laowang1026 Goto Github PK

juicypotato

JuicyPotato修改版

jwt-secret

Bruteforce a JWT against a list of passwords

jwt_tool

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens

jwtips

Usefull JWT Tool.

jwtxploiter

A tool to test security of json web token

k0otkit

k0otkit is a universal post-penetration technique which could be used in penetrations against Kubernetes clusters.

kernel-exploits

Various kernel exploits

kernelhub

:palm_tree:Windows exploits提权漏洞合集，附带编译环境，演示GIF图，漏洞详细信息，可执行文件

keye

Keye is a reconnaissance tool that was written in Python with SQLite3 integrated. After adding a single URL, or a list of URLs, it will make a request to these URLs and try to detect changes based on their response's body length.

killdefender

A small POC to make defender useless by removing its token privileges and lowering the token integrity

knockknock

A simple reverse whois lookup tool which returns a list of domains owned by people or companies

kscan

Kscan是一款纯go开发的全方位扫描器，具备端口扫描、协议检测、指纹识别，暴力破解等功能。支持协议1200+，协议指纹10000+，应用指纹2000+，暴力破解协议10余种。

ksubdomain

无状态子域名爆破工具

kube-hunter

Hunt for security weaknesses in Kubernetes clusters

kubestalk

KubeStalk discovers Kubernetes and related infrastructure based attack surface from a black-box perspective.

langsrccurise

SRC子域名资产监控

laravel_cve-2021-3129_exp

leakinfo_finder

批量爬取JS文件中接口信息，添加spring boot actuator目录扫描以及手机号、身份证号码等敏感信息匹配

leaky-paths

A collection of special paths linked to major web CVEs, known misconfigurations, juicy APIs ..etc. It could be used as a part of web content discovery, to scan passively for high-quality endpoints and quick-wins.

learn-security-from-0

从0开始学安全，注重实战+技巧的运用，分享各种安全攻防干货，包括但不限于：内网渗透、代码审计 、Web安全、企业安全等。

learnjavabug

Java安全相关的漏洞和技术demo，原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Spring、Dubbo、Shiro、CAS、Tomcat、RMI、Nexus等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。

lfimap

Local file inclusion discovery and exploitation tool

ligolo

Ligolo : 用于内网渗透的反向隧道

lilly

Tool to find the real IP behind CDNs/WAFs like cloudflare using passive recon by retrieving the favicon hash. For the same hash value, all the possible IPs, PORTs and SSL/TLS Certs are searched to validate the target in-scope.

linux-exploit-suggester

Linux privilege escalation auditing tool

listips

A script that uses nmap to expand IP ranges into a list of IPs

log4j-scan

A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

log4j-sniffer

A tool that scans archives to check for vulnerable log4j versions

log4j2-cve-2021-44228

Remote Code Injection In Log4j

log4j2-rce-scanner

BurpSuite Extension: Log4j2 RCE Scanner