Black Hat Ethical Hacking

DDoSlayer. An Advanced Layer 7 DDoS tool, Able to bypass CF and offers various DoS Techniques

TerminatorZ. TerminatorZ is a highly sophisticated and efficient Offensive CVE Exploitation Framework that scans for top potential vulnerabilities with known CVEs in your web applications.

Bug_Bounty_Tools_and_Methodology. Bug Bounty Tools used on Twitch - Recon

Nucleimonst3r. Nucleimonst3r is a powerful vulnerability scanner that can help Bug Bounty Hunters find low hanging fruit vulnerabilities for known CVEs and exploits but also gather all the technology running behind them for further investigation for a potential target.

SecretOpt1c. SecretOpt1c is a Red Team tool that helps uncover sensitive information in websites using ACTIVE and PASSIVE Techniques for Superior Accuracy!

XSSRocket. XSSRocket it is a tool designed for offensive security and XSS (Cross-Site Scripting) attacks.

SQLMutant. SQLMutant is a powerful SQL injection testing tool that includes both passive and active reconnaissance processes for any given domain. It filters URLs to identify those with parameters susceptible to SQL injection formats and then performs injection attacks. These attacks include pattern matching, error analysis, and timing attacks.

SSRFPwned. Checks for SSRF using built-in custom Payloads after fetching URLs from Multiple Passive Sources & applying complex patterns aimed at SSRF

ScopeHunter. ScopeHunter is a command-line tool for finding in scope targets for bug bounty programs.

fetchmeurls. A Tool for Bug Bounty Hunters that uses Passive and Active Techniques to fetch URLs as a strong Recon, so you can then create Attack Vectors (XSS, Nuclei, SQLi etc...)

AdminPBuster. AdminPBuster identifies hidden admin panels for any domain using a built-in wordlist that includes both common and obscure paths, effectively bypassing WAFs.

pacu. The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

OpenRediWrecked. A powerful and sophisticated tool for detecting and exploiting open redirect vulnerabilities using the sed utility and a selected list of carefully crafted payloads with encoding techniques.

s3-buckets-aio-pwn. An AIO Tool to check for Vulnerable Amazon S3 Buckets as part of Bug Bounty, the uniqueness of this tool is that it can take a file full of buckets, and check all of them with various attack scenarios if they are vulnerable

Pentest-Tools.

SQL-INJECTION-PWN. A 1 Liner SQL Injection Attack using SQLMAP and various parameters that helps quickly check for a vulnerabilities during Bug Bounty

OWASP-Nettacker. Automated Penetration Testing Framework

malicious-pdf. 💀 Generate a bunch of malicious pdf files with phone-home functionality. Can be used with Burp Collaborator or Interact.sh

Dorks-collections-list. List of Github repositories and articles with list of dorks for different search engines

bf_active_sub. Subdomain Bruteforce - Bounty Quick Code

BlackWidow. A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

HiddenEye. Modern Phishing Tool With Advanced Functionality [ Android-Support-Available ]

CMSeeK. CMS Detection and Exploitation suite - Scan WordPress, Joomla, Drupal and over 170 other CMSs

CloudFail. Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

ctfr. Abusing Certificate Transparency logs for getting HTTPS websites subdomains.

bheh-sub-pwner. This bash script tool, will perform advanced subdomain enumeration, save the results, it will then probe the subdomains into urls, save the results in a separate file, it will then resolve all the subdomains into ip addresses and save the results separately.

Dr0p1t-Framework. A framework that create an advanced stealthy dropper that bypass most AVs and have a lot of tricks

log4j-scan. A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228

Osintgram. Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname

mosint. An automated e-mail OSINT tool

linkedin_scraper. A library that scrapes Linkedin for user data

blackhatethicalhacking. Who We Are

Burp-Suite-Pro. A bash and powershell script to download the latest version of Burp-Suite Professional and use it for free.

androrat. androrat

BHEH_PHP_SHELL. Black Hat Ethical Hacking | PHP Backdoor Shell v1.0

InstagramOSINT. An Instagram Open Source Intelligence Tool

shad0w. A post exploitation framework designed to operate covertly on heavily monitored environments

sniffer. VoIPmonitor sniffer sources

blackbird. An OSINT tool to search for accounts by username in social networks.

wifijammer. Continuously jam all wifi clients/routers

awesome-bugbounty-tools. A curated list of various bug bounty tools

email-header-analyzer. E-Mail Header Analyzer

aquatone. A Tool for Domain Flyovers

bheh_conky_theme. Black Hat Ethical Hacking - Official Theme for Conky Manager

KatanaFramework. The New Hacking Framework

isitalive. This tool will resolve a list of Domains, IPs, Hosts, URLs and save the results for valid/invalid fast!

ruler. A tool to abuse Exchange services

Mobile-Security-Framework-MobSF. Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.

urh. Universal Radio Hacker: investigate wireless protocols like a boss 📡😎

Invoke-TheHash. PowerShell Pass The Hash Utils

o365-attack-toolkit. A toolkit to attack Office365

Veil. Veil 3.1.X (Check version info in Veil at runtime)

cve-bin-tool. This tool scans for a number of common, vulnerable components (openssl, libpng, libxml2, expat and a few others) to let you know if your system includes common libraries with known vulnerabilities.

lsassy. Extract credentials from lsass remotely

Talk2Me. Talk2Me interacts with OpenAI's language model to generate text responses and saves the conversation for future reference.

trape. People tracker on the Internet: OSINT analysis and research tool by Jose Pino

SecretScanner. :unlock: :unlock: Find secrets and passwords in container images and file systems :unlock: :unlock:

pegasus_spyware. decompiled pegasus_spyware

SharpCookieMonster. Extracts cookies from Chrome.

ODIN. Automated network asset, email, and social media profile discovery and cataloguing.