h4ck
1)fortune: random IPs scanner/generator
2)netbat : hosts + ports scanner, supports host list (+CIDR)
3)rtsp_brute: fuzz&brute rtsp cameras
4)vpn: connect to VPN server using openvpn
5)webmap: Scan web application for CMS, used techs, vulns (file, dir fuzz)
https://github.com/fagcinsk/h4ck
#scanner #fuzzer #redteam

OWASP Risk Assessment Calculator
source :
https://github.com/JavierOlmedo/OWASP-Calculator
online :
https://javierolmedo.github.io/OWASP-Calculator/
https://security-net.biz/files/owaspriskcalc.html
#owasp #Assessment #risk

C2 Powershell Command & Control Framework with BuiltIn Commands
کلیه ابزارهای تست نفوذ در قالب اسکریپت ها و ماژول های پاورشل برای بایپس آنتی ویروس
https://github.com/r00t-3xp10it/meterpeter
https://github.com/r00t-3xp10it/meterpeter/releases/tag/v2.10.8
#AMSI #powershell #FUD

kraker
is a distributed password brute-force system that focused on easy use.
https://github.com/zzzteph/kraker
#bruteforce #kraker #docker

Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices.
https://github.com/mvt-project/mvt
#android #ios #forensic

Cobalt Strike Beacon Object File (BOF) that takes the name of of a PE file as an argument and spawns the process in a suspended state
https://github.com/boku7/bof-spawnSuspendedProcess
#cobaltstrike

PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw function.
https://github.com/topotam/PetitPotam
#EFS #Windows

Meet Mushikago
=============
https://github.com/PowderKegTech/mushikago
Mushikago uses game AI technology to select and execute the most appropriate test content based on the environment in spot. The application of game AI technology to security products is new, and our work has shown that game AI is most suitable for penetration testing, where the content needs to change depending on the environment. In addition, Mushikago can automatically perform penetration testing in mixed environments of IT and OT(ICS), and can visualize and report the acquired device, account, and network information. The test contents are also displayed in a format consistent with MITRE ATT&CK. This allows the user to perform penetration testing at a certain level without manual intervention.
Features:
- Full Automatic penetration testing tool
- Device detection
- IT penetration testing
- ICS penetration testing
#penetrationtesting #pentesting #automation #ai #ics

A collection of Hacker API tools utilizing the HackerOne API. To build your own Hacker API integration have a look at our getting started docs.
https://github.com/Hacker0x01/awesome-hacker-api-tools
#hackerone #apitools

Beaconator
A beacon generator using Cobalt Strike and PEzor.
https://github.com/capt-meelo/Beaconator

Request smuggler
Http request smuggling vulnerability scanner
https://github.com/sh1yo/request_smuggler
HTTP Desync Attacks: Request Smuggling Reborn
https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
#request_smuggler

Medusa is a cross-platform C2 agent compatible with Python 2.7 and 3.8, compatible with Mythic
https://github.com/MythicAgents/Medusa
#c2 #python #medusa

ShellShockHunter
Scan via Shodan search engine then try figure out Vulnerable or not
https://github.com/MrCl0wnLab/ShellShockHunter
#ShellShockHunter

Ghost Eye Informationgathering Footprinting Scanner and Recon Tool Release. Ghost Eye is an Information Gathering Tool I made in python 3. To run Ghost Eye, it only needs a domain or ip. Ghost Eye can work with any Linux distros if they support Python 3. Author: Jolanda de Koff
https://github.com/BullsEye0/ghost_eye
#Ghost_eye #informationGathering

#Exegol is a fully featured and community-driven hacking environment
It can be used in pentest engagements, #bugbounty, #CTF, #HackTheBox, #OSCP lab & exam and so on. Exegol's original fate was to be a ready-to-hack docker in case of emergencies during engagements.
https://github.com/ShutdownRepo/Exegol

QuickXSS
Automating XSS using Bash
https://github.com/theinfosecguy/QuickXSS
#xss #xsshunter

Pure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM local privilege escalation
https://github.com/HuskyHacks/ShadowSteal
#LPE

https://us-cert.cisa.gov/ics/Downloading-and-Installing-CSET
https://github.com/cisagov/cset
#ICS #CSET

Authentication testing framework
https://github.com/DigeeX/raider

We developed GRAT2 Command & Control (C2) project for learning purpose.
https://github.com/r3nhat/GRAT2
https://hakin9.org/grat2-command-and-control-c2-tool-written-in-python3-and-the-client-in-net-4-0/
#C2 #python