Christophe Tafani-Dereeper

CloudFlair. 🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.

log4shell-vulnerable-app. Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228).

censys-subdomain-finder. ⚡ Perform subdomain enumeration using the certificate transparency logs from Censys.

Adaz. :wrench: Deploy customizable Active Directory labs in Azure - automatically.

spoofing-office-macro. :fish: PoC of a VBA macro spawning a process with a spoofed parent and command line.

duplicacy-autobackup. :floppy_disk: Painless automated backups to multiple storage providers with Docker and duplicacy.

mindmaps. :mag: Mindmaps for threat hunting - work in progress.

IPv6teal. :wave: Stealthy data exfiltration via IPv6 covert channel

firepwned. :pray: Checks Firefox saved passwords against known data leaks using the Have I Been Pwned API.

nextcloud-docker-compose. :cloud: Spin up a Nextcloud instance with automatied backups and SSL certificate issuance.

docker-python-sandbox. A Docker-powered NodeJS sandbox to execute untrusted python code.

nmap-nse-info. Browse and search through nmap's NSE scripts.

aws-sso-device-code-authentication. Python

geolocate-ips. Batch IP geolocation script.

code-execution-api-demo. JavaScript

abusing-cloudflare-workers. Abusing Cloudflare Workers to establish persistence and exfiltrate sensitive data at the edge.

fun-with-vpc-endpoints. HCL

telegram-downbot. A Telegram bot to monitor websites

polybot. CoffeeScript

unix-commands. Some useful UNIX commands

my-arsenal-of-aws-security-tools. List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.

vulnerable-java-application. This repository contains a sample Java application vulnerable to command injection and server-side request forgery (SSRF).

PowerSploit. PowerSploit - A PowerShell Post-Exploitation Framework

known_aws_accounts. List of known AWS accounts

powercoders-docker. Repository for Powercoders Docker presentation and workshop

falias. Shell

aws-security-cert-service-notes. Security aspects of AWS products for the Security Specialist certification

container-security-site. HTML

fun-with-aws-load-balancers. HCL

BloodHound. Six Degrees of Domain Admin

opennem. Energy market data access platform

manifesto. The OpenTF Manifesto expresses concern over HashiCorp's switch of the Terraform license from open-source to the Business Source License (BSL) and calls for the tool's return to a truly open-source license.

filezilla-passwords-revealer. JavaScript

fos2015.github.io. Website for the Foundations of Software course at EPFL in the Fall 2015 semester