whojeff Goto Github PK

msbuild-inline-task

mssql-fileless-rootkit-warsqlkit

Bildiğiniz üzere uzun zamandır MSSQL üzerine çalışmalar yapmaktayım. Bu yazımda uzun zamandır uğraştığım bir konuyu ele alacağım, MSSQL Rootkit. Bildiğiniz üzere şimdiye kadar MS-SQL için anlatılan post-exploitation işlemlerinin büyük çoğunluğu “xp_cmdshell” ve “sp_OACreate” stored procedure’lerini kullanarak anlatılır. Peki xp_cmdshell ve sp_OACreate stored procedure’lerinin olmadığı bir MSSQL sunucusunun “sa” hesabını ele geçirmişsek, o sisteme girmekten vaz mı geçeceğiz? Tabii ki vazgeçmememiz gerekiyor. Bu makale “sa” hesabının yakalandığı ve “xp_cmdshell”, “sp_OACreate”, “sp_OAMethod” vb. prosedürlerin hiç birinin çalışmadığı bir senaryo düşünülerek kaleme alınmıştır.

mssql_backdoor

mytips

new-pac

nishang

Nishang - Offensive PowerShell for red team, penetration testing and offensive security.

oa-ezoffice

pan-light

百度网盘不限速客户端, golang + qt5, 跨平台图形界面

passmaker

可以自定义规则的密码字典生成器,支持图形界面 A password-generator that base on the rules that you specified

payloadsallthethings

A list of useful payloads and bypass for Web Application Security and Pentest/CTF

penetration

渗透 超全面的渗透资料💯 包含：0day，xss，sql注入，提权……

pentest-bookmarks

A collection of penetration testing related sites

pentest_interview

个人准备渗透测试和安全面试的经验之谈，和去部分厂商的面试题，干货真的满满~

pictures-trojans

poc

Various PoCs

poc-t

渗透测试插件化并发框架

pocsuite_poc_collect

collection poc use pocsuite framework 收集一些 poc with pocsuite框架

portscan

printspoofer

Abusing Impersonation Privileges on Windows 10 and Server 2019 本地提权2012-2019

privexchange

Exchange your privileges for Domain Admin privs by abusing Exchange

proxychains-ng

proxychains ng (new generation) - a preloader which hooks calls to sockets in dynamically linked programs and redirects it through one or more socks/http proxies. continuation of the unmaintained proxychains project. the sf.net page is currently not updated, use releases from github release page instead.

pupy

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python

pyshell

a management tool

python-100-days

Python - 100天从新手到大师

python-pentest-tools

Python tools for penetration testers

python-webshell

webshell writen in python

recaptcha

reCAPTCHA = REcognize CAPTCHA: A Burp Suite Extender that recognize CAPTCHA and use for intruder payload

recon-ng

Recon-ng is a full-featured Web Reconnaissance framework written in Python.

recon-ng-api-key-creation

One of the biggest annoyances of using Recon-ng is getting everything set up to use it. So here I’ll outline the different API keys it can use and where to get them yourself.

recon-ng-modules

Additional modules for recon-ng