GoSecure

pyrdp

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

dtd-finder

List DTDs and generate XXE payloads using those local DTDs.

pywsus

Standalone implementation of a part of the WSUS spec. Built for offensive security purposes.

php7-opcache-override

Security-related PHP7 OPcache abuse tools and demo

template-injection-workshop

Workshop on Template Injection (6 exercises) covering Twig, Jinja2, Tornado, Velocity and Freemaker engines.

xxe-workshop

Workshop given at Hack in Paris 2019

ldap-scanner

Checks for signature requirements over LDAP

frida-xamarin-unpin

A Frida script to bypass Xamarin certificate pinning implementations

presentations

Material from presentations done by GoSecure researchers

request-smuggling-workshop

prompt

AI-based implant feature

unicode-pentester-cheatsheet

An easy to navigate list of unicode characters that have risky transformations 💥

zap-autodecode-view

ZAP plugin demonstrating custom view for WebSocket messages.

goinsecure-deserialization

Accompanying material needed for the workshop

malware-ioc

Indicators of Compromise (IOCs) for malware we have researched

burp-fuzzy-encoding-generator

Quickly test various encoding for a given value in Burp Intruder

fq-pyrdp

fq format for parsing PyRDP replays

hack400tool

hack400tool

Nimcrypt2

.NET, PE, & Raw Shellcode Packer/Loader Written in Nim

notebooks

Cybersecurity Research Jupyter Notebooks for the Community

peas

PEAS is a Python 2 library and command line application for running commands on an ActiveSync server e.g. Microsoft Exchange.

pwndoc

Pentest Report Generator

scoutmerge

ScoutMerge is an extension for ScoutSuite allowing you to easily display results of hundreds of projects audits into a single text file.

csp-evaluator

gosecure.github.io

jupyterhub-workshop-environment

Opinionated JupyterHub deployment for workshops relying on GitHub for Authentication

jupyterhub-workshop-environment-legacy

Opinionated JupyterHub deployment for workshops relying on GitHub for Authentication

missing-security-controls

Spray365

Spray365 makes spraying Microsoft accounts (Office 365 / Azure AD) easy through its customizable two-step password spraying approach. The built-in execution plan features options that attempt to bypass Azure Smart Lockout and insecure conditional access policies.

TrainingContent