Others Useful github resources && Osint tools

AztecPo · May 24, 2023

A tool for conducting MITM on RDP connections
Pyrrdp (https://github.com/GoSecure/pyrdp ) is designed to conduct a MITM attack on RDP and allows you to view RDP connections in real time or after the fact. It is written in Python 3 and has open source code.

GitHub - GoSecure/pyrdp: RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact

RDP monster-in-the-middle (mitm) and library for Python with the ability to watch connections live or after the fact - GitHub - GoSecure/pyrdp: RDP monster-in-the-middle (mitm) and library for Pyth...

github.com

⛓ icmpdoor is a reverse ICMP wrapper signed in Python 3
(https://cryptsus.com/blog/icmp-reverse-shell.jpg )icmpdoor (https://github.com/krabelize/icmpdoor ) can tunnel a hidden ICMP channel to control the programmable machine. A large amount of time to work with the tool can be spent to familiarize yourself with the author's blog (https://cryptsus.com/blog/icmp-reverse-shell.html ).
Filtering of ICMP traffic packets is rarely configured, which allows attackers to bypass firewalls. In the breach, the use of ICMP as a backdoor was confirmed at least by one APT (https://cptofevilminions.github.io/...CK_matrix/techniques/command_and_control/icmp ) (Advanced persistent threat) by the group.

GitHub - krabelize/icmpdoor: ICMP Reverse Shell written in Python 3 and with Scapy (backdoor/rev shell)

ICMP Reverse Shell written in Python 3 and with Scapy (backdoor/rev shell) - GitHub - krabelize/icmpdoor: ICMP Reverse Shell written in Python 3 and with Scapy (backdoor/rev shell)

github.com

HTTP botnet in C++ with open source code
(https://github.com/UBoat-Botnet/UBoat ) - HTTP botnet PoC, designed to replicate a real combat commercial botnet.
The main purpose of creating this project is to help security researchers improve their understanding of the device and operation of commercial HTTP botnets.

⏺ Link to GitHub https://github.com/UBoat-Botnet/UBoat

PEzor is an open source tool for bypassing antivirus solutions

GitHub - phra/PEzor: Open-Source Shellcode & PE Packer

Open-Source Shellcode & PE Packer. Contribute to phra/PEzor development by creating an account on GitHub.

github.com

Rootkit for Windows 10/11
Cronos is a Windows 10/11 x64 Ring 0 rootkit. It can hide processes, protect and enhance them by manipulating tokens.

GitHub - XaFF-XaFF/Cronos-Rootkit: Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation.

Cronos is Windows 10/11 x64 ring 0 rootkit. Cronos is able to hide processes, protect and elevate them with token manipulation. - GitHub - XaFF-XaFF/Cronos-Rootkit: Cronos is Windows 10/11 x64 rin...

github.com

A tool for collecting subdomains from a list of IP addresses
Another tool that can allow you to find new subdomains during the exploration phase.
hakip2host receives a list of IP addresses at the input, and then performs a series of checks to find related hostnames, namely a search for PTR, CN and SAN from SSL certificates.

GitHub - hakluke/hakip2host: hakip2host takes a list of IP addresses via stdin, then does a series of checks to return associated domain names.

hakip2host takes a list of IP addresses via stdin, then does a series of checks to return associated domain names. - GitHub - hakluke/hakip2host: hakip2host takes a list of IP addresses via stdin, ...

github.com

A tool for scanning user data using neural networks
Octopii is an artificial intelligence-based user information scanner that uses Tesseract's Optical Character Recognition (OCR) and the MobileNet convolutional neural network (CNN) model.

GitHub - redhuntlabs/Octopii: An AI-powered Personal Identifiable Information (PII) scanner.

An AI-powered Personal Identifiable Information (PII) scanner. - GitHub - redhuntlabs/Octopii: An AI-powered Personal Identifiable Information (PII) scanner.

github.com

Logon Tracker
The software links the hostname (or IP address) and the account name detected in login-related events and displays them as a graph.

