@SpiderLabs

Top repositories

1

ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. With over 10,000 deployments world-wide, ModSecurity is the most widely deployed WAF in existence.
C++
6,764
star
2

Responder

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.
Python
4,197
star
3

owasp-modsecurity-crs

OWASP ModSecurity Core Rule Set (CRS) Project (Official Repository)
Perl
2,404
star
4

ModSecurity-nginx

ModSecurity v3 Nginx Connector
Perl
1,334
star
5

HostHunter

HostHunter a recon tool for discovering hostnames using OSINT techniques.
Python
890
star
6

portia

Portia aims to automate a number of techniques commonly performed on internal network penetration tests after a low privileged account has been compromised.
PowerShell
497
star
7

MCIR

The Magical Code Injection Rainbow! MCIR is a framework for building configurable vulnerability testbeds. MCIR is also a collection of configurable vulnerability testbeds.
PHP
435
star
8

DoHC2

DoHC2 allows the ExternalC2 library from Ryan Hanson (https://github.com/ryhanson/ExternalC2) to be leveraged for command and control (C2) via DNS over HTTPS (DoH).
C#
432
star
9

scavenger

scavenger : is a multi-threaded post-exploitation scanning tool for scavenging systems, finding most frequently used files and folders as well as "interesting" files containing sensitive information.
Python
320
star
10

SharpCompile

SharpCompile is an aggressor script for Cobalt Strike which allows you to compile and execute C# in realtime. This is a more slick approach than manually compiling an .NET assembly and loading it into Cobalt Strike. The project aims to make it easier to move away from adhoc PowerShell execution instead creating a temporary assembly and executing using beacon's 'execute-assembly' in seconds.
C#
288
star
11

malware-analysis

A repository of tools and scripts related to malware analysis
Ruby
236
star
12

Nmap-Tools

SpiderLabs shared Nmap Tools
Lua
227
star
13

ikeforce

Python
226
star
14

snappy

Python
219
star
15

CryptOMG

CryptOMG is a configurable CTF style test bed that highlights common flaws in cryptographic implementations.
PHP
188
star
16

jboss-autopwn

A JBoss script for obtaining remote shell access
Shell
171
star
17

cribdrag

cribdrag - an interactive crib dragging tool for cryptanalysis on ciphertext generated with reused or predictable stream cipher keys
Python
168
star
18

Airachnid-Burp-Extension

A Burp Extension to test applications for vulnerability to the Web Cache Deception attack
Java
136
star
19

beef_injection_framework

Inject beef hooks into HTTP traffic and track hooked systems from cmdline
Ruby
122
star
20

SQLol

A configurable SQL injection test-bed
PHP
121
star
21

cve_server

Simple REST-style web service for the CVE searching
Ruby
98
star
22

msfrpc

Perl/Python modules for interfacing with Metasploit MSGRPC
Python
91
star
23

ModSecurity-apache

ModSecurity v3 Apache Connector
Perl
86
star
24

IOCs-IDPS

This repository will hold PCAP IOC data related with known malware samples (owner: Bryant Smith)
84
star
25

burplay

Burplay is a Burp Extension allowing for replaying any number of requests using same modifications definition. Its main purpose is to aid in searching for Privilege Escalation issues.
Java
82
star
26

BurpNotesExtension

Burp Notes Extension is a plugin for Burp Suite that adds a Notes tab. The tool aims to better organize external files that are created during penetration testing.
Java
66
star
27

KoreLogic-Rules

Updated version of the 2010 KoreLogic password cracking rules for John the Ripper
61
star
28

thicknet

TCP session interception and injection framework
Perl
56
star
29

BlackByteDecryptor

C#
55
star
30

groupenum

Python
54
star
31

ModSecurity-log-utilities

Set of CLI tools to transform ModSecurity logs into a meaningful information, given a context.
Python
47
star
32

Firework

Firework is a proof of concept tool to interact with Microsoft Workplaces creating valid files required for the provisioning process.
Python
46
star
33

UPnP-request-generator

A tool to parse UPnP descriptor XML files and generate SOAP control requests for use with Burp Suite or netcat
PHP
45
star
34

ackack

A program to monitor network traffic and detect unauthorized sessions.
Perl
40
star
35

OWASP-CRS-Documentation

Documentation for the OWASP CRS project
Python
40
star
36

batchyDNS

A reconnaissance tool that can quickly discover hostnames from a list of IP addresses.
Perl
39
star
37

microphisher

µphisher spear phishing tool (reference implementation)
Ruby
38
star
38

deblaze

Performs method enumeration and interrogation against flash remoting end points.
Python
37
star
39

ModSecurity-status

ModSecurity status
JavaScript
34
star
40

XMLmao

A configurable XPath/XML injection testbed
PHP
33
star
41

net-tns

Net::TNS, a Ruby library for connecting to Oracle databases.
Ruby
33
star
42

deface

A Java Server Faces (JSF) testing tool for decoding view state and creating view state attack vectors.
Java
30
star
43

yara-ruby

Ruby bindings for the yara file analysis and classification library
Ruby
30
star
44

owasp-distributed-web-honeypots

Repository for the OWASP/WASC Distributed Web Honeypots Project -
Shell
28
star
45

oracle_pwd_tools

Oracle Database 12c password brute forcer
Python
27
star
46

ModSecurity-pcap

The ModSecurity Pcap Connector
C++
25
star
47

cerealbox

Arduino-based network monitor
Java
24
star
48

ModSecurity-Python-bindings

Python bindings for libModSecurity (aka ModSecurity v3)
Python
23
star
49

pingback

Python
21
star
50

modsecurity-mlogc-ng

Next generation remote logging tool for ModSecurity, supporting native and JSON format.
C
21
star
51

modsec-sdbm-util

Utility to manipulate SDBM files used by ModSecurity. With that utility it is possible to _shrink_ SDBM databases. It is also possible to list the SDBM contents with filters such as: expired or invalid items only.
C
21
star
52

XSSmh

XSSmh - A configurable Cross-Site Scripting testbed
PHP
18
star
53

advisories-poc

C
18
star
54

masher

multiple password 'asher using Python’s hashlib
Python
16
star
55

OWASP-CRS-regressions

Regression tests for OWASP CRS v3
Python
16
star
56

ShelLOL

A configurable OS shell command injection vulnerability testbed
PHP
16
star
57

secrules-language-evaluation

Set of Python scripts to perform SecRules language evaluation on a given http request.
Python
14
star
58

secrules-language-tests

Set of test cases that can be used to test custom implementations of the SecRules language (ModSecurity rules format).
Perl
12
star
59

Keystone

This repository contains the scripts released under the "Keystone Rocks" series of the SpiderLabs blog
Perl
11
star
60

nrfdump

Python script for dumping firmware from read-back protected nRF51 chips
Python
9
star
61

TWSL2011-007_iOS_code_workaround

Workaround for the vulnerability identified by TWSL2011-007 or CVE-2008-0228 - iOS x509 Certificate Chain Validation Vulnerability
Objective-C
7
star
62

json_crypto_helper

Ruby
7
star
63

Jorogumo

Red Team Stored XSS SVG phishing-companion tool with the ability to serve a malicious login page, or clone an html page and implement custom javascript. It then generates a relevant SVG.
Python
6
star
64

zpminternational

5
star
65

REvil_config

Configuration file for REvil / Kaseya July campaign
4
star
66

Misc

A repository for miscellaneous files shared by SpiderLabs
2
star
67

Scripts

Various Scripts
1
star
68

Grandoreiro-decryptor

Grandoreiro decryptor and DGA generator (26.May.2022)
Python
1
star