Exploitation / Network PenTest / Post Exploitation / Web Information Gathering / WebApp PenTest
by do son · Published September 28, 2018
tactical-exploitation I’ve always been a big proponent of a tactical approach to penetration testing that does not focus on exploiting known software vulnerabilities but relies on old-school techniques such as information gathering and brute...
autoDANE is a tool to automate the process of mapping and compromising internal networks. Given the prevalence of Microsoft Active Directory domains as the primary means of managing large corporate networks globally; one of...
rop-tool v2.4.2 A tool to help you writing binary exploits FEATURES String searching, Gadget searching, patching, info, heap visualization, disassembling Colored output Intel and AT&T flavor Support of ELF, PE and MACH-O binary format...
Fuzzinator Fuzzinator is a framework helping you to deal with the common fuzzing tasks, like running fuzz jobs, updating the targets, and reducing the inputs that induced failures. The figure below shows a high-level overview...
ipv4Bypass Using IPv6 to Bypass Security how the tool works 1) Sends an ICMP echo request (ping6 ff02::1%eth0) to the broadcast address (ff02::1), all IPv6 hosts in the local network will reply 2) Sends...
ibombshell – Dynamic Remote Shell ibombshell is a tool written in Powershell that allows you to have a prompt at any time with post-exploitation functionalities (and in some cases exploitation). It is a shell that...
Exploitation / Network PenTest
by do son · Published September 4, 2018 · Last modified January 21, 2022
Macro Pack The macro_pack is a tool used to automatize obfuscation and generation of MS Office documents for pentest, demo, and social engineering assessments. The goal of macro_pack is to simplify antimalware solutions bypass...
DR.CHECKER: A Soundy Vulnerability Detection Tool for Linux Kernel Drivers 1. Setup Our implementation is based on LLVM, specifically LLVM 3.8. We also need tools like c2xml to parse headers. First, make sure that you have...
whoof (Web-Browser Hooking Framework) whoof is an early stage lightweight web browser hooking framework. A web browser hook can be thought of as a backdoor in a web page allowing an attacker to execute...
Exploitation / Social Engineering
by do son · Published August 25, 2018 · Last modified October 10, 2021
Invoke-NoShell Invoke-NoShell outputs a Mircosoft Office Word .doc file with an embedded macro. It allows the automation of multiple similar versions of files, allowing to test how slight differences will affect it. Currently, only...
Ruler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol. The main aim is to abuse the client-side Outlook features and gain a shell...
Inception Framework Inception provides In-memory compilation and reflective loading of C# apps for AV evasion. Payloads are AES encrypted before transmission and are decrypted in memory. The payload server ensures that payloads can only...
SCALE: Side-Channel Attack Lab. Exercises Alongside the implementation of cryptography in hardware and software, attacks on those implementations (plus associated countermeasures) form a central challenge in cryptographic engineering. This topic is sometimes termed physical security, but, either...
boofuzz: Network Protocol Fuzzing for Humans It is a fork of and the successor to the venerable Sulley fuzzing framework. Besides numerous bug fixes, it aims for extensibility. The goal: fuzz everything. Features Like Sulley, boofuzz...
OWASP ZSC THIS SOFTWARE WAS CREATED TO CHALLENGE ANTIVIRUS TECHNOLOGY, RESEARCH NEW ENCRYPTION METHODS, AND PROTECT SENSITIVE OPEN SOURCE FILES WHICH INCLUDE IMPORTANT DATA. CONTRIBUTORS AND OWASP FOUNDATION WILL NOT BE RESPONSIBLE FOR ANY...
Secure Your Connection
