awesome-hacking-lists
A curated collection of top-tier penetration testing tools and productivity utilities across multiple domains. Join us to explore, contribute, and enhance your hacking toolkit!
https://github.com/taielab/awesome-hacking-lists
Last synced: 13 days ago
JSON representation
ActionScript
- appsecco/json-flash-csrf-poc - This repo contains the files required to perform a CSRF attack using Flash and HTTP 307 redirections.
Ada
Arduino
- UnicycleDumpTruck/MissionControl - This kids' homework desk has top that flips up to reveal a space-themed control panel.
- spacehuhn/wifi_keylogger - DIY Arduino Wi-Fi Keylogger (Proof of Concept)
ASL
- postgres-cn/pgdoc-cn - PostgreSQL manual Chinese translation by China PostgreSQL Users Group
ASP.NET
- Jean-Francois-C/Webshell-Upload-and-Web-RCE-Techniques - Classic Web shell upload techniques & Web RCE techniques
Assembly
- enkomio/AlanFramework - A C2 post-exploitation framework
- MortenSchenk/Token-Stealing-Shellcode
- xenoscr/SysWhispers2 - AV/EDR evasion via direct system calls.
- timwhitez/Doge-Direct-Syscall - Golang Direct Syscall
- klezVirus/inceptor - Template-Driven AV/EDR Evasion Framework
- guitmz/memrun - Small tool to run ELF binaries from memory with a given process name
- DownWithUp/DynamicKernelShellcode - An example of how x64 kernel shellcode can dynamically find and use APIs
- mai1zhi2/SysWhispers2_x86 - X86 version of syswhispers2 / x86 direct system call
- jthuraisamy/SysWhispers2 - AV/EDR evasion via direct system calls.
- Cybereason/siofra
- mytechnotalent/Reverse-Engineering - A FREE comprehensive reverse engineering tutorial covering x86, x64, 32-bit/64-bit ARM, 8-bit AVR and 32-bit RISC-V architectures.
- jjyr/jonesforth_riscv - Jonesforth RISC-V port.
- vxunderground/MalwareSourceCode - Collection of malware source code for a variety of platforms in an array of different programming languages.
- antonioCoco/Mapping-Injection - Just another Windows Process Injection
- jthuraisamy/SysWhispers - AV/EDR evasion via direct system calls.
- tinysec/windows-syscall-table - windows syscall table from xp ~ 10 rs4
AutoHotkey
- xianyukang/MyKeymap - 一款基于 AutoHotkey 的键盘映射工具
- goreliu/runz - RunZ，专业的快速启动工具
- kookob/smpic - Windows下面的SM.MS图床上传工具
AutoIt
- WildByDesign/ACLViewer - ACL Viewer for Windows
Batchfile
- frizb/Windows-Privilege-Escalation - Windows Privilege Escalation Techniques and Scripts
- lxgw/LxgwWenKai - An open-source Chinese font derived from Fontworks' Klee One. 一款开源中文字体，基于 FONTWORKS 出品字体 Klee One 衍生。
- gsuberland/lbfo_win10 - Re-enable NIC teaming (LBFO) in Windows 10 using components from Windows Server.
- SkyBlueEternal/jdk-change - 支持windows\linux\macOS | jdk一键切换版本\一键切换jdk版本\jdk版本更换
- 0xbinibini/emergency_response_batch - 应急响应，应急响应脚本，应急响应批处理；将Windows查看日志用户端口等命令集成在批处理脚本中。让熟练的应急人员能省去多次重复的敲击和记忆，并通过读取配置文件来调用Windows自带的命令结束进程服务等，本批处理尽量不调用任何外部的工具。任何调用的外部工具都将会存放在plugin目录下可按需使用，力图使用最原生的命令行来完成工作。
- SoraShu/easyconn-socks5-for-HITsz - 在服务器上运行easyconnect并建立socks5代理，实现win电脑上免安装easyconnect访问校园内网。
- r00t4dm/CVE-2020-27955
- swagkarna/Defeat-Defender-V1.2.0 - Powerful batch script to dismantle complete windows defender protection and even bypass tamper protection ..Disable Windows-Defender Permanently....Hack windows. POC
- wafinfo/cobaltstrike - cobaltstrike插件
- chroblert/JC-jEnv - windows java environ manage
- massgravel/Microsoft-Activation-Scripts - Open-source Windows and Office activator featuring HWID, Ohook, TSforge, KMS38, and Online KMS activation methods, along with advanced troubleshooting.
