Python script to enumerate users, groups and computers from a Windows domain through LDAP queries - ropnop/windapsearch

Automated Security Testing For REST API's. Contribute to flipkart-incubator/Astra development by creating an account on GitHub.

Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage. - lanjelot/patator

Quick SQLMap Tamper Suggester . Contribute to m4ll0k/Atlas development by creating an account on GitHub.

PoC exploit for the CVE-2019-15126 kr00k vulnerability - hexway/r00kie-kr00kie

Kernel Address Space Layout Derandomization (KASLD) - A collection of various techniques to infer the Linux kernel base virtual address as an unprivileged local user, for the purpose of bypassing K...

Linux privilege escalation auditing tool. Contribute to The-Z-Labs/linux-exploit-suggester development by creating an account on GitHub.

Technical details about how to pivot through a Microsoft SQL Server . Using mssql as a proxy for lateral movement

mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse - blackarrowsec/mssqlproxy

PoC to demonstrate how CLR ETW events can be tampered. - GitHub - outflanknl/TamperETW: PoC to demonstrate how CLR ETW events can be tampered.

Windows and Active Directory

Automated All-in-One OS Command Injection Exploitation Tool. - commixproject/commix

Server-Side Template Injection and Code Injection Detection and Exploitation Tool - epinna/tplmap

CVE-2020-0796 - Windows SMBv3 LPE exploit #SMBGhost - danigargu/CVE-2020-0796

NTLM relay is a technique of standing between a client and a server to perform actions on the server while impersonating the client. Protections such as SMB signing or MIC allow to limit the actions of an attacker. This article goes into detail about this…

This article aims to explain the Kerberoasting attack principle, based on the TGS request and the SPN attributes of Active Directory accounts.

When asking for a TGT, a user has to preauthenticate himself to the domain controller in order to get a response. If preauthentication is disabled, this account is vulnerable to as_rep roasting attack.