9ak47er Goto Github PK

0day

各种CMS、各种平台、各种系统、各种软件漏洞的EXP、POC 该项目将不断更新

9ak47er.github.io

adexplorersnapshot.py

ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.

aksk_tool

AK资源管理工具，阿里云/腾讯云/华为云/AWS/UCLOUD/京东云/百度云/七牛云存储 AccessKey AccessKeySecret，利用AK获取资源信息和操作资源，ECS/CVM/E2/UHOST/ECI/BCC执行命令，OSS/COS/S3/BOS管理，RDS/DB管理，域名管理，添加RAM/CAM/IAM账号等

api-t00l

互联网厂商API利用工具。

arl

ARL(Asset Reconnaissance Lighthouse)资产侦察灯塔系统旨在快速侦察与目标关联的互联网资产，构建基础资产信息库。 协助甲方安全团队或者渗透测试人员有效侦察和检索资产，发现存在的薄弱点和攻击面。

azureoutlookc2

Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37. TTP: Use Microsoft Graph API for C2 Operations.

browserghost

这是一个抓取浏览器密码的工具，后续会添加更多功能

bundler-bypass

免杀捆绑器，过国内主流杀软。A Bundler bypass anti-virus

bypassgodzilla

哥斯拉WebShell免杀生成 / Code By:Tas9er

cdk

CDK is an open-sourced container penetration toolkit, offering stable exploitation in different slimmed containers without any OS dependency. It comes with penetration tools and many powerful PoCs/EXPs helps you to escape container and takeover K8s cluster easily.

cf

云环境利用框架（Cloud exploitation framework）主要用来方便红队人员在获得 AK 的后续工作。

crackmapexec

A swiss army knife for pentesting networks

curlshell

reverse shell using curl

cve-2021-22205

GitLab CE/EE Preauth RCE using ExifTool

cve-2023-21939

JDK CVE-2023-21939

cve-2024-21683-rce

CVE-2024-21683 Post Auth RCE

cve-2024-22120-rce

Time Based SQL Injection in Zabbix Server Audit Log --> RCE

ehole

EHole(棱洞)3.0 重构版-红队重点攻击系统指纹探测工具

faketoa

Fake IP sources using Linux's BPF feature

fastjson-check

fastjson 被动扫描、不出网payload生成

fofax

fofax is a command line query tool based on the API of https://fofa.info/, simple is the best!

free-programming-books

:books: Freely available programming books

fscan

一款内网扫描工具，方便一键大保健~

go-common

哔哩哔哩 bilibili 网站后台工程 源码

go-proxy-checker

High Performance HTTP(S) Proxy Checker Written in GO

gofilebinder

golang免杀捆绑器

gopherus

This tool generates gopher link for exploiting SSRF and gaining RCE in various servers

hackbrowserdata

Decrypt passwords/cookies/history/bookmarks from the browser. 一款可全平台运行的浏览器数据导出解密工具。

hackeronereports

Here you can find mostly all disclosed h1 reports