- sagishahar/lpeworkshop - Windows / Linux Local Privilege Escalation Workshop
- maguowei/k8s-docker-desktop-for-mac - Docker Desktop for Mac 开启并使用 Kubernetes
- ihacku/winhardening - windows 加固脚本
- acgbfull/IBM_Appscan_Batch_Scan_Script - IBM AppScan批量扫描脚本
- crazywifi/RDP_SessionHijacking - Passwordless RDP Session Hijacking
- so87/CISSP-Study-Guide - study material used for the 2018 CISSP exam
- Tai7sy/fuckcdn - CDN真实IP扫描，易语言开发
- NextronSystems/APTSimulator - A toolset to make a system look as if it was the victim of an APT attack
- auspbro/domain-admin-crack - 🌵 入域电脑用户本地提权
- bartblaze/Disable-Intel-AMT - Tool to disable Intel AMT on Windows
- wzulfikar/ngrok-caddy - Script to run ngrok with (optional) caddy server
- mxk/windows-secure-group-policy - Windows 11 secure group policy for standalone devices
- NuclearPhoenixx/fake-sandbox - 👁🗨 This script will simulate fake processes of analysis sandbox/VM software that some malware will try to avoid.
BitBake
- xer0times/BugBounty - Bug Bounty stuffs, payloads, scripts, profiles, tips and tricks, ...
Blade
- dbarzin/mercator - Mapping the information system / Cartographie du système d'information
BlitzBasic
- Sy3Omda/burp-bounty - Burp Bounty profiles
- PortSwigger/scan-check-builder - Burp Bounty is a extension of Burp Suite that improve an active and passive scanner by yourself. This extension requires Burp Suite Pro.
- 1N3/IntruderPayloads - A collection of Burpsuite Intruder payloads, BurpBounty payloads, fuzz lists, malicious file uploads and web pentesting methodologies and checklists.
- ghsec/BBProfiles - Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that improve an active and passive scanner by yourself. This extension requires Burp Suite Pro.
- six2dez/burp-bounty-profiles - Burp Bounty profiles compilation, feel free to contribute!
Boo
- byt3bl33d3r/SILENTTRINITY - An asynchronous, collaborative post-exploitation agent powered by Python and .NET's DLR
C
- NoOne-hub/Beacon.dll - Beacon.dll reverse
- david378/ssocks - build static ssocks by cmake,cross build ssocks
- csandker/inMemoryShellcode - A Collection of In-Memory Shellcode Execution Techniques for Windows
- NixOS/patchelf - A small utility to modify the dynamic linker and RPATH of ELF executables
- fancycode/MemoryModule - Library to load a DLL from memory.
- TheWover/donut - Generates x86, x64, or AMD64+x86 position-independent shellcode that loads .NET Assemblies, PE files, and other Windows payloads from memory and runs them with parameters
- ntop/nDPI - Open Source Deep Packet Inspection Software Toolkit
- titansec/OpenWAF - Web security protection system based on openresty
- yangyangwithgnu/bypass_disablefunc_via_LD_PRELOAD - bypass disable_functions via LD_PRELOA (no need /usr/sbin/sendmail)
- V-E-O/rdp2tcp - rdp2tcp: open tcp tunnel through remote desktop connection.
- turing-technician/FastHook - Android ART Hook
- ValdikSS/p0f-mtu - p0f with patches to save MTU value and export it via API (for VPN detection)
- Ridter/Pentest - tools
- ScottyBauer/Android_Kernel_CVE_POCs - A list of my CVE's with POCs
- DhavalKapil/icmptunnel - Transparently tunnel your IP traffic through ICMP echo and reply packets.
- DhavalKapil/heap-exploitation - This book on heap exploitation is a guide to understanding the internals of glibc's heap and various attacks possible on the heap structure.
- SecWiki/windows-kernel-exploits - windows-kernel-exploits Windows平台提权漏洞集合
- ele7enxxh/Android-Inline-Hook - thumb16 thumb32 arm32 inlineHook in Android
- baidu/dperf - dperf is a 100Gbps network load tester.
