~/hackyfeed $

AzSubEnum is a Python-based subdomain enumeration tool specifically designed for identifying subdomains linked to Azure services. It employs DNS resolution techniques and permutation methods to systematically explore Azure's domain structure, facilitating comprehensive security assessments for professionals by uncovering subdomains connected to various Azure resources like App Services, Databases, and Key Vaults. Notable features include multi-threaded execution for enhanced performance and support for user-defined permutation wordlists to tailor enumeration efforts.

Awesome Docker is a comprehensive resource repository aimed at enhancing the utilization of Docker technology for developers and operators, featuring a range of materials from introductory tutorials to advanced management and security practices. Its notable features include curated links to official Docker documentation, management tools like Portainer and Docker Compose, best practices, and security guidelines, as well as resources for monitoring and orchestration. This collection serves both newcomers and experienced users, providing valuable references to streamline containerized development and deployment workflows.

Awesome Attack Surface Monitoring is a curated repository of open-source and commercial Attack Surface Monitoring (ASM) tools designed to enhance an organization's security posture by identifying and managing vulnerabilities across their digital assets. This resource categorizes tools in an accessible format, highlighting editor's choices and providing visual overviews of key tools. Notable features include a comprehensive list of ASM solutions and visual representations, aiding in the selection of appropriate tools for various use cases.

The API Pentesting Tool is a Node.js-based application designed for conducting thorough security assessments of APIs. It offers a user-friendly web interface for executing various tests such as endpoint fuzzing, JWT vulnerabilities, and CORS policy checks, while presenting the results in an easily understandable format. Notable features include JWT algorithm manipulation, header security assessments, and a comprehensive suite of tests for authentication and rate-limiting vulnerabilities.

AdminProber is a Python tool designed to scan websites for potential admin panels by testing a specified list of common paths. It features multi-threaded scanning for enhanced performance, customizable path lists, and the ability to save scan results, including HTTP status codes, to an output file. Additionally, it includes checks for internet connectivity and updates to simplify maintenance.

AcquiFinder is a Python script designed to scrape Google search results for acquisition titles sourced from Crunchbase using Apify's Google Search Scraper. Its primary use case is to automate the retrieval of relevant acquisition data for specified companies, facilitating market research and analysis. Notable features include easy installation through a virtual environment and minimal setup requirements, such as an Apify account with API access.

ACEshark is a utility for the rapid extraction and analysis of Windows service configurations and Access Control Entries, streamlining the identification of potential privilege escalation vectors without reliance on non-native binaries. It operates by starting an HTTP/HTTPS server to receive and process data from a custom extractor script run on the target machine, generating detailed logs for each service configuration analyzed. Notable features include the ability to audit service permissions across users and groups, as well as options for TLS encryption during data transfer.

ftpknocker is a multi-threaded scanner designed to identify anonymous FTP servers across various target networks. Its primary use case includes scanning individual IP addresses or entire IP blocks, with customizable options for threading, port specification, and timeout settings. Notable features include support for input via piping from other programs and a flexible usage syntax similar to nmap, enhancing its functionality for security assessments.

Cloudfish is a Python tool designed for subdomain enumeration using Cloudflare's DNS services, primarily aimed at penetration testers and bug bounty hunters. It automates the creation of a Cloudflare zone for a specified domain, scans for DNS records, saves the findings, and then deletes the zone, all while maintaining a passive approach since the scanning is executed on Cloudflare's end. Notable features include a silent operational mode with the option for verbose output, and the ability to be imported as a module for custom integration.

XMLRPC-Bruteforce is a specialized penetration testing tool designed for exploiting the XML-RPC functionality in WordPress, allowing users to conduct hyper-optimized brute force attacks. By employing a unique batch method capable of testing 50-100 passwords per request and utilizing a binary search algorithm for credential discovery, it offers significant speed improvements over traditional brute force methods. Notable features include smart detection of web application firewalls, real-time statistics tracking, and a user-friendly interface with color-coded outputs and progress visualizations.

Windfire is a high-performance, Rust-based tool designed for URL liveness detection, enabling fast and lightweight asset availability checks for domains, IPs, and URLs. Its notable features include support for HTTP/SOCKS proxies, HTTP status code filtering, customizable paths, and the ability to choose between liveness-only and full fingerprinting scan modes, all while maintaining high concurrency and asynchronous execution. Additionally, users can control the scan rate and export results in CSV or JSON formats.

wifikit is a WiFi pentesting toolkit designed for macOS, implemented in pure Rust without the need for kernel extensions or virtual machines. It enables comprehensive wireless network penetration testing through features like channel scanning, multiple attack engines (including PMKID extraction and WPS PIN cracking), and packet capturing, all accessible via an intuitive terminal user interface. The tool is specifically tailored for Apple Silicon and directly interacts with USB WiFi chipsets, providing a unique solution for native macOS penetration testing.

