RedWarden : Flexible CobaltStrike Malleable Redirector
Red Teaming business has seen several different great ideas on how to combat incident responders and misdirect them while offering resistant C2 redirectors network at the same time. This work combines many of those great ideas into a one, lightweight utility, mimicking Apache2 in it's roots of being a simple HTTP(S) reverse-proxy. Combining Malleable C2 profiles understanding, knowledge of bad IP addresses pool and a...
Kaiju : A Binary Analysis Framework Extension For The Ghidra Software Reverse Engineering Suite
CERT Kaiju is a collection of binary analysis tools for Ghidra. This is a Ghidra/Java implementation of some features of the CERT Pharos Binary Analysis Framework, particularly the function hashing and malware analysis tools, but is expected to grow new tools and capabilities over time. As this is a new effort, this implementation does not yet have full feature parity with the...
Link : A Command And Control Framework Written In Rust
Link provides MacOS, Linux and Windows implants which may lack the necessary evasive tradecraft provided by other more mature command and control frameworks. Tested on Linux only. Features Hopefully this list expands for humans to actually want to use this: HTTPS communicationProcess injectionIn-memory .NET assembly executionSharpCollection toolssRDI implementation for shellcode generationWindows link reloads DLLs from disk into current process Build Process Clone or download the...
Caronte : A Tool To Analyze The Network Flow During Attack/Defence Capture The Flag Competitions
Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using protocol specific rules. The connection flows are saved into a database and can...
Metarget : Framework Providing Automatic Constructions Of Vulnerable Infrastructures
Metarget = meta- + target, a framework providing automatic constructions of vulnerable infrastructures, used to deploy simple or complicated vulnerable cloud native targets swiftly and automatically. Why Metarget? During security researches, we might find that the deployment of vulnerable environment often takes much time, while the time spent on testing PoC or ExP is comparatively short. In the field of cloud native security, thanks...
magicRecon : A Powerful Shell Script To Maximize The Recon And Data Collection Process Of An Objective And Finding Common Vulnerabilities
MagicRecon is a powerful shell script to maximize the recon and data collection process of an objective and finding common vulnerabilities, all this saving the results obtained in an organized way in directories and with various formats. The new version of MagicRecon has a large number of new tools to automate as much as possible the process of collecting data...
403Fuzzer : Fuzz 403/401Ing Endpoints For Bypasses
403Fuzzer will check the endpoint with a couple of headers such as X-Forwarded-For It will also apply different payloads typically used in dir traversals, path normalization etc. to each endpoint on the path. e.g. /%2e/test/test2 /test/%2e/test2 /test;/test2/ Usage usage: 403fuzzer.py use this script to fuzz endpoints that return a 401/403optional arguments:-h, --help show this help...
CheeseTools : Self-developed Tools For Lateral Movement/Code Execution
The CheeseTools has been made basing onto the already existing MiscTool, so big shout-out to rasta-mouse for releasing them and for giving me the right motivation to work on them. CheeseExec Command Exec / Lateral movement via PsExec-like functionality. Must be running in the context of a privileged user. The tool is based on rasta-mouse CsExec, but is designed to allow additional control over the service...
IMAPLoginTester : Script That Reads A Text File With Lots Of E-Mails And Passwords
IMAPLoginTester is a simple Python script that reads a text file with lots of e-mails and passwords, and tries to check if those credentials are valid by trying to login to the respective IMAP servers. Usage usage: imaplogintester.py -i INPUT optional arguments:-h, --help show this help message and exit-i INPUT, --input INPUTinput file with e-mails and...
HookDump : Security Product Hook Detection
HookDump is a tool for security product hook detection. Building Source In order to build this you will need Visual Studio 2019 (community edition is fine) and CMake. The batch file Configure.bat will create two build directories with Visual Studio solutions.The project may build with MinGW with the correct CMake command line, this is untested YMMV.There is a dependency on zydis...
