karmaz95 Goto Github PK

followers: 122.0 following: 1.0 repos: 257.0 gists: 0.0

Name: Karol Mazurek

Type: User

Company: Afine

Bio: Offensive Security Engineer 🍎

Twitter: Karmaz95

Blog: https://karol-mazurek.medium.com/

👨‍💻 About Me

I am a passionate Offensive Security Engineer from afine, committed to finding 👾 bugs and developing 🤖 software that enhances our work in security. My main areas of interest are 🍎 macOS internals and 🕸️ web application security. I also have experience in 💠 Active Directory and creating 🦠 malware to bypass 🛡️ EDRs.

🔭 Projects I am proud of

I created some tools helpful for Offensive Security work, but there are two that I am the most proud of, they are:

Crimson - this was my first big thing. Currently, I am not focusing on this tool. However, it is still powerful. My friends and I are using it to this day. This is also a great place to start your journey with Application Security.
Snake&Apple - The code repository for the Snake&Apple article series documents my macOS security research.

🐛 CVE I am proud of

As my daily work and some part of my free time research, I am looking for bugs 🐛. I have caught many of them so far, and some have even received a public CVE. I am particularly proud of these two:

📖 Blog

In my free time, I also run a blog about - guess what 😆

🎖️ Certs & CTFs & Courses

I have participated in multiple CTFs, completed various courses, and obtained certifications through various platforms. Below are links that demonstrate some of these small accomplishments:

Certs - OSCE³, eWPTxv2, OSCP, OST2-Arch1001
Pentesterlab - various web hacking courses & CTFs.
RPISEC/MBE - Modern Binary Exploitation - CSCI 4968
HTB - CTFs & Pro Labs
CS50 - Harvard University - Introduction to Computer Science

📫 Social Media

You can reach me here:

💰 Funding

If you enjoy my work and want to help me grow, you can sponsor me using any of the below options:

❗By subscribing to my Patreon, you will receive access to all of my published articles.

Karol Mazurek's Projects

commix

Automated All-in-One OS Command Injection Exploitation Tool.

corsme

Cross Origin Resource Sharing MisConfiguration Scanner

cpptest

:hammer_and_wrench: Powerful, yet simple, C++ unit testing framework; new home after https://sourceforge.net/projects/cpptest/

crackmapexec

A swiss army knife for pentesting networks

crashmon

crashmon - A LLDB Based replacement for CrashWrangler

crimson

Web Application Security Testing Tools

crimson_cracking

All around cracking wordlist.

crimson_lisp

Linux Post-Exploitation tools wrapper

crimson_prober

Asynchronous TCP scanner through SOCKS5 proxies

crimson_wisp

Windows Post-Exploitation tools wrapper

crimsonuroboros

A repository reserved for a program from the Snake Apple series.

crlfuzz

A fast tool to scan CRLF vulnerability written in Go

crypto-tools

A collection of tools that deal with crypto and cryptanalysis. For educational purposes only. These tools are likely not a good substitute for real cryptography.

csrf-to-rce-on-backdrop-cms

cve-2017-0199

Exploit toolkit CVE-2017-0199 - v4.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious RTF/PPSX file and deliver metasploit / meterpreter / other payload to victim without any complex configuration.