GoSecure

pyrdp

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

dtd-finder

List DTDs and generate XXE payloads using those local DTDs.

php7-opcache-override

Security-related PHP7 OPcache abuse tools and demo

pywsus

Standalone implementation of a part of the WSUS spec. Built for offensive security purposes.

template-injection-workshop

Workshop on Template Injection (6 exercises) covering Twig, Jinja2, Tornado, Velocity and Freemaker engines.

xxe-workshop

Workshop given at Hack in Paris 2019

ldap-scanner

Checks for signature requirements over LDAP

frida-xamarin-unpin

A Frida script to bypass Xamarin certificate pinning implementations

linkedin-osint

A simple proof of concept that demonstrate how emails can easily be tie to LinkedIn profile

presentations

Material from presentations done by GoSecure researchers

request-smuggling-workshop

unicode-pentester-cheatsheet

An easy to navigate list of unicode characters that have risky transformations 💥

zap-autodecode-view

ZAP plugin demonstrating custom view for WebSocket messages.

goinsecure-deserialization

Accompanying material needed for the workshop

malware-ioc

Indicators of Compromise (IOCs) for malware we have researched

burp-fuzzy-encoding-generator

Quickly test various encoding for a given value in Burp Intruder

fq-pyrdp

fq format for parsing PyRDP replays

hack400tool

hack400tool

Nimcrypt2

.NET, PE, & Raw Shellcode Packer/Loader Written in Nim

peas

PEAS is a Python 2 library and command line application for running commands on an ActiveSync server e.g. Microsoft Exchange.

pwndoc

Pentest Report Generator

gosecure.github.io

missing-security-controls

notebooks

Cybersecurity Research Jupyter Notebooks for the Community

ScoutSuite

Multi-Cloud Security Auditing Tool

Spray365

Spray365 makes spraying Microsoft accounts (Office 365 / Azure AD) easy through its customizable two-step password spraying approach. The built-in execution plan features options that attempt to bypass Azure Smart Lockout and insecure conditional access policies.

csp-evaluator

jupyterhub-workshop-environment

Opinionated JupyterHub deployment for workshops relying on GitHub for Authentication

jupyterhub-workshop-environment-legacy

Opinionated JupyterHub deployment for workshops relying on GitHub for Authentication

scoutmerge

ScoutMerge is an extension for ScoutSuite allowing you to easily display results of hundreds of projects audits into a single text file.