- H4K6/CVE-2023-0179-PoC - 针对（CVE-2023-0179）漏洞利用 该漏洞被分配为CVE-2023-0179，影响了从5.5到6.2-rc3的所有Linux版本，该漏洞在6.1.6上被测试。 漏洞的细节和文章可以在os-security上找到。
- Impalabs/CVE-2023-27326 - VM Escape for Parallels Desktop <18.1.1
- libAudioFlux/audioFlux - A library for audio and music analysis, feature extraction.
- chompie1337/Windows_LPE_AFD_CVE-2023-21768 - LPE exploit for CVE-2023-21768
- xforcered/Windows_LPE_AFD_CVE-2023-21768 - LPE exploit for CVE-2023-21768
- Esonhugh/sshd_backdoor - /root/.ssh/authorized_keys evil file watchdog with ebpf tracepoint hook.
- brosck/Pingoor - 「🚪」Linux Backdoor based on ICMP protocol
- nelhage/reptyr - Reparent a running program to a new terminal
- itm4n/PPLdump - Dump the memory of a PPL with a userland exploit
- zh-explorer/dirtycow - exploit for dirtycow
- Coldzer0/ReverseSock5Proxy - A tiny Reverse Sock5 Proxy written in C :V
- Cerbersec/KillDefenderBOF - Beacon Object File PoC implementation of KillDefender
- seventeenman/noELF - Linux下用于远程加载可执行文件以达到内存加载的目的
- Kevin-sa/ebpf-supply-chain - 利用ebpf做pypi恶意包检测
- yukar1z0e/cloudswordtsh - 多用户版linux/freebsd/openbsd/netbsd/cygwin/sunos/irix/hpux/osf的远控tiny shell
- Octoberfest7/EventViewerUAC_BOF - Beacon Object File implementation of Event Viewer deserialization UAC bypass
- Rvn0xsy/SchtaskCreator - 远程创建任务计划工具
- Libraggbond/EventViewerBypassUacBof - EventViewer Bypass Uac Bof
- randorisec/CVE-2022-34918-LPE-PoC
- h3xduck/TripleCross - A Linux eBPF rootkit with a backdoor, C2, library injection, execution hijacking, persistence and stealth capabilities.
- pytorch/cpuinfo - CPU INFOrmation library (x86/x86-64/ARM/ARM64, Linux/Windows/Android/macOS/iOS)
- byt3bl33d3r/BOF-Zig - Cobalt Strike BOF with Zig!
- crisprss/PetitPotam - 替代PrintBug用于本地提权的新方式，主要利用MS-EFSR协议中的接口函数 借鉴了Potitpotam中对于EFSR协议的利用,实现了本地提权的一系列方式 Drawing on the use of the EFSR protocol in Potitpotam, a series of local rights escalation methods have been realized
- Cracked5pider/Ekko - Sleep Obfuscation
- helloexp/0day - 各种CMS、各种平台、各种系统、各种软件漏洞的EXP、POC ,该项目将持续更新
- tr3ee/CVE-2022-23222 - CVE-2022-23222: Linux Kernel eBPF Local Privilege Escalation
- synacktiv/ica2tcp - A SOCKS proxy for Citrix.
- thefLink/DeepSleep - A variant of Gargoyle for x64 to hide memory artifacts using ROP only and PIC
- q77190858/CVE-2021-3156 - sudo提权漏洞CVE-2021-3156复现代码
- nsacyber/Hardware-and-Firmware-Security-Guidance - Guidance for the Spectre, Meltdown, Speculative Store Bypass, Rogue System Register Read, Lazy FP State Restore, Bounds Check Bypass Store, TLBleed, and L1TF/Foreshadow vulnerabilities as well as gene
- nemo-wq/PrintNightmare-CVE-2021-34527 - PrintNightmare - Windows Print Spooler RCE/LPE Vulnerability (CVE-2021-34527, CVE-2021-1675) proof of concept exploits
- LDrakura/Remote_ShellcodeLoader - 远程shellcode加载&权限维持+小功能
- JDArmy/RPCSCAN - RPC远程主机信息匿名扫描工具
- jituo666/AndroidEventRecorder - A recorder used for recording user actions on Android platforms.
