Skip to content

@synacktiv Synacktiv

Change the repository type filter

All

    Repositories list

    80 repositories

    • octoscan

      Public
      Octoscan is a static vulnerability scanner for GitHub action workflows.
      githubexploitvulnerabilitycicdgithub-actions
      Go
      •
      GNU General Public License v3.0
      •9•162•2•1•Updated Oct 31, 2024Oct 31, 2024

    • bbs

      Public
      bbs is a router for SOCKS and HTTP proxies. It exposes a SOCKS5 (or HTTP CONNECT) service and forwards incoming requests to proxies or chains of proxies based on the request's target. Routing can be configured with a PAC script (if built with PAC support), or through a JSON file.
      Go
      •4•80•0•0•Updated Oct 30, 2024Oct 30, 2024

    • SCCMSecrets

      Public
      SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting, initial access and lateral movement.
      Python
      •16•153•0•0•Updated Oct 28, 2024Oct 28, 2024

    • action-octoscan

      Public
      📦 :octocat: A GitHub Action that performs a security scan of your GitHub Actions.
      githubsecurityscancicdgithub-actions
      Shell
      •
      GNU General Public License v3.0
      •0•4•0•0•Updated Oct 28, 2024Oct 28, 2024

    • shh

      Public
      Systemd Hardening Helper
      Rust
      •
      GNU General Public License v3.0
      •1•97•1•0•Updated Oct 23, 2024Oct 23, 2024

    • nord-stream

      Public
      Nord Stream is a tool that allows you to extract secrets stored inside CI/CD environments by deploying malicious pipelines. It currently supports Azure DevOps, GitHub and GitLab.
      githubgitlabgitlab-cici-cdcicdazuredevops
      Python
      •
      GNU General Public License v3.0
      •13•251•1•0•Updated Oct 20, 2024Oct 20, 2024

    • eos

      Public
      Enemies Of Symfony - Debug mode Symfony looter
      Python
      •
      Other
      •44•310•0•1•Updated Oct 18, 2024Oct 18, 2024

    • gh-hijack-runner

      Public
      A python script to create a fake GitHub runner and hijack pipeline jobs to leak CI/CD secrets.
      githubrunnercicdexploitationgithubactions
      Python
      •4•18•0•0•Updated Oct 13, 2024Oct 13, 2024

    • adb_client

      Public
      Rust ADB client
      Rust
      •1•8•1•0•Updated Oct 10, 2024Oct 10, 2024

    • DepFuzzer

      Public
      Python
      •
      MIT License
      •4•39•2•1•Updated Oct 8, 2024Oct 8, 2024

    • CVE-2024-45409

      Public
      Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) exploit
      Python
      •11•67•0•0•Updated Oct 7, 2024Oct 7, 2024

    • krbrelayx

      Public
      Kerberos unconstrained delegation abuse toolkit
      Python
      •
      MIT License
      •168•0•0•0•Updated Oct 3, 2024Oct 3, 2024

    • garble

      Public
      Obfuscate Go builds
      Go
      •
      BSD 3-Clause "New" or "Revised" License
      •254•0•0•0•Updated Sep 25, 2024Sep 25, 2024

    • AADOutsider-py

      Public
      Python3 rewrite of AsOutsider features of AADInternals
      Python
      •
      MIT License
      •2•36•0•0•Updated Sep 11, 2024Sep 11, 2024

    • kcmdump

      Public
      Dump Kerberos tickets from the KCM database of SSSD
      Python
      •5•48•0•0•Updated Sep 8, 2024Sep 8, 2024

    • veeam-velociraptor

      Public
      Proof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.
      GNU Affero General Public License v3.0
      •0•0•0•0•Updated Aug 27, 2024Aug 27, 2024

    • hexalocker-analysis

      Public
      HexaLocker ransomware analysis
      YARA
      •
      GNU Affero General Public License v3.0
      •0•1•0•0•Updated Aug 23, 2024Aug 23, 2024

    • ntdissector

      Public
      Python
      •
      Other
      •15•126•3•3•Updated Aug 16, 2024Aug 16, 2024

    • frinet

      Public
      Frida-based tracer for easier reverse-engineering on Android, iOS, Linux, Windows and most related architectures.
      C
      •
      MIT License
      •43•457•5•0•Updated Aug 7, 2024Aug 7, 2024

    • QLinspector

      Public
      Finding Java gadget chains with CodeQL
      CodeQL
      •
      GNU General Public License v3.0
      •17•160•0•0•Updated Jul 26, 2024Jul 26, 2024

    • CacheData_decrypt

      Public
      A simple Toolkit to BF and decrypt Windows EntraId CacheData
      Python
      •0•13•0•0•Updated Jun 20, 2024Jun 20, 2024

    • DLHell

      Public
      Local & remote Windows DLL Proxying
      Python
      •22•161•0•0•Updated Jun 17, 2024Jun 17, 2024

    • mobileiron-exploit

      Public
      Python
      •0•6•0•0•Updated Jun 4, 2024Jun 4, 2024

    • php_filter_chains_oracle_exploit

      Public
      A CLI to exploit parameters vulnerable to PHP filter chain error based oracle.
      Python
      •
      Other
      •14•219•0•0•Updated Jun 2, 2024Jun 2, 2024

    • Invoke-RunAsWithCert

      Public
      A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine.
      PowerShell
      •13•110•1•0•Updated May 13, 2024May 13, 2024

    • OUned

      Public
      The OUned project automating Active Directory Organizational Units ACL exploitation through gPLink poisoning
      Python
      •11•75•1•0•Updated Apr 17, 2024Apr 17, 2024

    • EIPP

      Public
      Entra ID Password Protection Banned Password Lists
      C#
      •1•13•0•0•Updated Apr 16, 2024Apr 16, 2024

    • ysoserial

      Public
      A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.
      Java
      •
      MIT License
      •1.8k•2•0•0•Updated Mar 20, 2024Mar 20, 2024

    • Arlo

      Public
      Arlo file format helper
      Python
      •1•12•0•0•Updated Mar 7, 2024Mar 7, 2024

    • krustyloader-analysis

      Public
      KrustyLoader Analysis
      YARA
      •
      Apache License 2.0
      •2•3•0•1•Updated Feb 24, 2024Feb 24, 2024