Lists (8)
Stars
Proof-of-Concept tool for extracting NTLMv1 hashes from sessions on modern Windows systems.
A small script that automates Entra ID persistence with Windows Hello For Business key
CVE-2025-26794: Blind SQL injection in Exim 4.98 (SQLite DBM)- exploit writeup
CVE-2025-31200 is a zero-day, zero-click RCE in iOS CoreAudioโs AudioConverterService, triggered by a malicious audio file via iMessage/SMS. Exploitation bypassed Blastdoor, enabled kernel escalatiโฆ
Intelligent automation and multi-agent orchestration for Claude Code
JamfHound is a python3 project designed to collect and identify attack paths in Jamf Pro tenants based on existing object permissions by outputting data as JSON for ingestion into BloodHound.
Testing TLS/SSL encryption anywhere on any port
TREVORspray is a modular password sprayer with threading, clever proxying, loot modules, and more!
IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations
Script to check Azure Front Door WAF for insecure RemoteAddr variable
A tool for coercing and relaying Kerberos authentication over DCOM and RPC.
Module that (tries) to dump clipboard history on most versions of Windows. Attempts live clipboard extraction as well.
A library for detecting known secrets across many web frameworks
A next-generation crawling and spidering framework.
๐๐๏ธ๐ฌ Your new, ๐ง๐๐๐ค๐ฃ๐ ๐ช๐ก๐๐๐๐ค๐ช๐จ๐ก๐ฎ smart clipboard manager
onedrive user enumeration - pentest tool to enumerate valid o365 users
Everything and anything related to password spraying
DNSTake โ A fast tool to check missing hosted DNS zones that can lead to subdomain takeover
Simple python tool for password spraying against a 401 endpoint (basic/ntlm) when you know a lockout policy (ie will try X number of attempts, then sleep for Y minutes)
Wordlists for creating statistically likely username lists for use in password attacks and security testing
OSINT Tool: Generate username lists for companies on LinkedIn
Exchange your privileges for Domain Admin privs by abusing Exchange
Weaponizing DCOM for NTLM Authentication Coercions
A tool for checking if MFA is enabled on multiple Microsoft Services
AWS API Gateway management tool for creating on the fly HTTP pass-through proxies for unique IP rotation