- liudf0716/xfrpc - The xfrpc project is a lightweight implementation of the FRP client written in C language for OpenWRT and IoT systems. It is designed to provide an efficient solution for resource-constrained devices
- Mr-Un1k0d3r/WindowsDllsExport - A list of all the DLLs export in C:\windows\system32\
- trustedsec/CS-Remote-OPs-BOF
- outflanknl/C2-Tool-Collection - A collection of tools which integrate with Cobalt Strike (and possibly other C2 frameworks) through BOF and reflective DLL loading techniques.
- chicharitomu14/AndScanner - This is the project for the paper “Large-scale Security Measurements on the Android Firmware Ecosystem” in ICSE2022
- rbsec/sslscan - sslscan tests SSL/TLS enabled services to discover supported cipher suites
- krisnova/boopkit - Linux eBPF backdoor over TCP. Spawn reverse shells, RCE, on prior privileged access. Less Honkin, More Tonkin.
- bytedance/bhook - 🔥 ByteHook is an Android PLT hook library which supports armeabi-v7a, arm64-v8a, x86 and x86_64.
- r0ysue/AndroidFridaBeginnersBook - 《安卓Frida逆向与抓包实战》随书附件
- easychen/pushdeer - 开放源码的无App推送服务，iOS14+扫码即用。亦支持快应用/iOS和Mac客户端、Android客户端、自制设备
- emptymonkey/revsh - A reverse shell with terminal support, data tunneling, and advanced pivoting capabilities.
- Bonfee/CVE-2022-0995 - CVE-2022-0995 exploit
- RfidResearchGroup/proxmark3 - Iceman Fork - Proxmark3
- gojue/ecapture - Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.
- ly4k/PwnKit - Self-contained exploit for CVE-2021-4034 - Pkexec Local Privilege Escalation
- crisprss/PrintSpoofer - PrintSpoofer的反射dll实现，结合Cobalt Strike使用
- AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits - A collection of exploits and documentation that can be used to exploit the Linux Dirty Pipe vulnerability.
- mponcet/subversive - x86_64 linux rootkit using debug registers
- therealdreg/lsrootkit - Rootkit Detector for UNIX
- Arinerron/CVE-2022-0847-DirtyPipe-Exploit - A root exploit for CVE-2022-0847 (Dirty Pipe)
- Bonfee/CVE-2022-25636 - CVE-2022-25636
- bopin2020/WindowsCamp - Windows Kernel Knowledge && Collect Resources on the wire && Nothing innovation by myself &&
- Lojii/Knot - 一款iOS端基于MITM(中间人攻击技术)实现的HTTPS抓包工具，完整的App，核心代码使用SwiftNIO实现
- r4j0x00/exploits
- SentryPeer/SentryPeer - Protect your SIP Servers from bad actors at https://sentrypeer.org
- b1n4r1b01/n-days
- linux-lock/bpflock - bpflock - eBPF driven security for locking and auditing Linux machines
- Rvn0xsy/CVE-2021-4034 - CVE-2021-4034 Add Root User - Pkexec Local Privilege Escalation
- 0verSp4ce/CVE-2021-4034 - CVE-2021-4034, For Webshell Version.
- MichaelDim02/Narthex - Modular personalized dictionary generator.
- FlamingSpork/iptable_evil - An evil bit backdoor for iptables
- kyleavery/inject-assembly - Inject .NET assemblies into an existing process
- spieglt/whatfiles - Log what files are accessed by any Linux process
- berdav/CVE-2021-4034 - CVE-2021-4034 1day
- arthepsy/CVE-2021-4034 - PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec (CVE-2021-4034)
- Ayrx/CVE-2021-4034 - Exploit for CVE-2021-4034
- aaaddress1/Skrull - Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting te
- thefLink/Hunt-Sleeping-Beacons - Aims to identify sleeping beacons
- Rvn0xsy/linux_dirty - 更改后的脏牛提权代码，可以往任意文件写入任意内容，去除交互过程
- revng/pagebuster - PageBuster - dump all executable pages of packed processes.
- screetsec/TheFatRat - Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then
- f0rb1dd3n/Reptile - LKM Linux rootkit
- lcatro/qemu-fuzzer - Qemu Fuzzer.针对Qemu模拟设备的模糊测试工具,主要思路是Host生成种子Data,然后传递给Guest中转程序,由中转程序访问MMIO,以达到和模拟设备的交互,不同于qtest自带的fuzzer.
