secjia Goto Github PK

aazhen-v3.1

自研JavaFX图形化漏洞扫描工具，支持ThinkPHP 2.x RCE，Thinkphp5 5.0.22/5.1.29RCE，ThinkPHP5 5.0.23RCE和ThinkPHP5 SQL注入漏洞和敏感信息泄露漏洞的漏洞检测，以及命令执行的功能。漏洞POC基本适用ThinkPHP全版本漏洞。

ad-attack-defense

Attack and defend active directory using modern post exploitation adversary tradecraft activity

addmemshellsjsp

通过jsp注入valve内存马，可以忽略框架影响，通用tomcat789

afrog

一个挖洞工具 - A tool for finding vulnerabilities

alphagolang

IDApython Scripts for Analyzing Golang Binaries

ant_php_extension

PHP 扩展, 用于 PHP-FPM、FastCGI、LD_PRELOAD等模式下突破 disabled_functions

artillery

JAVA 插件化漏洞扫描器，Gui基于javafx。POC 目前集成 Weblogic、Tomcat、Shiro、Spring等。

awesome-hacker-search-engines

A curated list of awesome search engines useful during Penetration testing, Vulnerability assessments, Red Team operations, Bug Bounty and more

awvs13_batch_py3

针对 AWVS扫描器开发的批量扫描脚本，支持log4j漏洞专项，支持联动xray、burp、w13scan等被动批量

bad-bpf

A collection of eBPF programs demonstrating bad behavior, presented at DEF CON 29

beaconeye

Hunts out CobaltStrike beacons and logs operator command output

behinder

“冰蝎”动态二进制加密网站管理客户端

blackhat-scrapy

BlackHat scrapy for download all the pdf file

blackstone

一个基于docker，开箱即用的CTF竞赛平台

boopkit

Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.

burp-awesome-tls

Fix Burp Suite's horrible TLS stack & spoof any browser fingerprint

caesar

一个全新的敏感文件发现工具

calculate_captcha

计算验证码生成器，用于训练使用

chunk-proxy

classpy

GUI tool for investigating Java class files

cli

🧰 A zero trust swiss army knife for working with X509, OAuth, JWT, OATH OTP, etc.

clipboardhistory

cmsexp

cms的exp利用框架

cobaltstrike-update

Cobalt Strike is a powerful threat emulation tool that provides a post-exploitation agent and covert channels ideal for Adversary Simulations and Red Team exercises. With Cobalt Strike, companies can emulate the tactics and techniques of a quiet long-term embedded threat actor in an IT network. Malleable C2 lets you change your network indicators to look like different malware each time. These tools complement Cobalt Strike's solid social engineering process, its robust collaboration capability, and unique reports designed to aid blue team training.

codeinspector

基于Java ASM技术和GadgetInspector的原理，尝试实现一个自动Java代码审计工具。目前做到了可控参数分析和数据流跟踪分析

codeql

《深入理解CodeQL》Finding vulnerabilities with CodeQL.

csbruter

Cobalt Strike team server password brute force tool

cve-2021-22205

CVE-2021-22205& GitLab CE/EE RCE

cve-2021-22214

Gitlab CI Lint API未授权 SSRF漏洞 (CVE-2021-22214)

cve-2021-25646-gui

CSharp CVE-2021-25646-GUI