(https://github.com/JPCERTCC/LogonTracer)

Nrich is a tool for scanning ports and finding vulnerabilities.
A new command-line tool for quickly analyzing a list of IP addresses and viewing open ports and vulnerabilities.

shodan-public / nrich · GitLab

A command-line tool to quickly analyze all IPs in a file and see which ones have open ports/ vulnerabilities. Can also be fed data from stdin to be...

gitlab.com

BLACKBIRD TOOL – OSINT TOOL TO FIND ACCOUNTS USING USERNAME
Blackbird is a user name enumeration tool.This is one of the best OSINT tools to find usernames across social media websites.

GitHub - p1ngul1n0/blackbird: An OSINT tool to search for accounts by username in social networks.

An OSINT tool to search for accounts by username in social networks. - p1ngul1n0/blackbird

github.com

MacStealer: Wi-Fi Client Isolation Bypass
MacStealer can test Wi-Fi networks for client isolation bypasses (CVE-2022-47522) to intercept (steal) traffic toward other clients at the MAC layer

GitHub - vanhoefm/macstealer

Contribute to vanhoefm/macstealer development by creating an account on GitHub.

github.com

NExfil is a specialized utility for conducting OSINT intelligence by searching for a user by his personal nickname.

GitHub - thewhiteh4t/nexfil: OSINT tool for finding profiles by username

OSINT tool for finding profiles by username. Contribute to thewhiteh4t/nexfil development by creating an account on GitHub.

github.com

StormBreaker is a utility for creating a phishing link, which in turn performs testing and takes a photo from the victim's camera.

GitHub - ultrasecurity/Storm-Breaker: Social engineering tool [Access Webcam & Microphone & Location Finder] With Python

Social engineering tool [Access Webcam & Microphone & Location Finder] With Python - GitHub - ultrasecurity/Storm-Breaker: Social engineering tool [Access Webcam & Microphone & Lo...

github.com

Sashay is a script that will give you the opportunity
automatic installation of 340 utilities. 340 basic tools for Linux with which you can upgrade your "skills" and increase your experience in the pentest.

GitHub - scalabli/sashay: Sashay is an automatic installer for useful tools.

Sashay is an automatic installer for useful tools. - GitHub - scalabli/sashay: Sashay is an automatic installer for useful tools.

github.com

One x (https://github.com/rajkumardusad/onex ) - A library of hacking tools for Thermex and other Linux distributions;

WiFi Bruteforce (https://github.com/faizann24/wifi-bruteforcer-fsecurify ) - Android application for brute force WiFi passwords;

Nexphisher (https://github.com/htr-tech/nexphisher ) - an advanced phishing tool for Linux and Termax;

Cctools (https://4f2bcn3u2m2u2z7ghc17a5jm-wp...mate-hacking-toolkit-black-hat-asia-2019-2.7z ) - a new set of tools for hacking Windows;

Hijacker (https://github.com/chrisk44/Hijacker ) - A universal Wi-Fi hacking tool for Android;

SSH-Harvester
We get the passwords of ssh users in plain text

GitHub - jm33-m0/SSH-Harvester: Harvest passwords automatically from OpenSSH server

Harvest passwords automatically from OpenSSH server - GitHub - jm33-m0/SSH-Harvester: Harvest passwords automatically from OpenSSH server

github.com

"Hacker search engines"

osv.dev (https://osv.dev/list) — vulnerabilities in open source code
Vulners.com (https://vulners.com/) — your search engine for security analysis
opencve.io (https://www.opencve.io/cve ) — The easiest way to track CVE updates and receive notifications about new vulnerabilities .
security.snyk.io (https://security.snyk.io /) — open source vulnerability database
Mend Vulnerability Database (https://www.mend.io/vulnerability-database /) — the largest open source vulnerability database.
Rapid7 — DB (https://www.rapid7.com/db /) — Database of vulnerabilities and exploits
CVEDetails (https://www.cvedetails.com/) — the ultimate source of security vulnerability data
VulnIQ (https://vulniq.com/) — vulnerability analysis and management solution
SynapsInt (https://synapsint.com /) — unified OSINT research tool
Aqua Vulnerability Database (https://avd.aquasec.com /) — vulnerabilities and weaknesses in open source applications and cloud infrastructure.
Vulmon (https://vulmon.com /) — search for vulnerabilities and exploits
VulDB (https://vuldb.com /) — vulnerability database number one
ScanFactory (https://in.scanfactory.io/cvemon.html ) — real-time security monitoring
Trend Micro Zero Day Initiative (https://www.zerodayinitiative.com/advisories/published/) — published vulnerabilities discovered by Zero Day Initiative researchers.
Google Project Zero (https://bugs.chromium.org/p/project... Type Status Priority Milestone Owner Summary ) — vulnerabilities, including Zero Days

