onebitsec Goto Github PK

apache-log4j-rce-poc

arjun

HTTP parameter discovery suite.

awesome-list-of-secrets-in-environment-variables

🦄🔒 Awesome list of secrets in environment variables 🖥️

bit-cannon

Here are some penetration testing tools commonly used by 1 bit teams

cve-2021-44228-log4j-payloads

cve-2022-20699

Cisco Anyconnect VPN unauth RCE (rwx stack)

cvebase.com

cvebase is a community-driven vulnerability data platform to discover the world's top security researchers and their latest disclosed vulnerabilities & PoCs

domain_hunter_pro

domain_hunter的高级版本，SRC挖洞、HW打点之必备！自动化资产收集；快速Title获取；外部工具联动；等等

ffuf

Fast web fuzzer written in Go

fuzzdicts

Web Pentesting Fuzz 字典,一个就够了。

httpx

httpx is a fast and multi-purpose HTTP toolkit allows to run multiple probers using retryablehttp library, it is designed to maintain the result reliability with increased threads.

installerfiletakeover

javasec

Java安全，漏洞分析/挖掘/利用

kerberoast

known_hosts-hashcat

A guide and tool for cracking ssh known_hosts files with hashcat

krbrelayx

Kerberos unconstrained delegation abuse toolkit

langsrccurise

SRC子域名资产监控

lazagne

Credentials recovery project

log4j2-cve-2021-44228

Remote Code Injection In Log4j

lolbas

Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

mimikatz

A little tool to play with Windows security

onebitsec.github.io

oscp-prep-cheatsheet

poc

Advisories, proof of concept files and exploits that have been made public by @pedrib.

powertools

PowerTools is a collection of PowerShell projects with a focus on offensive operations.

reconftw

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

rogue-mysql-server

Rogue MySql Server

seclists

SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

tickey

Tool to extract Kerberos tickets from Linux kernel keys.