infosec-au

pure-sh-bible

📖 A collection of pure POSIX sh alternatives to external processes.

apk-mitm

🤖 A CLI application that automatically prepares Android APK files for HTTPS inspection

cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more

legba

A multiprotocol credentials bruteforcer / password sprayer and enumerator. 🥷

jsluice

Extract URLs, paths, secrets, and other interesting bits from JavaScript

nuclei-wordfence-cve

The EXCLUSIVE Collection of 37,000+ Nuclei templates based on Wordfence intel. Daily updates for bulletproof WordPress security.

api_wordlist

A wordlist of API names for web application assessments

ShadowClone

Unleash the power of cloud

rogue_mysql_server

A rouge mysql server supports reading files from most mysql libraries of multiple programming languages.

shortscan

An IIS short filename enumeration tool

GadgetProbe

Probe endpoints consuming Java serialized objects to identify classes, libraries, and library versions on remote Java classpaths.

WordList

noir

Attack surface detector that identifies endpoints by static analysis

aws-security-survival-kit

Bare minimum AWS Security Alerting and Configuration

curlshell

reverse shell using curl

PIPE

Prompt Injection Primer for Engineers

humanify

Deobfuscate Javascript code using ChatGPT

route-detect

Find authentication (authn) and authorization (authz) security bugs in web application routes.

wapalyzer

🌐 Identify the technologies powering any website. This is a fork of the now deleted Wappalyzer project by @AliasIO and community.

grepmarx

A source code static analysis platform for AppSec enthusiasts.

hackvertor

graphicator

A GraphQL enumeration and extraction tool

grepaddr

Use grepaddr to extract (grep) all kinds of addresses from stdin like URLs (incl. IPv4/IPv6), IP addresses & ranges (IPv4/IPv6), e-mail addresses, MAC addresses.

EC2StepShell

EC2StepShell is an AWS post-exploitation tool for getting high privileges reverse shells in public or private EC2 instances.

pyyso

pyyso is a Python package that generate java serialized poc. Including CommonsCollections1-7, JDK7u21, JDK8u20, ldap for jndi, shiro-550, CommonsBeanutils1 no cc, JRMPClient, high version JDK Bypass, Fake MySQL for JDBC attack

nmapurls

Nmapurls parses Nmap xml reports from either piped input or command line arg and outputs a list of http(s) URL's to be used in an automation pipeline.

rsu-cracker

hot-jar-swapping-urlclassloader

Demo of the URLClassLoader JAR-swapping showing the ability to replace and exploit an already loaded JAR with inner classes

interactsh-client-python

rate-limit-queue

An implementation of rate limited queues in Python, thread-safe, using only built-in components