echocipher's Projects
PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface. This is possible via other protocols as well.
massive SQL injection vulnerability scanner
Struts2漏洞扫描利用工具 - Golang版. Struts2 Scanner Written in Golang
A DNS meta-query spider that enumerates DNS records, and subdomains.
一个子域名接管检测工具
A new generation of tool for discovering subdomains( ip , cdn and so on)
A fast sub domain brute tool for pentesters
A Powerful Subdomain Takeover Tool
基于实战沉淀下的各种弱口令字典
通达OA综合利用工具
Master the command line, in one page
Patch PE, ELF, Mach-O binaries with shellcode (NOT Supported)
E-mails, subdomains and names Harvester - OSINT
thinkphp反序列化漏洞复现及POC编写
thinkphp v5.x 远程代码执行漏洞-POC集合
ThreatHound is a threat intelligence query tool use for detecting potentially malicious IP or domains. It combines the MISP open source threat intelligence sharing platform as its back-end intelligence library, and currently integrates 69 open source threat intelligence data feeds from the security community.
To Be Top Javaer - Java工程师成神之路
通达OA 任意用户登录漏洞
看见一个top 500的用户名字典,觉得还可以,因为是中文,所以搞了了很low的脚本转换一下。
一个想帮你总结所有类型的上传漏洞的靶场
验证码研究破解心得记录。包含网易易盾,阿里云验证码,极验验证码等主流验证码破解。包含点按验证码、点选验证、语序点选等等。已更新极验验证码、企业公示网采集心得。
一键部署VPS渗透环境
用于辅助安全工程师漏洞挖掘、测试、复现,集合了mock、httplog、dns tools、xss,可用于测试各类无回显、无法直观判断或特定场景下的漏洞。
🚀Vulfocus 是一个漏洞集成平台,将漏洞环境 docker 镜像,放入即可使用,开箱即用。
一款基于被动的漏洞关键词匹配插件。
厂商未公开漏洞库
python3写的综合扫描工具,主要用来存活验证,敏感文件探测(目录扫描/js泄露接口/html注释泄露),WAF/CDN识别,端口扫描,指纹/服务识别,操作系统识别,POC扫描,SQL注入,绕过CDN,查询旁站等功能,主要用来甲方自测或乙方授权测试,请勿用来搞破坏。
Passive Security Scanner (被动安全扫描器)
WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.