txrw Goto Github PK

jndi-injection-exploit

JNDI注入测试工具（A tool which generates JNDI links can start several servers to exploit JNDI Injection vulnerability,like Jackson,Fastjson,etc）

jndiscan

无须借助dnslog且完全无害的JNDI反连检测工具，解析RMI和LDAP协议实现，可用于甲方内网自查

ladon

大型内网渗透扫描器&Cobalt Strike，包含信息收集/存活主机/IP扫描/端口扫描/服务识别/网络资产/密码爆破/漏洞检测/漏洞利用。漏洞检测含MS17010、Weblogic、ActiveMQ、Tomcat、Struts2系列等，密码口令爆破含(Mysql、Oracle、MSSQL)、FTP、SSH(Linux)、VNC、Windows(IPC、WMI、SMB、LDAP、SmbHash、WmiHash)等,可高度自定义插件支持.NET程序集、DLL(C#/Delphi/VC)、PowerShell等语言编写的插件,支持通过配置INI批量调用任意外部程序或命令,EXP生成器一键生成Web漏洞POC,可快速扩展扫描或利用能力。支持Cobalt Strike 3.X-4.0

linbing

本系统是对目标进行漏洞扫描的一个系统,前端采用vue技术,后端采用flask.核心原理是扫描主机的开放端口情况,然后根据端口情况逐个去进行poc检测,poc有110多个,包含绝大部分的中间件漏洞,本系统的poc皆来源于网络或在此基础上进行修改,在centons7环境下使用nginx和uwsgi部署,部署起来可能有点麻烦,烦请多点耐心

linkfinder

A python script that finds endpoints in JavaScript files

log4jscanner

lsposed

LSPosed Framework

magisk

The Magic Mask for Android

magisk-files

Magisk File Host

marshalsec

myexploit

OAExploit一款基于产品的一键扫描工具。

mysql_sql_bypass_wiki

mysql注入,bypass的一些心得

notquite0dayfriday

This is a repo which documents real bugs in real software to illustrate trends, learn how to prevent or find them more quickly.

oneforall

OneForAll是一款功能强大的子域收集工具

packer-fuzzer

Packer Fuzzer is a fast and efficient scanner for security detection of websites constructed by javascript module bundler such as Webpack.

password_brute_dictionary

口令爆破字典，有键盘组合字典、拼音字典、字母与数字混合这三种类型

pentest-tools

php-audit-labs

一个关于PHP的代码审计项目

php_bug_wiki

代码审计相关的一些知识

php_bugs

PHP代码审计分段讲解

phuip-fpizdam

Exploit for CVE-2019-11043

poclist

Alibaba-Nacos-Unauthorized/ApacheDruid-RCE_CVE-2021-25646/MS-Exchange-SSRF-CVE-2021-26885/Oracle-WebLogic-CVE-2021-2109_RCE/RG-CNVD-2021-14536/RJ-SSL-VPN-UltraVires/Redis-Unauthorized-RCE/TDOA-V11.7-GetOnlineCookie/VMware-vCenter-GetAnyFile/yongyou-GRP-U8-XXE/Oracle-WebLogic-CVE-2020-14883/Oracle-WebLogic-CVE-2020-14882/Apache-Solr-GetAnyFile/F5-BIG-IP-CVE-2021-22986/Sonicwall-SSL-VPN-RCE/GitLab-Graphql-CNVD-2021-14193/D-Link-DCS-CVE-2020-25078/WLAN-AP-WEA453e-RCE/360TianQing-Unauthorized/360TianQing-SQLinjection/FanWeiOA-V8-SQLinjection/QiZhiBaoLeiJi-AnyUserLogin/QiAnXin-WangKangFirewall-RCE

powercat

netshell features all in version 2 powershell

powersploit

PowerSploit - A PowerShell Post-Exploitation Framework

pykek

Kerberos Exploitation Kit

python

python爬虫

red-vs-blue

红蓝对抗交流心得

redis-rce

Redis 4.x/5.x RCE

redis-rogue-getshell

redis 4.x/5.x master/slave getshell module

redismodules-executecommand

Tools, utilities and scripts to help you write redis modules!