Prototype Pollution and useful Script Gadgets

Alternative Shellcode Execution Via Callbacks

Convert Cobalt Strike profiles to modrewrite scripts

Internal Crossfire Hack

Access without a real handle

PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)

An open source swiss army knife for arbitrary communication over application protocols

Extract relative urls from a heap snapshot

Tool to generate smart and powerful wordlists

Reverse proxies cheatsheet

A helpful Java Deserialization exploit framework based on ysoserial

AV/EDR evasion via direct system calls.

口令爆破字典，有键盘组合字典、拼音字典、字母与数字混合这三种类型

Converts PE into a shellcode

越来越多的网站具有反爬虫特性，有的用图片隐藏关键数据，有的使用反人类的验证码，建立反反爬虫的代码仓库，通过与不同特性的网站做斗争（无恶意）提高技术。（欢迎提交难以采集的网站）（因工作原因，项目暂停）

Python script wrote to automate the process of generating various reverse shells.

Multi-hop Proxy Tool for pentesters

Exfiltrate blind remote code execution output over DNS via Burp Collaborator.

fastjson命令执行利用工具， remote code execute

anti AV

Java安全相关的漏洞和技术demo，原生Java、Fastjson、Jackson、Hessian2、XML反序列化漏洞利用和Dubbo、Shiro、CAS、Tomcat、RMI等框架\中间件\功能的exploits以及Java Security Manager绕过、Dubbo-Hessian2安全加固等等实践代码。

Antivirus evasion project

Shiro<=1.2.4反序列化，一键检测工具

Fetch and print the GraphQL schema from a GraphQL HTTP endpoint. (Can be used for Relay Modern.)

List DTDs and generate XXE payloads using those local DTDs.