Escapes
Exploit-DB (https://www.exploit-db.com /) — Exploit database
Sploitus (https://sploitus.com /) — A convenient central place to identify the latest exploits.
Rapid7 — DB (https://www.rapid7.com/db /) — Database of vulnerabilities and exploits
Vulmon (https://vulmon.com /) — search for vulnerabilities and exploits
packagestormsecurity.com (https://packetstormsecurity.com /) — information security services, news, files, tools, exploits, recommendations and technical documents
0day.today (https://0day.today /) — Full database of exploits and vulnerabilities
LOLBAS (https://lolbas-project.github.io/) — Life Beyond Earth Binary files, scripts and libraries
GTFOBins (https://gtfobins.github.io /) is a verified list of Unix binaries that can be used to bypass local security restrictions on incorrectly configured systems.
Payloads All The Things (https://swisskyrepo.github.io/PayloadsAllTheThingsWeb/) — a list of useful payloads and workarounds for web application security.
XSS Payloads (http://www.xss-payloads.com /) — a wonderland of unexpected JavaScript usage and more
exploitalert.com (https://www.exploitalert.com/search-results.html ) – exploit database.

Attacking surface
FullHunt.io (https://fullhunt.io /) — The entire Internet attack surface database
BynaryEdge (https://www.binaryedge.io /) — we scan the internet and collect data for you
Censys ASM (https://censys.io /) — solutions for managing the attack surface
RedHunt Labs (https://redhuntlabs.com /) — constantly open up opportunities for attacks
SecurityTrails (https://securitytrails.com /) — full online inventory
overcast-security.com (https://overcast-security.com/) — we make it easier to track your external attack surface

Others Useful github resources && Osint tools

Currently reading: Others Useful github resources && Osint tools

"S'all Good, Man."​

"Perfection Is The Enemy Of Perfectly Adequate."​

"Money Is The Point!"​

"I Travel In Worlds You Can't Even Imagine."​

"Say Nothing, You Understand? Get A Lawyer!"​

“Confidence is good. Facts on your side, better.” ​

“Facts are facts.”​

“Sometimes the good guys win.”​

“I’m not good at building shit, you know? I’m excellent at tearing it down.”​

“Money is not beside the point… Money is the point.”​

“Whoa, whoa. Hold up. What the hell happened to you? I get it, the first rule of Fight Club, right?”​

“A good magician never reveals his secrets.”​

“Got to look successful to be successful.”​

“The lesson is, if you’re gonna be a criminal, do your homework.” ​

“If I had to do it all over again, I would maybe do some things differently. I just thought you should know that.”​

“Some men aren't looking for anything logical. They can't be bought, bullied, reasoned or negotiated with. Some men just want to watch the world burn.”​

"Ernest Hemingway once wrote, "The world is a fine place and worth fighting for." I agree with the second part."​

“There’s no better way to destroy someone’s life than to uncover their secrets.”​

“Hackers are breaking the systems for profit. Before, it was about intellectual curiosity and pursuit of knowledge and thrill, and now hacking is big business.”​

“Hackers often describe what they do as playfully creative problem-solving.”​

“Computer hackers do not need to know each other’s real names, or even live on the same continent, to steal millions in mere hours."​

“While many hackers have the knowledge, skills, and tools to attack computer systems, they generally lack the motivation to cause violence or severe economic or social harm.”​

“Very smart people are often tricked by hackers, by phishing. I don’t exclude myself from that. It’s about being smarter than a hacker. Not about being smart.”​

“At the end of the day, my goal was to be the best hacker.”​

“Humiliation is the favorite currency of the hacker.”​

“The hacker didn’t succeed through sophistication. Rather he poked at obvious places, trying to enter through unlocked doors. Persistence, not wizardry, let him through.”​

