chenpengxiao Goto Github PK

amass

In-depth Attack Surface Mapping and Asset Discovery

arsenal

Cobalt Strike 3.13 Arsenal Kit

attackwebframeworktools-5.0

本软件首先集成危害性较大框架和部分主流cms的rce(无需登录,或者登录绕过执行rce)和反序列化(利用链简单)。傻瓜式导入url即可实现批量getshell。批量自动化测试。例如:Thinkphp,Struts2,weblogic。出现的最新漏洞进行实时跟踪并且更新例如:log4jRCE,向日葵RCE 等等.

attck-tools-library

TimelineSec ATT&CK 工具库

bypass-beacon-config-scan

Bypass cobaltstrike beacon config scan

charlotte

c++ fully undetected shellcode launcher ;)

cobalt-wipe

Cobalt wipe is the non-commercial version of Cobalt-Strike 4.3 (May 2021 Release)

cobaltstrike

CobaltStrike's source code

cve-2021-1675

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527

cve-2021-1675-lpe

Local Privilege Escalation Edition for CVE-2021-1675

cve-2021-3156

cve-2021-4034

CVE-2021-4034 1day

foundations-for-analytics-with-python

githacker

🕷️ A Git source leak exploit tool that restores the entire Git repository, including data from stash, for white-box auditing and analysis of developers' mind

httpx

A next generation HTTP client for Python. 🦋

java-rce-echo

Java RCE 回显测试代码

malleable-c2-profiles

Cobalt Strike - Malleable C2 Profiles. A collection of profiles used in different projects using Cobalt Strike https://www.cobaltstrike.com/.

neteasecloudmusicapi

网易云音乐 Node.js API service

oneforall

OneForAll是一款功能强大的子域收集工具

poc-bomber

利用大量高威胁poc/exp快速获取目标权限，用于渗透和红队快速打点

printnightmare

pystinger

Bypass firewall for traffic forwarding using webshell 一款使用webshell进行流量转发的出网工具

rules

Repository of yara rules

serein

【懒人神器】一款图形化、批量采集url、批量对采集的url进行各种nday检测的工具。可用于src挖掘、cnvd挖掘、0day利用、打造自己的武器库等场景。可以批量利用Actively Exploited Atlassian Confluence 0Day CVE-2022-26134和DedeCMS v5.7.87 SQL注入 CVE-2022-23337。

spring4shell_behinder

CVE-2022-22965写入冰蝎webshell脚本

uacme

Defeating Windows User Account Control

yara

The pattern matching swiss knife

z1-aggressorscripts

适用于Cobalt Strike的插件