Archaeologit This script scans the history of a user’s GitHub repositories for a given pattern to find sensitive things that may have been there but has been overwritten in a later commit. For example...
DumpsterDiver DumpsterDiver is a tool used to analyze big volumes of various file types in search of hardcoded secret keys (e.g. AWS Access Key, Azure Share Key or SSH keys) based on counting the...
Reddit Account Analyzer A tool to analyze a Reddit account based on their submissions and comments. The tool prints back the following information: Karma Scores Account creation date and age Average activity by the...
HandyHeaderHacker HandyHeaderHacker is a script to examine HTTP responses from a server for best security practices. While HandyHeaderHacker is nowhere near completion it is in a state where you can quickly analyze a web...
WebBorer WebBorer is a directory-enumeration tool written in Go and targeting CLI usage. This project was formerly named ‘GoBuster’, but that had a namespace collision with OJ Reeves’ excellent tool (which was released about...
mitmproxy mitmproxy is an interactive, SSL-capable intercepting proxy with a console interface. mitmdump is the command-line version of mitmproxy. Think tcpdump for HTTP. mitmweb is a web-based interface for mitmproxy. pathoc and pathod are...
DOT – Darknet OSINT Transform What does this do? It fetches open ports, banners, emails, BTC addresses, linked onions domains and other (soon). Where are the infos stored? The infos are stored in a...
Gitmails explores that git commits contain a name and an email configured by the author and that version control host services are being used to store a lot of projects. What Gitmails does is:...
Sanitiz3r Sanitiz3r is a lightweight tool designed to filter based on a set of defined rules and determine the validity of subdomains of a website discovered through a bunch of recon tools for enumerating...
DART: A Documentation and Reporting Tool DART is a test documentation tool created by the Lockheed Martin Red Team to document and report on penetration tests, especially in isolated network environments. The goals of...
CloudScraper is a Tool to spider and scrape targets in search of cloud resources. Plug in a URL and it will spider and search the source of spidered pages for strings such as ‘s3.amazonaws.com’,...
hsecscan A security scanner for HTTP response headers. Installation Requirement: Python 2.x Usage Example Copyright (C) 2015 riramar Source: https://github.com/riramar/
Tips and Tricks / WebApp PenTest
by do son · Published July 19, 2018 · Last modified October 10, 2021
PNG-IDAT-Payload-Generator Generate a PNG with a payload embedded in the IDAT chunk (Based off of previous concepts and code — credit given below) Additionally, bruteforce payloads matching a regex pattern ##Based Off of Previous...
Scout2 is a security tool that lets AWS administrators assess their environment’s security posture. Using the AWS API, Scout2 gathers configuration data for manual inspection and highlights high-risk areas automatically. Rather than pouring through...
Web Exploitation / Web Vulnerability Analysis / WebApp PenTest
by do son · Published July 14, 2018 · Last modified October 10, 2021
Tplmap Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operating system. The tool and its test suite...
Secure Your Connection
