Repository Index

RedTeam/Pentest notes and experiments tested on several infrastructures related to professional engagements.

• pentesting
• redteam
• security-tools
• exploit

Passive Security Scanner (被动式安全扫描器)

• security-tools
• passive-vulnerability-scanner

Windows exploits, mostly precompiled. Not being updated. Check https://github.com/SecWiki/windows-kernel-exploits instead.

• exploit
• windows
• compiled

Educational, CTF-styled labs for individuals interested in Memory Forensics

• forensics
• dfir
• memory-forensics
• windows

ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment.

Everything for pentest. | 渗透测试知识库，以 AI Agent 可执行的格式沉淀安全方法论。

• payload
• security
• dictionary
• fuzz

JWT login microservice with plugable backends such as OAuth2, Google, Github, htpasswd, osiam, ..

• jwt
• htpasswd
• service
• golang

403/401 bypass tool: finds HTTP access-control bypasses via path, method, header and raw-request mutations. Baseline diff, auto-calibration, replayable curl evidence.

• waf-bypass
• pentesting
• bugbounty
• ctf

一个高价值漏洞采集与推送服务 | Collect valueable vulnerabilities and push them to various services

• dingding-bot
• vulnerability
• vulnerability-analysis
• lark-bot

hacking-tool termux-tools termux noob-friendly instagram-bot bruteforce-password-cracker wordlist-technique

• hacking
• tool
• hacking-tool
• termux

Web vulnerability scanner written in Python3

一个关于PHP的代码审计项目

Self-hosted collaborative password manager for teams: folder-level access control, AES-256-GCM encryption, LDAP/AD, OAuth2 SSO, audit trail, REST API, browser extension. PHP/MySQL, Docker.

• php
• access-control
• audit
• browser-extension

Binary code static analyser, with IDA integration. Performs value and taint analysis, type reconstruction, use-after-free and double-free detection

• ida-plugin
• taint-analysis
• reverse-engineering
• disassembly

Build a database of libc offsets to simplify exploitation

• pwn
• libc
• offsets
• ctf

The ChameleonMini is a versatile contactless smartcard emulator compliant to NFC. The ChameleonMini was developed by https://kasper-oswald.de. The device is available at https://shop.kasper.it. For further information see the Getting Started Page https://rawgit.com/emsec/ChameleonMini/master/Doc/Doxygen/html/_page__getting_started.html or the Wiki tab above.

• nfc
• card
• contactless
• rfid

The Offensive Manual Web Application Penetration Testing Framework.

• web-penetration-testing
• reconnaissance
• vulnerability-analysis
• scanning-enumeration

Find exploits in local and online databases instantly

• exploits
• metasploit
• nmap
• pentest

A collection of malware samples caught by several honeypots i manage

• malware
• honeypot
• botnet
• malware-analysis

OSINT power without API key hassle

• osint
• security
• pentesting
• infosec

For basic researches, top 25 vulnerability parameters that can be used in automation tools or manual recon. 🛡️⚔️🧙

• vulnerability-detection
• vulnerability-research
• bugbounty
• pentesting

A tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)

• reverse-engineering
• linux-kernel
• linux
• vmlinux

This cheasheet is aimed at the CTF Players and Beginners to help them sort Hack The Box Labs on the basis of Operating System and Difficulty.

A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

• web
• application
• scanner
• osint