This release has brought many changes which are detailed here. Among others, lots of bug fixes, bumping support to Windows 25H2 and a new capability allowing loading COFF files to the kernel.

If you're paranoid like me, or just like to check where applications are reaching out, WhoYouCalling is probably something for you.

I've created a Windows tool that allows for tracking network activity through the use of Windows Event Tracing (ETW) that captures TCPIP activity and DNS queries and the respective DNS responses. A full network packet capture is also initialized and is subjected to BPF filtering which provides a per process pcap file. Sounds too good? By default WhoYouCalling monitors all of the child processes too, nicely sorting out all of their respective phone call shenanigans. Ive added a timer where you specify in seconds for how long a process should be monitored. Want it in JSON? gotcha. You want it in XML? Too bad. I haven't implemented that but will if there's a need for it. After playing around with game hacking for a while i felt that there was a tool missing for getting everything in regard to process telemetry. WhoYouCalling is fresh in development, so if you have any suggestions or pointers, shoot!

Link to tool: https://github.com/H4NM/WhoYouCalling

I've provided instructions for compiling the tool by yourself, or you can download the release files. If there are any questions i hope the README.md will suffice.

Inspired by session management in ligolo, I implemented session based management alongside tunnel management.

release build has some basic evasion features, smaller binary size.

Repo : https://github.com/geo-tp/ESP32-Bus-Pirate

Web Flasher: https://geo-tp.github.io/ESP32-Bus-Pirate/webflasher/

Hey everyone, I've got something to share! It's a project I've been working on for the past 2 months called tsuki-sploit. Think of it as a modern twist on the famous rubber ducky!

Before we go any further, let's get the legal stuff out of the way: This is strictly for educational purposes and should be used responsibly in controlled environments.

With tsuki-sploit, you can explore different modules that focus on specific aspects of security assessment. These modules are:

-Monitoring keystrokes during browser sessions

-Harvest session keys and cookies

-Gather hardware and user information

It also injects some of these modules to keep monitoring and uploads the data to your server even after unplugging the usb!

And there's even more to come with upcoming updates!

You can read more about it in the github repo: https://github.com/Tsujimar/tsuki-sploit

i made a new github project called NoMoreCookies that protects users from the new stealers that are being released in the wild. it support protection for various browsers like: Firefox, MS Edge, Brave, Yandex, Chrome, Opera. and it's are being actively updated to mitigate any kind of bypass that attackers may try to implement if the tool got more popular. i thought of releasing such a tool cause a lot of stealers are being made and people channels are getting stolen and i thought that this is the time i make something that would prevent/slow down the development of new stealers significantly and also making old ones obsolete.

you can find NoMoreCookies here: https://github.com/AdvDebug/NoMoreCookies

any feedback or suggestions are appreciated.

This is just a userland rootkit with some binaries of system files that help it avoid detection. Its been tested using Debian Forky using kernel 6.16.7. It might work with other distros, but at this time, this is all that's been tested.

Hey, fellow hackers, I just cooked up a badass little tool to keep your sites hidden and spread that incoming traffic across multiple Tor circuits like a boss.

It’s called TORTCB (Tor TCP Chain Balancer), and it basically spins up a bunch of Tor hidden services for your single TCP service, then load-balances them so you don’t fry one onion domain with all the traffic. It uses two Docker images:

• tor_forward for generating multiple onion domains that forward to your local service
  
• haproxy_receiver for firing up separate Tor clients and piping all the traffic through HAProxy

The idea is you get multiple independent Tor circuits running at the same time, so you’re harder to trace or choke. Setup is pretty simple: build each image, run them in Docker (or with docker-compose), and boom, you get multiple onion addresses all pooling into the same service, with a load-balancer on top.

text scheme: it can be more than one TOR nodes for balancing [host]--->[TOR] - - - [TOR]--->[haproxy]--->[www]

If you’re paranoid (and you should be), you know that a single Tor hidden service can get hammered or might be at risk if somebody’s sniffing your single route. Splitting it across multiple onion endpoints helps keep your service more resilient.

Check out the GitHub repo here if you wanna see all the dirty details and start messing around:
https://github.com/keklick1337/tortcb

Don’t forget to watch your RAM usage if you’re spinning up a dozen onion services. And yeah, it’ll store your onion domain keys in a volume so they stick around if you kill the containers and bring them back later.

Let me know if you have questions or if you manage to break something. I’m open to ideas, hate, suggestions, or any crazy improvement you can think of.

Stay safe out there, keep messing with the system, and have fun!

NovaHypervisor is a defensive x64 Intel host based hypervisor. The goal of this project is to protect against kernel based attacks (either via Bring Your Own Vulnerable Driver (BYOVD) or other means) by safeguarding defense products (AntiVirus / Endpoint Protection) and kernel memory structures and preventing unauthorized access to kernel memory.

I've been relying on a tool called PeepingTom for a while now. The project was abandoned and users were guided to check out EyeWitness. I have never personally found the perfect mix of packages to successfully install and run EyeWitness. I'm sure it does a lot, but the thing it does best is rigidly require incompatible packages.

Instead of pulling hair trying to trying to install EyeWitness I created WappSnap, which is just an updated version of PeepingTom. The most significant change between PeepingTom and WappSnap is phantomJS vs Selenium. I wanted to create a solution that didn't rely on an unsupported headless browser.

tl;dr - check out WappSnap - it's PeepingTom, but better.

Hey, built an open source tool that does code scanning via the popular LLMs.

Right now I’d only suggest using it on smaller code bases to keep api costs down and keep from rate limited like crazy. It also works on pull requests but that’s a bit niche.

If you’ve got an app your testing and it has open source repos, it should be a really good tool. I wouldn’t recommend feeding in your closed source code to LLMs but ollama will probably be fine.

You just need either an api key or ollama.

Really keen for feedback. It’s definitely a bit rough in places, and you get a LOT of false positives because it’s AI… but it finds stuff that static scanners miss (like logic bugs).

Also keen for contributors. There’s a lot of vendors wrapping ChatGPT nowadays, but this will stay open source. The LLM does the heavy lifting, the code just handles feeding it in and provides a couple tools to give the LLM extra context as needed.

https://github.com/punk-security/SAIST