WiFi Password Stealer is a cybersecurity tool designed to extract WiFi credentials from target computers using keystroke injection techniques via a USB device, specifically leveraging a Raspberry Pi Pico configured as a Rubber Ducky. The tool facilitates information exfiltration through customized payloads, allowing stolen data to be sent over email or stored on a USB drive. It demonstrates advanced attack vectors, including both Rubber Ducky and Bash Bunny methods, while emphasizing the importance of physical access to the target system.

whomrx-dosX is a DDOS tool designed to flood a target server with packets until it becomes unresponsive. It requires a simple installation process and allows users to specify target IP addresses and packet configurations through command-line parameters. Notable features include the ability to set the port and number of packets sent, making it an educational resource for understanding network stress testing.

WebCap is a lightweight web screenshot tool that captures fully-rendered DOMs and detailed HTTP request/response logs without the need for browser automation frameworks. Its primary use case is to provide comprehensive insights into web pages, with unique features including JSON output, JavaScript extraction, and OCR text extraction. Users can operate it via a command line interface or a web server, allowing for automated scanning of multiple URLs and capturing of detailed web elements efficiently.

Weakpass is a comprehensive password and hash cracking toolkit that consolidates several tools for penetration testing and security assessments. It features a password generator (Passgen), a secure hash lookup tool (Lookup), and a password compromise checker (Passcheck), allowing users to generate targeted wordlists, perform client-side hash lookups without data exposure, and assess password vulnerabilities through rule-based simulations. Notably, it includes precomputed hash data and can be hosted locally for enhanced security and performance.

WaybackURLsX is a Go-based tool designed to extract archived URLs from the Wayback Machine, emphasizing performance and user-configurable features. It offers smart filtering for sensitive files, adaptive rate limiting to comply with Wayback Machine constraints, and automatic retry mechanisms with exponential backoff for robust error handling. Notable features include detailed logging, support for domain-specific searches, and the capability to filter results based on custom regex patterns.

vulntechfinder is an automated vulnerability scanning tool that utilizes technology stack detection to execute targeted scans using tools like Nuclei and httpx. It supports features such as automated tech stack identification, configurable parallel processing, smart filtering for technology inclusion, and crash-safe resume capabilities, making it versatile for various scanning needs. The tool is compatible with any security tool that accepts technology tags, thereby enhancing its utility in security assessments.

Vulnshop is a deliberately insecure e-commerce web application designed for security training and penetration testing practice, featuring over 40 embedded vulnerabilities across various categories of web application security. Built on Node.js, it simulates a modern online shopping platform with functionalities like user authentication, product management, and an administrative dashboard, allowing users to practice real-world exploitation scenarios in a controlled environment. The tool facilitates educational engagement with critical security concepts, but should only be used in isolated setups to prevent exploitation in production contexts.

The Venera Framework is a Lua-based tool designed for automating customizable tests and attacks across various protocols. Its primary use case lies in vulnerability scanning and exploitation, allowing users to create and manage scripts that target specific vulnerabilities or conduct general verification tasks. Notable features include a built-in package manager, the ability to import and export scripts, and a flexible scripting environment that supports user-defined modules for tailored security testing.

unew is a high-performance command-line utility designed for efficiently processing and managing unique lines from input streams, offering functionalities similar to `sort`, `uniq`, and `tee`. Its primary use case is deduplication and data organization, featuring advanced capabilities such as case-insensitive processing, file splitting, shuffling, and the ability to append new unique lines to existing files. Benchmarked against similar tools, unew demonstrates superior speed and memory efficiency, making it suitable for handling large datasets.

Turbo-attack is a pentesting tool designed to generate random network traffic with variable MAC and IP addresses, enhancing testing capabilities for network resilience against traffic-based attacks. It supports both IPv4 and IPv6 on various Linux architectures (ARM64 and AMD64), and is optimized for environments such as Kali Linux using native syscalls for improved performance. This tool is intended for educational use and emphasizes responsible usage to prevent unauthorized access to networks.

TraxOsint is an open-source OSINT tool designed for gathering comprehensive information on IP addresses using various APIs and services for accurate data comparison. Its notable features include asynchronous scraping, capabilities for checking IP validity, open port status, and geographical information generation, along with integration with services like Pastebin and ProtonVPN. The tool also provides a command-line interface for user interaction and outputs detailed IP-related data, including geographical mapping.

tldscan is a high-performance domain scanner designed to identify active domains by testing various Top-Level Domains (TLDs) against user-specified domain names. It features customizable concurrency levels, wordlist options for domain generation, and the ability to output results to a specified file, making it suitable for domain reconnaissance tasks in cybersecurity. Notably, users can choose between small and large wordlists and utilize silent or verbose modes for streamlined operation or detailed debugging.

TireFire is a semi-automatic enumeration platform designed for penetration testing, leveraging HackTricks resources for real-time updates and command execution. It enables users to initiate and control scans, effectively managing their footprint while generating organized lists of results, which is particularly beneficial for training environments and professional assessments. Notable features include support for multiple terminal interfaces like Tmux and Tilix, allowing for flexible and streamlined scan management.