kylingit's Stars
LandGrey/spring-boot-upload-file-lead-to-rce-tricks
spring boot Fat Jar 任意写文件漏洞到稳定 RCE 利用技巧
x-Ai/BurpSuiteLoader
Burp Suite loader version --> ∞
momosecurity/momo-code-sec-inspector-java
IDEA静态代码安全审计及漏洞一键修复插件
LoRexxar/Kunlun-M
KunLun-M是一个完全开源的静态白盒扫描工具,支持PHP、JavaScript的语义扫描,基础安全、组件安全扫描,Chrome Ext\Solidity的基础扫描。
orleven/Tentacle
Tentacle is a POC vulnerability verification and exploit framework. It supports free extension of exploits and uses POC scripts. It supports calls to zoomeye, fofa, shodan and other APIs to perform bulk vulnerability verification for multiple targets.
TideSec/BypassAntiVirus
远控免杀系列文章及配套工具,汇总测试了互联网上的几十种免杀工具、113种白名单免杀方式、8种代码编译免杀、若干免杀实战技术,并对免杀效果进行了一一测试,为远控的免杀和杀软对抗免杀提供参考。
LS95/gopher-redis-auth
This tool generates gopher link for exploiting SSRF and gaining RCE in redis with password.用于生成附带密码认证的gopher内容,用于SSRF等利用。
Dliv3/Venom
Venom - A Multi-hop Proxy for Penetration Testers
facebook/pyre-check
Performant type-checking for python.
fnmsd/MySQL_Fake_Server
MySQL Fake Server use to help MySQL Client File Reading and JDBC Client Java Deserialize
veracode-research/rogue-jndi
A malicious LDAP server for JNDI injection attacks
NickstaDB/BaRMIe
Java RMI enumeration and attack tool.
lalajun/RMIDeserialize
RMI 反序列化环境 一步步
wh1t3p1g/ysomap
A helpful Java Deserialization exploit framework.
github/codeql
CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
s0md3v/Arjun
HTTP parameter discovery suite.
chompie1337/SMBGhost_RCE_PoC
threedr3am/learnjavabug
Java安全相关的漏洞和技术demo,原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Spring、Dubbo、Shiro、CAS、Tomcat、RMI、Nexus等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。
LandGrey/SpringBootVulExploit
SpringBoot 相关漏洞学习资料,利用方法和技巧合集,黑盒安全评估 check list
shunf4/proxychains-windows
Windows and Cygwin port of proxychains, based on MinHook and DLL Injection
c0ny1/java-object-searcher
java内存对象搜索辅助工具
fofapro/vulfocus
🚀Vulfocus 是一个漏洞集成平台,将漏洞环境 docker 镜像,放入即可使用,开箱即用。
nsacyber/Mitigating-Web-Shells
Guidance for mitigation web shells. #nsacyber
zhzyker/exphub
Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本,最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340
labuladong/fucking-algorithm
刷算法全靠套路,认准 labuladong 就够了!English version supported! Crack LeetCode, not only how, but also why.
threedr3am/FindClassInJars
个人用于在自动化挖掘gadget时,方便查找gadget chains中class所在jar包,以助于便捷审计测试gadget有效性的那么一个小工具。
Ruil1n/after-deserialization-attack
Java After-Deserialization Attack
Dm2333/ATTCK-PenTester-Book
ATTCK-PenTester-Book
timwhitez/crawlergo_x_XRAY
360/0Kee-Team/crawlergo动态爬虫结合长亭XRAY扫描器的被动扫描功能
boy-hack/wooyun-payload
从wooyun中提取的payload,以及burp插件