ls4cfk

Pentest-Tools

automatic-api-attack-tool

Imperva's customizable API attack tool takes an API specification as an input, generates and runs attacks that are based on it as an output.

avatarify-python

Avatars for Zoom, Skype and other video-conferencing apps.

php-exploit-scripts

A collection of PHP exploit scripts, found when investigating hacked servers. These are stored for educational purposes and to test fuzzers and vulnerability scanners. Feel free to contribute.

hardcodes

find hardcoded strings from source code

Spring-Boot-Actuator-Exploit

Spring Boot Actuator (jolokia) XXE/RCE

axiom

The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!

penglab

🐧 Abuse of Google Colab for cracking hashes.

android-afl

Fuzzing Android program with american fuzzy lop (AFL)

jackit

JackIt - Exploit Code for Mousejack

openvas-docker

A Docker container for Openvas

chaos-client

Go client to communicate with Chaos DB API.

Ghost

Ghost Framework is an Android post-exploitation framework that exploits the Android Debug Bridge to remotely access an Android device.

httpx

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

shiva

An Ansible playbook to provision a host for penetration testing and CTF challenges

reverseme

A quick reference script that can easily display reverse shells for different languages.

BugBountyTemplate

A simple Cherry Tree template that can be used to organize bug bounties

siege

Siege is an http load tester and benchmarking utility

py_django_crack

Crack the django password on the way. By default Django use pbkdf2 and sha256 method to encrypt user's password. Once get the password stored in the database table, you need to compare it with others if brute force cracking. It is recommended that you use hash table comparison. The tool 'rainbow crack' can generate rainbow hash tables while another tool 'hashcat' brute-force cracks password from a dictionary alive. Because django uses PBKDF2(Password-Based Key Derivation Function), it would take too long to generate a password.

nuclei-templates

Community curated list of templates for the nuclei engine to find security vulnerabilities.

MonitorControl

🖥 Control your display's brightness & volume on your Mac as if it was a native Apple Display. Use Apple Keyboard keys or custom shortcuts. Shows the native macOS OSDs.

AFL

american fuzzy lop - a security-oriented fuzzer

docker-flask-example

A generic python/Flask app with a Docker file

pwncat

pwncat - netcat on steroids with Firewall, IDS/IPS evasion, bind and reverse shell, self-injecting shell and port forwarding magic - and its fully scriptable with Python (PSE)

awesome-jenkins-rce-2019

There is no pre-auth RCE in Jenkins since May 2017, but this is the one!

CTF-pwn-tips

Here record some tips about pwn. Something is obsoleted and won't be updated. Sorry about that.

TJ-JPT

This repo contains my pentesting template that I have used in PWK and for current assessments. The template has been formatted to be used in Joplin

BugBounty_Profile

Recon_profile

Gf-Patterns

GF Paterns For (ssrf,RCE,Lfi,sqli,ssti,idor,url redirection,debug_logic, interesting Subs) parameters grep

XXE-OOB-Exploitation-Toolset-for-Automation

XXE OOB Exploitation Toolset for Automation