NetSPI/PowerUpSQL

Security

Stars
2,444
Rank 18,812 (Top 0.4 %)
Language
PowerShell
License
Other
Created over 8 years ago
Updated 3 months ago

NetSPI/PowerUpSQL

NetSPI

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

PowerUpSQL: A PowerShell Toolkit for Attacking SQL Server

PowerUpSQL includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post exploitation actions such as OS command execution. It is intended to be used during internal penetration tests and red team engagements. However, PowerUpSQL also includes many functions that can be used by administrators to quickly inventory the SQL Servers in their ADS domain and perform common threat hunting tasks related to SQL Server.

PowerUpSQL Wiki

For setup instructions, cheat Sheets, blogs, function overviews, and usage information check out the wiki: https://github.com/NetSPI/PowerUpSQL/wiki

Author and Contributors

Author: Scott Sutherland (@_nullbind)
Major Contributors: Antti Rantasaari, Eric Gruber (@egru), Thomas Elling (@thomaselling)
Contributors: Alexander Leary (@0xbadjuju), @leoloobeek, Andrew Luke(@Sw4mpf0x), Mike Manzotti (@mmanzo_), @TVqQAAMA, @cobbr_io, @mariuszbit (mgeeky), @0xe7 (@exploitph), phackt(@phackt_ul), @vsamiamv, and @ktaranov

Issue Reports

I perform QA on functions before we publish them, but it's hard to consider every scenario. So I just wanted to say thanks to those of you that have taken the time to give me a heads up on issues with PowerUpSQL so that we can make it better.

Bug Reporters: @ClementNotin, @runvirus, @CaledoniaProject, @christruncer, rvrsh3ll(@424f424f),@mubix (Rob Fuller)

License

BSD 3-Clause

MicroBurst

A collection of scripts for assessing Microsoft Azure security

SQLInjectionWiki

A wiki focusing on aggregating and documenting various SQL injection methods

PESecurity

PowerShell module to check if a Windows binary (EXE/DLL) has been compiled with ASLR, DEP, SafeSEH, StrongNaming, and Authenticode.

PowerHuntShares

PowerHuntShares is an audit script designed in inventory, analyze, and report excessive privileges configured on Active Directory domains.

xssValidator

This is a burp intruder extender that is designed for automation and validation of XSS vulnerabilities.

NetblockTool

Find netblocks owned by a company

PowerShell

NetSPI PowerShell Scripts

ESC

Evil SQL Client (ESC) is an interactive .NET SQL console client with enhanced SQL Server discovery, access, and data exfiltration features. While ESC can be a handy SQL Client for daily tasks, it was originally designed for targeting SQL Servers during penetration tests and red team engagements. The intent of the project is to provide an .exe, but also sample files for execution through mediums like msbuild and PowerShell.

WebLogicPasswordDecryptor

PowerShell script and Java code to decrypt WebLogic passwords

sshkey-grab

Grab ssh keys from ssh-agent

JavaSerialKiller

Burp extension to perform Java Deserialization Attacks

django.nV

Vulnerable Django Application

Wsdler

WSDL Parser extension for Burp

Swift.nV

Security Training Tool that demonstrates common mobile application vulnerabilities using Swift in iOS

aws_consoler

A utility to convert your AWS CLI credentials into AWS console access.

DAFT

DAFT: Database Audit Framework & Toolkit

Powershell-Modules

Burp-Extensions

Central Repo for Burp extensions

BurpCollaboratorDNSTunnel

A DNS tunnel utilizing the Burp Collaborator

BetaFast

Vulnerable thick client applications used as examples in the Introduction to Hacking Desktop Applications blog series

BurpExtractor

A Burp extension for generic extraction and reuse of data within HTTP requests and responses.

AWSSigner

Burp Extension for AWS Signing

AutoDirbuster

Automatically run and save ffuf scans for multiple IPs

SQLC2

SQLC2 is a PowerShell script for deploying and managing a command and control system that uses SQL Server as both the control server and the agent.

PowerHunt

PowerHunt is a modular threat hunting framework written in PowerShell that leverages PowerShell Remoting for data collection on scale.

FuncoPop

Tools for attacking Azure Function Apps

MonkeyWorks

cmdsql

heapdump-ios

Dump IOS application heap space from memory

SpoofSpotter

A tool to catch spoofed NBNS responses.

skl

strace keylogger PoC

grails-nV

Vulnerable Grails application

JSONBeautifier

JSON Beautifier for Burp written in Java

asa_tools

Verification tools for CVE-2016-1287

MoneyX

MoneyX is an intentionally vulnerable JSP application used for training developers in application security concepts.

JIG

Jira Information Gatherer

httpillage

HTTPScrapers

NetSPI HTTP Scrapers

binrev

crossdomainscanner

Python tool for expired domain discovery in crossdomain.xml files

goat.js

Tutorial for Node.js security

PS_Reflector

PS_MultiCrack

A powershell script for cracking halfLMchall password hashes

PS_CC_Checker

DataLoc

Scan MSSQL databases for payment card data without relying on key words

silkwasm

HTML Smuggling with Web Assembly

Pin

Intel pin tools

ruby_apk_unpack

Ruby Gem to Unpack APK(s)

SVNentriesParser

A powershell script to parse SVN entries files into an HTML directory listing

Dekrypto

JSWS

JavaScript Web Service Proxy Burp Plugin

gppdecrypt

Stand alone script to decrypt GPP cpassword.

TapJacking-Demo

WCF

PycroBurst

Python implementation of select MicroBurst scripts.

Custom-Passive-Scanner

Define custom findings for Burp's Passive Scanner using regex.

doctordocker

Docker Doctor - Automated upgrading of libraries through Docker deployments.

osint_scripts

Collection of Scripts of Open Source Intelligence Gathering

npm-deps-parser

Parses, summarizes, and prints "npm audit" json output to markdown for nVision reports

DetectionRules

This is a single location to store detection rules of various types.

Scheduled-Task

Native Binary for Creating a Scheduled Task

rails-scope

scoping gem for rails application

CollegePresentation

edge-cases-in-web

brigade-security-scripts

Brigade scripts to perform common Kubernetes and container-level security checks triggered by events.

WikiJekyllTheme

Wiki theme for various NetSPI wikis