Repositories list

• pipetap

  Public

  sensepost/pipetap’s past year of commit activity
  A Windows Named Pipe Multi-tool / Proxy

  researchproxynamedpipe

  C++

  •

  GNU General Public License v3.0

  •14•192•1•0•Updated Dec 7, 2025Dec 7, 2025

• gowitness

  Public
  🔍 gowitness - a golang, web screenshot utility using Chrome Headless

  golangsecurityscreenshot+ 8chromewebreportingheadlessfingerprinttechnologieschrome-headless+ 1

  Go

  •

  GNU General Public License v3.0

  •418•4.1k•23•3•Updated Nov 24, 2025Nov 24, 2025

• objection

  Public
  📱 objection - runtime mobile exploration

  androidsecurityios+ 5mobileframeworkinstrumentationpentestfrida

  Python

  •

  GNU General Public License v3.0

  •946•8.8k•63•11•Updated Nov 21, 2025Nov 21, 2025

• CVE-2025-64446

  Public

  sensepost/CVE-2025-64446’s past year of commit activity
  A scanner for the FortiNet vulnerability CVE-2025-64446

  cve-2025-64446

  Python

  •5•26•0•0•Updated Nov 18, 2025Nov 18, 2025

• hash-cracker

  Public
  Script to perform some hashcracking logic automagically

  automationbruteforcetoggle+ 17combinatormd5ntlmhybridhasheshacktoberfesthashcat+ 10

  C

  •

  GNU General Public License v3.0

  •14•80•0•0•Updated Nov 12, 2025Nov 12, 2025

• wpswag

  Public
  Create an OpenAPI/Swagger spec from a WordPress REST entry point.

  Python

  •1•6•0•0•Updated Sep 10, 2025Sep 10, 2025

• bloatware-pwn

  Public
  LPE / RCE Exploits for various vulnerable "Bloatware" products

  C#

  •6•84•0•0•Updated Aug 5, 2025Aug 5, 2025

• depscanner

  Public

  sensepost/depscanner’s past year of commit activity
  Detect public repository dependencies in the GitHub repositories with an orphan required library.

  Python

  •

  GNU General Public License v3.0

  •2•21•0•0•Updated Jun 24, 2025Jun 24, 2025

• shellnot

  Public

  sensepost/shellnot’s past year of commit activity
  Pseudo-shell for RCE scenarios: tunnels commands via /tmp sockets to a local daemon, keeps context, no bind or reverse shell needed.

  shellsocketreverse-shell+ 4proxysessionrcebind-shell

  C

  •

  GNU General Public License v3.0

  •3•41•0•0•Updated Jun 12, 2025Jun 12, 2025

• mallet

  Public
  Mallet is an intercepting proxy for arbitrary protocols

  netty

  Java

  •43•288•13•1•Updated Apr 14, 2025Apr 14, 2025

• capchan

  Public
  Solving CAPTCHA with Image Classification

  Python

  •

  GNU General Public License v3.0

  •1•9•0•0•Updated Mar 13, 2025Mar 13, 2025

• dresscode

  Public
  Scan websites CSP policies and visualise their vunlnerabilities from a dashboard

  csp

  Python

  •

  GNU General Public License v3.0

  •2•13•0•0•Updated Mar 11, 2025Mar 11, 2025

• InvokeADCheck

  Public
  InvokeADCheck is a PowerShell module designed to evaluate the security of Active Directory environments.

  PowerShell

  •

  BSD 3-Clause "New" or "Revised" License

  •16•118•4•0•Updated Mar 10, 2025Mar 10, 2025

• goLAPS

  Public
  Retrieve LAPS passwords from a domain. The tools is inspired in pyLAPS.

  Go

  •

  GNU General Public License v3.0

  •9•86•0•0•Updated Mar 6, 2025Mar 6, 2025

• reGeorg

  Public
  The successor to reDuh, pwn a bastion webserver and create SOCKS proxies through the DMZ. Pivot and pwn.

  Python

  •

  Other

  •829•3.1k•16•4•Updated Mar 6, 2025Mar 6, 2025

• thumbscr-ews

  Public
  Exchangelib wrapper for pentesting

  Python

  •10•67•0•0•Updated Feb 17, 2025Feb 17, 2025

• susinternals

  Public

  sensepost/susinternals’s past year of commit activity
  psexecsvc - a python implementation of PSExec's native service implementation

  Python

  •

  GNU General Public License v3.0

  •19•229•0•0•Updated Feb 11, 2025Feb 11, 2025

• berate_ap

  Public
  Script for orchestrating mana rogue WiFi Access Points.

  Shell

  •

  BSD 2-Clause "Simplified" License

  •1k•242•1•0•Updated Feb 3, 2025Feb 3, 2025

• mail-in-the-middle

  Public

  sensepost/mail-in-the-middle’s past year of commit activity
  Python

  •

  GNU General Public License v3.0

  •10•109•0•0•Updated Nov 7, 2024Nov 7, 2024

• Frack

  Public archive
  Frack - Keep and Maintain your breach data

  osintbreaches

  Python

  •

  GNU General Public License v3.0

  •29•376•0•0•Updated Sep 1, 2024Sep 1, 2024

• hostapd-mana

  Public
  SensePost's modified hostapd for wifi attacks.

  C

  •

  Other

  •132•593•20•1•Updated Aug 5, 2024Aug 5, 2024

• steampipe-plugin-projectdiscovery

  Public archive
  A steampipe plugin to query projectdiscovery.io tools.

  projectdiscoverysteampipesteampipe-plugin

  Go

  •

  Apache License 2.0

  •1•27•0•1•Updated Jul 23, 2024Jul 23, 2024

• cipherchecks

  Public
  visually see issues with supported cipher suites

  Python

  •

  GNU General Public License v3.0

  •8•17•1•0•Updated Jun 18, 2024Jun 18, 2024

• ruler

  Public
  A tool to abuse Exchange services

  exchangemapipentesting+ 1shells

  Go

  •

  Other

  •365•2.3k•13•1•Updated Jun 10, 2024Jun 10, 2024

• apostille

  Public
  Java

  •

  Other

  •19•73•1•0•Updated May 23, 2024May 23, 2024

• assless-chaps

  Public
  Crack MSCHAPv2 challenge/responses quickly using a database of NT hashes

  Python

  •18•136•1•0•Updated Mar 19, 2024Mar 19, 2024

• mydumbedr

  Public
  C

  •

  GNU General Public License v3.0

  •17•121•0•0•Updated Jan 30, 2024Jan 30, 2024

• wiresocks

  Public
  A sock, with a wire, so you can tunnel all you desire.

  Shell

  •

  GNU General Public License v3.0

  •32•296•2•0•Updated Jan 19, 2024Jan 19, 2024

• go-out

  Public
  ☄️ go-out - A Golang egress buster.

  securitynetworkscanner+ 2busteregress-filtering

  Go

  •

  GNU General Public License v3.0

  •13•126•3•1•Updated Dec 19, 2023Dec 19, 2023

• godoh

  Public

  sensepost/godoh’s past year of commit activity
  🕳 godoh - A DNS-over-HTTPS C2

  dnsgolangdns-over-https+ 3dohc2command-and-control

  Go

  •

  GNU General Public License v3.0

  •131•799•1•2•Updated Dec 19, 2023Dec 19, 2023