- chriskaliX/Hades - Hades is a Host-Based Intrusion Detection System based on eBPF(mainly)
- n0b0dyCN/redis-rogue-server - Redis(<=5.0.5) RCE
- wavestone-cdt/EDRSandblast
- OALabs/BlobRunner - Quickly debug shellcode extracted during malware analysis
- SweetIceLolly/Huorong_Vulnerabilities - Huorong Internet Security vulnerabilities 火绒安全软件漏洞
- scareing/cmd2shellcode - cmd2shellcode
- securifybv/Visual-Studio-BOF-template - A Visual Studio template used to create Cobalt Strike BOFs
- HexHive/USBFuzz - A Framework for fuzzing USB Drivers by Device Emulation
- fortra/nanodump - The swiss army knife of LSASS dumping
- 0671/RedisModules-ExecuteCommand-for-Windows - 可在Windows下执行系统命令的Redis模块，可用于Redis主从复制攻击。
- Lakr233/Decrypter - An easy way to decrypt UIKit app.
- idealeer/xmap - XMap is a fast network scanner designed for performing Internet-wide IPv6 & IPv4 network research scanning.
- wolfpython/nids - 基于网络的入侵检测系统
- dismantl/ImprovedReflectiveDLLInjection - An improvement of the original reflective DLL injection technique by Stephen Fewer of Harmony Security
- aircrack-ng/mdk4 - MDK4
- boku7/injectEtwBypass - CobaltStrike BOF - Inject ETW Bypass into Remote Process via Syscalls (HellsGate|HalosGate)
- codewhitesec/HandleKatz - PIC lsass dumper using cloned handles
- gentilkiwi/kekeo - A little toolbox to play with Microsoft Kerberos in C
- EspressoCake/PPLDump_BOF - A faithful transposition of the key features/functionality of @itm4n's PPLDump project as a BOF.
- microsoft/omi - Open Management Infrastructure
- seL4/seL4 - The seL4 microkernel
- outflanknl/PrintNightmare
- cube0x0/SharpSystemTriggers - Collection of remote authentication triggers in C#
- paranoidninja/PIC-Get-Privileges - Building and Executing Position Independent Shellcode from Object Files in Memory
- SolomonSklash/SleepyCrypt - A shellcode function to encrypt a running process image when sleeping.
- limithit/NginxExecute - The NginxExecute module executes the shell command through GET POST and HEAD to display the result.
- boku7/azureOutlookC2 - Azure Outlook Command & Control (C2) - Remotely control a compromised Windows Device from your Outlook mailbox. Threat Emulation Tool for North Korean APT InkySquid / ScarCruft / APT37. TTP: Use Micro
- cyberark/rdpfuzz - Tools for fuzzing RDP
- mprovost/NFStash - NFS client CLI toolkit
- aaaddress1/PR0CESS - some gadgets about windows process and ready to use :)
- superflexible/TGPuttyLib - An SFTP client shared library (dll/so/dylib) with bindings and classes for C++, Delphi and Free Pascal based on PuTTY
- ttdennis/fpicker - fpicker is a Frida-based fuzzing suite supporting various modes (including AFL++ in-process fuzzing)
- mgeeky/ElusiveMice - Cobalt Strike User-Defined Reflective Loader with AV/EDR Evasion in mind
- boku7/whereami - Cobalt Strike Beacon Object File (BOF) that uses handwritten shellcode to return the process Environment strings without touching any DLL's.
- frkngksl/Huan - Encrypted PE Loader Generator
- Yubico/yubico-c - YubiKey C low-level library (libyubikey)
- RUB-SysSec/Nyx - USENIX 2021 - Nyx: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types
- glmcdona/Process-Dump - Windows tool for dumping malware PE files from memory back to disk for analysis.
- alfarom256/BOF-ForeignLsass
- knightswd/ProcessGhosting
- boku7/BokuLoader - A proof-of-concept Cobalt Strike Reflective Loader which aims to recreate, integrate, and enhance Cobalt Strike's evasion features!
- aqi00/advanceapp - 《Android App开发进阶与项目实战》随书源码
- horsicq/PDBRipper - PDBRipper is a utility for extract an information from PDB-files.
- Gui774ume/ebpfkit - ebpfkit is a rootkit powered by eBPF
- jrbrtsn/ban2fail - Simple & efficient log file scanning and iptable filtering
- cdpxe/NELphase - Network Environment Learning (NEL) Phase for Covert Channels (with a Feedback Channel)