windows-rs shellcode loaders

Rusty Injection - Shellcode Reflective DLL Injection (sRDI) in Rust (Codename: Venom)

Jar Analyzer - 一个JAR包分析工具，批量分析搜索，方法调用关系搜索，字符串搜索，Spring分析，CFG分析，JVM Stack Frame分析，远程分析Tomcat，自定义SQL查询

Web Pentesting Fuzz 字典,一个就够了。

jclasslib bytecode editor is a tool that visualizes all aspects of compiled Java class files and the contained bytecode.

Adversary Emulation Framework

Some ReadObject Sink With JDBC

corax community version

Unofficial revival of the well known .NET debugger and assembly editor, dnSpy

渗透测试常规操作记录

Ladon大型内网渗透工具，可PowerShell模块化、可CS插件化、可内存加载，无文件扫描。含端口扫描、服务识别、网络资产探测、密码审计、高危漏洞检测、漏洞利用、密码读取以及一键GetShell，支持批量A段/B段/C段以及跨网段扫描，支持URL、主机、域名列表扫描等。10.10.5内置228个功能模块,网络资产探测模块32个通过多种协议(ICMP\NBT\DNS\MAC\SMB\WMI…

Pre-Built Vulnerable Environments Based on Docker-Compose

Basic PoC for CVE-2023-27524: Insecure Default Configuration in Apache Superset

Coverage-guided, in-process fuzzing for the JVM

通过通过jhat解析heapdump文件，从而实现heapdump敏感信息搜索。

Java Agent is a Java application probe of DongTai IAST, which collects method invocation data during runtime of Java application by dynamic hooks.

An easy-to-learn/use static analysis framework for Java

GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems

scalpel是一款命令行漏洞扫描工具，支持深度参数注入，拥有一个强大的数据解析和变异算法，可以将常见的数据格式（json, xml, form等）解析为树结构，然后根据poc中的规则，对树进行变异，包括对叶子节点和树结构 的变异。变异完成之后，将树结构还原为原始的数据格式。 原理：https://mp.weixin.qq.com/s/U_llBwC05vb84U9wb8NZog

Dynamically resolve and invoke Windows APIs using Rust. This might help to avoid suspicious imports and the usage of GetProcAddress.

中国菜刀官方版本，拒绝黑吃黑，来路清晰

🚀Vulfocus 是一个漏洞集成平台，将漏洞环境 docker 镜像，放入即可使用，开箱即用。

Zimbra CVE-2022-27925 PoC

Ladon 911 for Cobalt Strike & Cracked Download,Large Network Penetration Scanner, vulnerability / exploit / detection / MS17010 / password/brute-force/psexec/atexec/sshexec/webshell/smbexec/netcat/…

RASP测试靶场

本项目制作的初衷是帮助渗透新手快速搭建工作环境，工欲善其事，必先利其器。

The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects)

A declarative static analysis tool for jvm bytecode based Datalog like CodeQL