Ressurect0

drawio

draw.io is a JavaScript, client-side editor for general diagramming.

mimikatz

A little tool to play with Windows security

Rubeus

Trying to tame the three-headed dog.

ghauri

An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws

MailSniper

MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used as a non-administrative user to search their own email, or by an administrator to search the mailboxes of every user in a domain.

Neo-reGeorg

Neo-reGeorg is a project that seeks to aggressively refactor reGeorg

MicroBurst

A collection of scripts for assessing Microsoft Azure security

DSInternals

Directory Services Internals (DSInternals) PowerShell Module and Framework

Dumpert

LSASS memory dumper using direct system calls and API unhooking.

Freeze

Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods

SharPersist

Internal-Monologue

Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

xnLinkFinder

A python tool used to discover endpoints, potential parameters, and a target specific wordlist for a given target

TeamsPhisher

Send phishing messages and attachments to Microsoft Teams users

MSOLSpray

A password spraying tool for Microsoft Online accounts (Azure/O365). The script logs if a user cred is valid, if MFA is enabled on the account, if a tenant doesn't exist, if a user doesn't exist, if the account is locked, or if the account is disabled.

Locksmith

A small tool built to find and fix common misconfigurations in Active Directory Certificate Services.

Whisker

Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account.

SharpDllProxy

Retrieves exported functions from a legitimate DLL and generates a proxy DLL source code/template for DLL proxy loading or sideloading

sj

A tool for auditing endpoints defined in exposed (Swagger/OpenAPI) definition files.

frameless-bitb

A new approach to Browser In The Browser (BITB) without the use of iframes, allowing the bypass of traditional framebusters implemented by login pages like Microsoft and the use with Evilginx.

Amnesiac

Amnesiac is a post-exploitation framework entirely written in PowerShell and designed to assist with lateral movement within Active Directory environments

inthewilddb

Hourly updated database of exploit and exploitation reports

bambdas

Bambdas collection for Burp Suite Professional and Community.

sheye

Opensource assets and vulnerability scanning tool

github_cves_search

Find CVEs associated to Linux and public exploits on github

Omnispray

Modular Enumeration and Password Spraying Framework

veeam-creds

Collection of scripts to retrieve stored passwords from Veeam Backup

Apache-OFBiz-Authentication-Bypass

This repo is a PoC with to exploit CVE-2023-51467 and CVE-2023-49070 preauth RCE vulnerabilities found in Apache OFBiz.

ofbiz-CVE-2023-49070-RCE-POC

Favicon-Hash-For-Shodan.io

this script will help you find favicon hashes which you can use to shodan to get more details about an asset