vitorfhc

GQLSpection

GQLSpection - parses GraphQL introspection schema and generates possible queries

pandoras_pot

A HellPot inspired HTTP honeypot to punish and educate unruly web crawlers, written in Rust (🚀)

DomainPasswordSpray

DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAREFUL NOT TO LOCKOUT ACCOUNTS!

automatisch

The open source Zapier alternative. Build workflow automation without spending time and money.

cargo-expand

Subcommand to show result of macro expansion

beef

The Browser Exploitation Framework Project

LaZagne

Credentials recovery project

pupy

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) C2 and post-exploitation framework written in python and C

Active-Directory-Exploitation-Cheat-Sheet

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

darkarmour

Windows AV Evasion

nishang

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

Mythic

A collaborative, multi-platform, red teaming framework

sliver

Adversary Emulation Framework

Responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

impacket

Impacket is a collection of Python classes for working with network protocols.

smbcrawler

smbcrawler is no-nonsense tool that takes credentials and a list of hosts and 'crawls' (or 'spiders') through those shares

zap

:zap: Zap is a minimal zsh plugin manager

proxychains

proxychains - a tool that forces any TCP connection made by any given application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy. Supported auth-types: "user/pass" for SOCKS4/5, "basic" for HTTP.

xsshunter

jaeles

The Swiss Army knife for automated Web Application Testing

subjs

Fetches javascript file from a list of URLS or subdomains.

Autorize

Automatic authorization enforcement detection extension for burp suite written in Jython developed by Barak Tawily in order to ease application security people work and allow them perform an automatic authorization tests

Find-Hardcoded

You can find hardcoded Api-Key,Secret,Token Etc..

4-ZERO-3

403/401 Bypass Methods + Bash Automation + Your Support ;)

mkpath

Make URL path combinations using a wordlist

mksub

Generate tens of thousands of subdomain combinations in a matter of seconds

inventory

Asset inventory of over 800 public bug bounty programs.

dsieve

Filter and enrich a list of subdomains by level

Beetlebug

Beetlebug is an open source insecure Android application with CTF challenges built for Android Penetration Testers and Bug Bounty hunters.

tbhm

The Bug Hunters Methodology