infosec-au

dive

A tool for exploring each layer in a docker image

pure-sh-bible

📖 A collection of pure POSIX sh alternatives to external processes.

Recaf

The modern Java bytecode editor

apk-mitm

🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection

cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

legba

A multiprotocol credentials bruteforcer / password sprayer and enumerator. 🥷

jsluice

Extract URLs, paths, secrets, and other interesting bits from JavaScript

nuclei-wordfence-cve

The EXCLUSIVE Collection of 38,000+ Nuclei templates based on Wordfence intel. Daily updates for bulletproof WordPress security.

ShadowClone

Unleash the power of cloud

rogue_mysql_server

A rouge mysql server supports reading files from most mysql libraries of multiple programming languages.

shortscan

An IIS short filename enumeration tool

noir

Attack surface detector that identifies endpoints by static analysis

aws-security-survival-kit

Bare minimum AWS Security Alerting and Configuration

curlshell

reverse shell using curl

humanify

Deobfuscate Javascript code using ChatGPT

PIPE

Prompt Injection Primer for Engineers

cnext-exploits

Exploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv()

route-detect

Find authentication (authn) and authorization (authz) security bugs in web application routes.

wapalyzer

🌐 Identify the technologies powering any website. This is a fork of the now deleted Wappalyzer project by @AliasIO and community.

grepmarx

A source code static analysis platform for AppSec enthusiasts.

hackvertor

HttpRemotingObjRefLeak

Additional resources for leaking and exploiting ObjRefs via HTTP .NET Remoting (CVE-2024-29059)

EC2StepShell

EC2StepShell is an AWS post-exploitation tool for getting high privileges reverse shells in public or private EC2 instances.

grepaddr

Use grepaddr to extract (grep) all kinds of addresses from stdin like URLs (incl. IPv4/IPv6), IP addresses & ranges (IPv4/IPv6), e-mail addresses, MAC addresses.

Todesstern

A simple mutator engine which focuses on finding unknown classes of injection vulnerabilities

pyyso

pyyso is a Python package that generate java serialized poc. Including CommonsCollections1-7, JDK7u21, JDK8u20, ldap for jndi, shiro-550, CommonsBeanutils1 no cc, JRMPClient, high version JDK Bypass, Fake MySQL for JDBC attack

Zero-E

Automates the network enumeration process in a fire-and-forget manner, among many more functions. Zero effort, zero error network enumeration.

nmapurls

Nmapurls parses Nmap xml reports from either piped input or command line arg and outputs a list of http(s) URL's to be used in an automation pipeline.

CodeSheriff.NET

rate-limit-queue

An implementation of rate limited queues in Python, thread-safe, using only built-in components