Synacktiv

php_filter_chain_generator

frinet

Frida-based tracer for easier reverse-engineering on Android, iOS, Linux, Windows and most related architectures.

eos

Enemies Of Symfony - Debug mode Symfony looter

GPOddity

The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying (and more).

nord-stream

Nord Stream is a tool that allows you to extract secrets stored inside CI/CD environments by deploying malicious pipelines. It currently supports Azure DevOps, GitHub and GitLab.

php_filter_chains_oracle_exploit

A CLI to exploit parameters vulnerable to PHP filter chain error based oracle.

QLinspector

Finding Java gadget chains with CodeQL

CVE-2023-35001

Pwn2Own Vancouver 2023 Ubuntu LPE exploit

Mindmaps

Azure mindmap for penetration tests

DLHell

Local & remote Windows DLL Proxying

rulesfinder

Machine-learn password mangling rules

ntdissector

Invoke-RunAsWithCert

A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine.

shh

Systemd Hardening Helper

bbs

bbs is a router for SOCKS and HTTP proxies. It exposes a SOCKS5 (or HTTP CONNECT) service and forwards incoming requests to proxies or chains of proxies based on the request's target. Routing can be configured with a PAC script (if built with PAC support), or through a JSON file.

Prox-Ez

OUned

The OUned project automating Active Directory Organizational Units ACL exploitation through gPLink poisoning

keebcap

Win32 keylogger that supports all (non-ime using) languages correctly

Weggli_rules_SSTIC2023

pcapan

A pcap capture analysis helper

canon-mf644

EIPP

Entra ID Password Protection Banned Password Lists

CVE-2020-9289

Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only difference with CVE-2019-6693 is the encryption routine).

Arlo

Arlo file format helper

forensic-msvpn

This repository contains Velociraptor artifact and Chainsaw rules to help detect Microsoft Remote Access VPN activity

krustyloader-analysis

KrustyLoader Analysis

dissect.esedb

A Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB), used for example in Active Directory, Exchange and Windows Update.

gh-hijack-runner

A python script to create a fake GitHub runner and hijack pipeline jobs to leak CI/CD secrets.

ysoserial

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

CacheData_decrypt

A simple Toolkit to BF and decrypt Windows EntraId CacheData