"Rules. Without Them We Live With The Animals.”​

“Consider This A Professional Courtesy.”​

"I've Lived My Life My Way, And I'll Die My Way."​

"You stabbed the devil in the back, and forced him back into the life that he had just left."​

"You Want A War, Or Do You Want To Just Give Me A Gun?"​

"Leave one wolf alive and the sheep are never safe."​

"When you play the game of thrones, you win or you die. There is no middle ground."​

"It's not easy to see something that’s never been before: A good world."​

"I believe in second chances. I don't believe in third chances."​

"If you only trust the people you grew up with, you won't make many allies."​

"A man with no motive is a man no one suspects. Always keep your foes confused: If they don't know who you are, what you want—they can't know what you plan to do next."​

"Never forget what you are, the rest of the world will not. Wear it like armor and it can never be used to hurt you."​

"I try to know as many people as I can. You never know which one you'll need."​

"It's hard to put a leash on a dog once you've put a crown on its head."​

“Everything before the word ‘but’ is horseshit.”​

“A lion doesn’t concern himself with the opinions of a sheep.”​

“Nothing FUCKS you harder than time.”​

“You pray for rain, you gotta deal with the mud too. That’s a part of it.”​

“I’d be more frightened by not using whatever abilities I’d been given.”​

“Luck is where opportunity meets preparation.”​

“If you have an enemy, then learn and know your enemy, don’t just be mad at him or her.”​

“Every failed experiment is one step closer to success.”​

When you work on a computer your hands travel 20 kilometres a day!​

Fugaku supercomputer is the world’s fastest computer. The $1-billion supercomputer has 7,630,848 cores, requires 29,899 kilowatts of electricity, and can execute 442,010 teraFLOPs.​

“Every day, about 317 million new viruses are discovered.​

“Microsoft’s founder, the infamous Bill Gates, was actually a college dropout."​

Did you know?​

“On average, a human blinks 20 times per minute, but using a computer reduces it to 7."​

Did you know?​

“The most common password for a computer and social media platforms is 123456."​

Did you know?​

“There are eight varieties of computers: mainframe, supercomputer, workstation, personal computer, Apple Macintosh, laptop, tablet, and smartphone."​

Did you know?​

“Linux leads the industry as it is used by Google, Facebook, Twitter, and Amazon."​

Did you know?​

“NASA computers were hijacked by a 15-year-old, resulting in a 21-day halt."​

Did you know?​

“You may heat a room with Gaming PCs more effectively than a heater."​

Did you know?​

“Physical money accounts for just around 10% of global cash, while the rest is stored on computers."​

Did you know?​

“YouTube actually started as a dating website." (Oh crap xD)​

Did you know?​

“Before they could progress as stable brands, Microsoft, HP, and Apple began manufacturing computers in their Garages."​

Did you know?​

“For every 12 million email spams, only one gets a reply."​

Did you know?​

“Banks and other corporate giants hire white hats or “good hackers” to help fix security issues and prevent system infiltration."​

Did you know?​

“If Earth stopped rotating for 1 second, everyone would die."​

Did you know?​

“If someone made a sound of 1100db or larger a black hole would form sucking in our whole solar system."​

Currently reading:
Others Useful github resources && Osint tools

"S'all Good, Man."

"Perfection Is The Enemy Of Perfectly Adequate."

"Money Is The Point!"

"I Travel In Worlds You Can't Even Imagine."

"Say Nothing, You Understand? Get A Lawyer!"

“Confidence is good. Facts on your side, better.”

“Facts are facts.”

“Sometimes the good guys win.”

“I’m not good at building shit, you know? I’m excellent at tearing it down.”

“Money is not beside the point… Money is the point.”

“Whoa, whoa. Hold up. What the hell happened to you? I get it, the first rule of Fight Club, right?”

“A good magician never reveals his secrets.”

“Got to look successful to be successful.”

“The lesson is, if you’re gonna be a criminal, do your homework.”

“If I had to do it all over again, I would maybe do some things differently. I just thought you should know that.”

“Some men aren't looking for anything logical. They can't be bought, bullied, reasoned or negotiated with. Some men just want to watch the world burn.”

