This is your work, valued

London

Daniel Card

Elite
@mr-r3b00t
www.pwndefend.com

crime-mapper. A tool for mapping cyber crime

241

soc_chef. Security Operations Chef

105

GoDark. Go Dark

40

CVE-2021-3156.

35

kali_p05t_1n5ta11. Some bash to make life easier after a new kali install..

34

NotProxyShellHunter. Check for NotProxyShell CVE-2022-40140 & CVE-2022-41082

26

CVE-2020-2021. CVE-2020-2021

22

msdt_pwn. HTML

20

RDP_Backdoor. PowerShell

20

ExchangeMarch2021IOCHunt. Really fast knock up use at own risk etc.

18

OSCP.

15

parse_win_log. PowerShell

14

CVE-2021-44228. Backdoor detection for VMware view

13

KQL. This is for my crappy (but hopefully useful) MDE and Sentinel KQL queries! #KQLThePlanet

13

CVE-2023-3519. PowerShell

13

cyberwar.

11

psh-portscanner. Simple Powershell Port scanner

10

CVE-2024-47176. Scanner

9

incidentrepsonse. PowerShell

9

file_report. a quick ps1 to create a csv report of the folders, files and metadata of a directory and it's subfolders

8

AzureADAudit. A WIP powershell script to audit azure directory services

7

fuckConti.

7

amsi_bypass. Modified from Rasta Mouse's bypass which was flagged by defender.

6

CyberEssentials. PowerShell

6

cybermapper. PowerShell

6

not_a_pentest. A quick basic script created with GROK to test for some common web application vulnerabilities. This is, as it says, 'not a pentest' but should help people cover some of the things that are important when publishing apps to the internet!

6

badusernames.

6

Neighbours. PowerShell

6

3cx_march_2023.

5

WarPi. A quick n dirty bash script to install some hax toolz on a Pi running Raspbian n00bs OS

5

msft_abuse_report. PowerShell

4

AD_Enum. AD enum emulation

3

windows-privesc. Shell

3

PwnDefend-ep2. Pivoting

3

CVE-2019-18988. TeamViewer Store Credentials Decryption

3

psexec. PowerShell

3

MDE_Audit_Pol. This is a security audit config csv for importing to GPO to enable all of the detections required for MDE concering event logs

3

killnet_iocs_dos_romania.

3

office365pwn. PowerShell

3

WinHarden. PowerShell

2

1million.

2

CVE-2023-20198-IOS-XE-Scanner. PowerShell

2

cisco_brute_april_24_iocs. copied and re-factored from TALOS

2

maltrail. Malicious traffic detection system

2

debian_post. a post install shitty bash script for installing some pwntesting toolz - use at own risk its a crappy script

2

nuke_azure. Remove all resources from azure except ones with *shell* in their name

2

shell-backdoor. all shell backdoor in the world

2

b3_conti. A crappy batch file to simulate a human operator doing on box enum (windows) via cmd exec

2

wiregauard_server. Shell

2

TakeMyRDP2.0. An updated version of keystroke logger targeting the Remote Desktop Protocol (RDP) related processes, It utilizes a low-level keyboard input hook, allowing it to record keystrokes in certain contexts (like in mstsc.exe and CredentialUIBroker.exe)

2

ADLabPrep. PowerShell

2

applocker_bypass. hunt for folders you can use to bypass applocker

2

win_security_log_parse. get the ip address from security failure events

2

asus_ac88u. Classic ASP

2

7zipMOTW. PowerShell

2

zip_ripper. PowerShell

2

cobalt-strike.github.io. with love from mRr3b00t

2

AdminUserCreationAlertToolkit. For testing and triggering alerts

2