gosecure Goto Github PK

pyrdp

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

pywsus

Standalone implementation of a part of the WSUS spec. Built for offensive security purposes.

request-smuggling-nsec-demo

request-smuggling-workshop

reveal.js

Added our own themes to reveal.js

roslyn-security-guard

Roslyn analyzers that aim to help security audit on .NET applications.

rwhtml

A peculiar markdown-to-HTML converter

scoutsuite

Multi-Cloud Security Auditing Tool

security-cheat-sheet

Minimalist cheat sheet for developpers to write secure code

serpico

SimplE RePort wrIting and COllaboration tool

sharphound3

C# Data Collector for the BloodHound Project, Version 3

spray365

Spray365 makes spraying Microsoft accounts (Office 365 / Azure AD) easy through its customizable two-step password spraying approach. The built-in execution plan features options that attempt to bypass Azure Smart Lockout and insecure conditional access policies.

sprayingtoolkit

Scripts to make password spraying attacks against Lync/S4B & OWA a lot quicker, less painful and more efficient

sysmon-config

Sysmon configuration file template with default high-quality event tracing

tachyon

Fast Multi-Threaded Web Discovery Tool

template-injection-workshop

Workshop on Template Injection (6 exercises) covering Twig, Jinja2, Tornado, Velocity and Freemaker engines.

terraform-inventory

Terraform State → Ansible Dynamic Inventory

tls-fingerprinting

TLS Fingerprinting

unfetter

Identifies defensive gaps in security posture by leveraging Mitre's ATT&CK framework. iadgov

unicode-pentester-cheatsheet

An easy to navigate list of unicode characters that have risky transformations 💥

vvv

An open source Vagrant configuration for developing with WordPress

wsuspect-proxy

WSUSpect Proxy - a tool for MITM'ing insecure WSUS connections

wsuspicious

WSuspicious - A tool to abuse insecure WSUS connections for privilege escalations

xfsc

eXtensions for Financial Services (XFS) proof of concept client to explore and issue commands directly to the devices that support the protocol. Force ATMs to dispense cash if you have code execution on them.

xxe-workshop

Workshop given at Hack in Paris 2019

yasuo

A ruby script that scans for vulnerable & exploitable 3rd-party web applications on a network

ysoserial

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

zap-autodecode-view

ZAP plugin demonstrating custom view for WebSocket messages.