michalkoczwara

BloodHound

Six Degrees of Domain Admin

bluebox-ng

Pentesting framework using Node.js powers. Specially focused in VoIP/UC.

CloudFail

Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

clusterd

application server attack toolkit

CrackMapExec

A swiss army knife for pentesting networks

cs-suite

Cloud Security Suite - One stop tool for auditing the security posture of AWS infrastructure.

cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system

DeathStar

Automate getting Domain Admin using Empire (https://github.com/EmpireProject/Empire)

DET

(extensible) Data Exfiltration Toolkit (DET)

dockerscan

Docker security analysis & hacking tools

dvna

Damn Vulnerable NodeJS Application

fame

FAME Automates Malware Evaluation

fibratus

Tool for exploration and tracing of the Windows kernel

fuzzapi

Fuzzapi is a tool used for REST API pentesting and uses API_Fuzzer gem

github-dorks

Collection of github dorks and helper tool to automate the process of checking dorks

glastopf

Web Application Honeypot

gym-malware

HttpPwnly

"Repeater" style XSS post-exploitation tool for mass browser control. Primarily a PoC to show why HttpOnly flag isn't a complete protection against session hijacking via XSS

intrigue-core

Identify your attack surface!

king-phisher

Phishing Campaign Toolkit

koadic

Koadic C3 COM Command & Control - JScript RAT

metasploit-framework

Metasploit Framework

passionfruit

[WIP] Crappy iOS app analyzer

phishing_catcher

Phishing catcher using Certstream

pupy

Pupy is an opensource, multi-platform (Windows, Linux, OSX, Android), multi function RAT (Remote Administration Tool) mainly written in python. It features a all-in-memory execution guideline and leaves very low footprint. Pupy can communicate using various transports, migrate into processes (reflective injection), load remote python code, python packages and python C-extensions from memory.

PyExfil

A Python Package for Data Exfiltration

SecGen

Create randomly insecure VMs

sneaky-creeper

Get your APT on using social media as a tool for data exfiltration.

uncaptcha

Defeating Google's audio reCaptcha with 85% accuracy.

xsscrapy

XSS spider - 66/66 wavsep XSS detected