A list of Google Dorks for Bug Bounty, Web Application Security, and Pentesting

A collection of Azure AD/Entra tools for offensive and defensive security purposes

SCEP request tool for AD CS and Intune

BaldHead is a modular and interactive Active Directory (AD) attack framework built for red teamers and security testers. It automates enumeration and exploitation of AD misconfigurations

Monkey365 provides a tool for security consultants to easily conduct not only Microsoft 365, but also Azure subscriptions and Microsoft Entra ID security configuration reviews.

🧙‍♂️ Node.js Command & Control for Script-Jacking Vulnerable Electron Applications

MCP server for JADX-AI Plugin

🕵️‍♂️ Offensive Google framework.

M365/Azure adversary simulation tool that generates realistic attack telemetry to help blue teams improve their detection and response capabilities.

game of active directory

AI-powered ffuf wrapper

An advanced, yet simple, tunneling/pivoting tool that uses a TUN interface.

My Notes about Penetration Testing

Azure Security Resources and Notes

POC & $BASH script for CVE-2024-4577

PHP CGI Argument Injection (CVE-2024-4577) Remote Code Execution PoC

A list of public penetration test reports published by several consulting firms and academic security groups.

Extract URLs, paths, secrets, and other interesting bits from JavaScript

winPEAS, but for Active Directory

Tool for extracting EXIF metadata from website images

User Enumeration of Microsoft Teams users via API

A tool for parsing breached passwords