NTLM Relay Gat NTLM Relay Gat is a powerful tool designed to automate the exploitation of NTLM relays using ntlmrelayx.py from the Impacket tool suite. By leveraging the capabilities of ntlmrelayx.py, NTLM Relay Gat streamlines...
The post NTLM Relay Gat: automate the exploitation of NTLM relays appeared first on Penetration Testing Tools.
Hfinger – fingerprinting HTTP requests Tool for fingerprinting HTTP requests of malware. Based on Tshark and written in Python3. Working prototype stage 🙂 Its main objective is to provide a representation of malware requests...
The post Hfinger: fingerprinting HTTP requests appeared first on Penetration Testing Tools.
ACEshark ACEshark is a utility designed for rapid extraction and analysis of Windows service configurations and Access Control Entries, eliminating the need for tools like accesschk.exe or other non-native binaries. Why? Efficiently identify and analyze service...
The post ACEshark: extraction and analysis of Windows service configurations and Access Control Entries appeared first on Penetration Testing Tools.
Driver Buddy Reloaded Driver Buddy Reloaded is an IDA Pro Python plugin that helps automate some tedious Windows Kernel Drivers reverse engineering tasks. It has a number of handy features, such as: Identifying the type...
The post DriverBuddyReloaded: automate some tedious Windows Kernel Drivers reverse engineering tasks appeared first on Penetration Testing Tools.
QCSuper QCSuper is a tool communicating with Qualcomm-based phones and modems, allowing to capture raw 2G/3G/4G (and for certain models 5G) radio frames, among other things. It will allow you to generate PCAP captures of it using either...
The post QCSuper: capture raw 2G/3G/4G/ 5G radio frames appeared first on Penetration Testing Tools.
Speakeasy Speakeasy is a portable, modular, binary emulator designed to emulate Windows kernel and user mode malware. Instead of attempting to perform dynamic analysis using an entire virtualized operating system, Speakeasy will emulate specific...
The post Speakeasy: emulate Windows kernel and user mode malware appeared first on Penetration Testing Tools.
MEGR-APT MEGR-APT is a scalable APT hunting system to discover suspicious subgraphs matching an attack scenario (query graph) published in Cyber Threat Intelligence (CTI) reports. MEGR-APT hunts APTs in a twofold process: (i) memory-efficient...
The post MEGR-APT: A Memory-Efficient APT Hunting System appeared first on Penetration Testing Tools.
SessionProbe SessionProbe is a multi-threaded pentesting tool designed to assist in evaluating user privileges in web applications. It takes a user’s session token and checks for a list of URLs if access is possible,...
The post SessionProbe: assist in evaluating user privileges in web applications appeared first on Penetration Testing Tools.
SharpADWS SharpADWS is an Active Directory reconnaissance and exploitation tool for Red Teams that collects and modifies Active Directory data via the Active Directory Web Services (ADWS) protocol. Typically, enumeration or manipulation of Active...
The post SharpADWS: Active Directory reconnaissance and exploitation for Red Teams appeared first on Penetration Testing Tools.
freki Freki is a free and open-source malware analysis platform. Goals Facilitate malware analysis and reverse engineering; Provide an easy-to-use REST API for different projects; Easy deployment (via Docker); Allow the addition of new...
The post freki: Malware analysis platform appeared first on Penetration Testing Tools.
gubble gubble is a tool designed to audit Google Workspace group settings. It analyzes settings such as who can join, view membership, post messages, view conversations, and more to help identify potential security risks associated...
The post gubble: audit Google Workspace group settings appeared first on Penetration Testing Tools.
Hunt-Sleeping-Beacons This project is ( mostly ) a callstack scanner which tries to identify IOCs indicating an unpacked or injected C2 agent. All checks are based on the observation that C2 agents wait between...
The post Hunt-Sleeping-Beacons: identify beacons appeared first on Penetration Testing Tools.
AlphaGolang AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the...
The post AlphaGolang: IDApython Scripts for Analyzing Golang Binaries appeared first on Penetration Testing Tools.
Malduck Malduck is your ducky companion in malware analysis journeys. It is mostly based on the Roach project, which derives many concepts from mlib library created by Maciej Kotowicz. The purpose of the fork was to make Roach...
The post Malduck: make library for malware researchers appeared first on Penetration Testing Tools.
Vermilion Vermilion is a simple and lightweight CLI tool designed for rapid collection, and optional exfiltration of sensitive information from Linux systems. Its primary purpose is to streamline the process of gathering critical data...
The post vermilion: Linux post exploitation tool for info gathering and exfiltration appeared first on Penetration Testing Tools.
Protect Loader Protect Loader is a shellcode loader written in pure golang designed to provide various security and evasion techniques for Go applications. It includes features such as shellcode loading, obfuscation, the use of...
The post Protect Loader: Advanced Go Shellcode Loading appeared first on Penetration Testing Tools.
LEAKEY LEAKEY is a tool for validation of leaked API tokens/keys found during pentesting and Red Team Engagements. The script is really useful for Bug Hunters in order to validate and determine the impact...
The post LEAKEY: checks and validates for leaked credentials appeared first on Penetration Testing Tools.
BREAD BREAD (BIOS Reverse Engineering & Advanced Debugging) is an ‘injectable’ real-mode x86 debugger that can debug arbitrary real-mode code (on real HW) from another PC via serial cable. BREAD emerged from many failed...
The post BREAD: BIOS Reverse Engineering & Advanced Debugging appeared first on Penetration Testing Tools.
EmoCheck Emotet detection tool for Windows OS. How EmoCheck detects Emotet (v0.0.1) Emotet generates their process name from a specific word dictionary and C drive serial number. EmoCheck scans the running process on the...
The post EmoCheck: Emotet detection tool for Windows OS appeared first on Penetration Testing Tools.
HellBunny The purpose of this research project was to develop a comprehensive understanding of the architecture and internals of the Windows operating system, including the Native API, the Process and Thread Environment Block, and...
The post HellBunny: Syscall Mastery Bypasses EDR appeared first on Penetration Testing Tools.