"Ernest Hemingway once wrote, "The world is a fine place and worth fighting for." I agree with the second part."

“There’s no better way to destroy someone’s life than to uncover their secrets.”

“Hackers are breaking the systems for profit. Before, it was about intellectual curiosity and pursuit of knowledge and thrill, and now hacking is big business.”

“Hackers often describe what they do as playfully creative problem-solving.”

“Computer hackers do not need to know each other’s real names, or even live on the same continent, to steal millions in mere hours."

“While many hackers have the knowledge, skills, and tools to attack computer systems, they generally lack the motivation to cause violence or severe economic or social harm.”

“Very smart people are often tricked by hackers, by phishing. I don’t exclude myself from that. It’s about being smarter than a hacker. Not about being smart.”

“At the end of the day, my goal was to be the best hacker.”

“Humiliation is the favorite currency of the hacker.”

“The hacker didn’t succeed through sophistication. Rather he poked at obvious places, trying to enter through unlocked doors. Persistence, not wizardry, let him through.”

"Rules. Without Them We Live With The Animals.”

“Consider This A Professional Courtesy.”

"I've Lived My Life My Way, And I'll Die My Way."

"You stabbed the devil in the back, and forced him back into the life that he had just left."

"You Want A War, Or Do You Want To Just Give Me A Gun?"

"Leave one wolf alive and the sheep are never safe."

"When you play the game of thrones, you win or you die. There is no middle ground."

"It's not easy to see something that’s never been before: A good world."

"I believe in second chances. I don't believe in third chances."

"If you only trust the people you grew up with, you won't make many allies."

"A man with no motive is a man no one suspects. Always keep your foes confused: If they don't know who you are, what you want—they can't know what you plan to do next."

"Never forget what you are, the rest of the world will not. Wear it like armor and it can never be used to hurt you."

"I try to know as many people as I can. You never know which one you'll need."

"It's hard to put a leash on a dog once you've put a crown on its head."

“Everything before the word ‘but’ is horseshit.”

“A lion doesn’t concern himself with the opinions of a sheep.”

“Nothing FUCKS you harder than time.”

“You pray for rain, you gotta deal with the mud too. That’s a part of it.”

“I’d be more frightened by not using whatever abilities I’d been given.”

“Luck is where opportunity meets preparation.”

“If you have an enemy, then learn and know your enemy, don’t just be mad at him or her.”

“Every failed experiment is one step closer to success.”

When you work on a computer your hands travel 20 kilometres a day!

Fugaku supercomputer is the world’s fastest computer. The $1-billion supercomputer has 7,630,848 cores, requires 29,899 kilowatts of electricity, and can execute 442,010 teraFLOPs.

“Every day, about 317 million new viruses are discovered.

“Microsoft’s founder, the infamous Bill Gates, was actually a college dropout."

Did you know?

“On average, a human blinks 20 times per minute, but using a computer reduces it to 7."

Did you know?

“The most common password for a computer and social media platforms is 123456."

Did you know?

“There are eight varieties of computers: mainframe, supercomputer, workstation, personal computer, Apple Macintosh, laptop, tablet, and smartphone."

Did you know?

“Linux leads the industry as it is used by Google, Facebook, Twitter, and Amazon."

Did you know?

“NASA computers were hijacked by a 15-year-old, resulting in a 21-day halt."

Did you know?

“You may heat a room with Gaming PCs more effectively than a heater."

Did you know?

“Physical money accounts for just around 10% of global cash, while the rest is stored on computers."

Did you know?

“YouTube actually started as a dating website." (Oh crap xD)

Did you know?

“Before they could progress as stable brands, Microsoft, HP, and Apple began manufacturing computers in their Garages."

Did you know?

“For every 12 million email spams, only one gets a reply."

Did you know?

“Banks and other corporate giants hire white hats or “good hackers” to help fix security issues and prevent system infiltration."

Did you know?

“If Earth stopped rotating for 1 second, everyone would die."

Did you know?

“If someone made a sound of 1100db or larger a black hole would form sucking in our whole solar system."

“People shouldn't be afraid of their government. Governments should be afraid of their people.”