qlng Goto Github PK

activemq_throwable

Apache ActiveMQ (版本 < 5.18.3) RCE

activemqrce

用java实现构造openwire协议，利用activeMQ < 5.18.3 RCE 回显利用 内存马注入

adcscoercepotato

aksk_tool

AK资源管理工具，阿里云/腾讯云/华为云/AWS/UCLOUD/京东云/七牛云存储 AccessKey AccessKeySecret，利用AK获取资源信息和操作资源，ECS/CVM/E2/UHOST/执行命令，OSS/COS/S3管理，RDS/DB管理，域名管理，添加RAM/CAM/IAM账号等

as-exploits

**蚁剑后渗透框架

avkiller

利用图形化识别技术快速关闭目标机器上的杀毒软件

awesome-poc

一个漏洞POC知识库

be-a-docker-escaper

The container escape challenge of Be A RWCTFer competition (https://be-a-rwctfer.realworldctf.com/)

beacon_source

not a reverse-engineered version of the Cobalt Strike Beacon

bugbountyscanner

A Bash script and Docker image for Bug Bounty reconnaissance. Intended for headless use.

bypass-ssl-pinning

bypassantivirus

远控免杀系列文章及配套工具，汇总测试了互联网上的几十种免杀工具、113种白名单免杀方式、8种代码编译免杀、若干免杀实战技术，并对免杀效果进行了一一测试，为远控的免杀和杀软对抗免杀提供参考。

callbackdump

dump lsass进程工具

can-i-take-over-xyz

"Can I take over XYZ?" — a list of services and how to claim (sub)domains with dangling DNS records.

cf

Cloud Exploitation Framework 云环境利用框架，方便红队人员在获得 AK 的后续工作

chunked-coding-converter

Burp suite 分块传输辅助插件

cobalt_strike_wiki

Cobalt Strike系列

connectwise-screenconnect_auth-bypass-add-user-poc

crossc2

generate CobaltStrike's cross-platform payload

crossc2-1

generate CobaltStrike's cross-platform payload

crossnet-beta-1

红队行动中利用白利用、免杀、自动判断网络环境生成钓鱼可执行文件。

cs-avoid-killing

CS免杀加载器

cve-2021-21972

Proof of Concept Exploit for vCenter CVE-2021-21972

cve-2021-21973

CVE-2021-21972 Exploit

cve-2021-21974

POC for CVE-2021-21974 VMWare ESXi RCE Exploit

cve-2021-21985

CVE-2021-21985 VMware vCenter Server远程代码执行漏洞 EXP (更新可回显EXP)

cve-2021-21985_exp

cve-2021-21985 exploit

cve-2021-22005

cve-2021-44228-poc-log4j-bypass-words

🐱‍💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - A trick to bypass words blocking patches

cve-2022-26134

[PoC] Atlassian Confluence (CVE-2022-26134) - Unauthenticated OGNL injection vulnerability (RCE)