威胁情报 Threat Intelligence
红队框架/工具集 Redteam Framework
-
[tools]
Utilities for MITRE™ ATT&CK https://github.com/nshalabi/ATTACK-Tools -
[tools]
好用的渗透工具列表 https://github.com/enaqx/awesome-pentest -
[book]
KALI渗透 https://jobrest.gitbooks.io/kali-linux-cn/content/ -
[paper]
ATT&CK 发布了七款安全产品的评估 https://medium.com/mitre-attack/first-round-of-mitre-att-ck-evaluations-released-15db64ea970d -
[doc]
红队技术实战 https://ired.team/ -
[tools]
红队框架 https://ired.team/offensive-security/red-team-infrastructure/automating-red-team-infrastructure-with-terraform -
[cheatsheet]
红队手册 https://github.com/mantvydasb/Offensive-Security-OSCP-Cheatsheets/ -
[tools]
渗透、红队工具集 https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE -
[tools]
红队资源集合 https://github.com/yeyintminthuhtut/Awesome-Red-Teaming/ -
[tools]
APT实战资源 https://osint-labs.org/apt/
MITRE ATT&CK Matrix
-
Caldera https://github.com/mitre/caldera https://caldera.readthedocs.io/en/latest/index.html
-
Atomic Red Team https://github.com/redcanaryco/atomic-red-team https://atomicredteam.io
-
DumpsterFire https://github.com/TryCatchHCF/DumpsterFire
-
Metta https://github.com/uber-common/metta https://github.com/uber-common/metta/wiki
业内红队 Industry
信息搜集 Reconnaissance
OSINT 在线工具
-
[tools]
企业邮箱搜索工具 http://www.skymem.info/ -
[tools]
子域名和DNS历史记录Dnstrails https://securitytrails.com/dns-trails -
[tools]
全网证书搜索 http://crt.sh -
[tools]
多种域名/IP信息工具 https://viewdns.info/ -
[tools]
https://pentest-tools.com -
[tools]
全网资产搜索 Shodan https://www.shodan.io/ -
[tools]
全网资产搜索 Censys https://censys.io -
[tools]
全网资产搜索 Fofa https://fofa.so/ -
[tools]
全网资产搜索 Zoomeye https://www.zoomeye.org/ -
[tools]
DNS查询 https://dnsdumpster.com/ -
[tools]
文件在线监测 VirusTotal https://www.virustotal.com/ -
[tools]
DNS查询 http://www.dnsgoodies.com/ -
[tools]
Google ASE aka Google Dorking [Most effective in some cases] -
[tools]
Spiderfoot [Currently Free, just request for a Spiderfoot instance] -
[tools]
Binaryedge [Paid/Rate-Limited] -
[tools]
onyphe.io [Free mostly]
入口突破 Entry
钓鱼 Phishing
-
[cases]
利用谷歌开放平台OAuth授权,伪装成Google Doc使用GMail传播钓鱼 https://www.reddit.com/r/google/comments/692cr4/new_google_docs_phishing_scam_almost_undetectable/ -
[blog]
Office在线视频钓鱼 https://blog.cymulate.com/abusing-microsoft-office-online-video -
[tools]
邮件钓鱼工具 https://www.mailsploit.com/index -
[trick]
利用DOCX文档远程模板注入执行宏https://xz.aliyun.com/t/2496 -
[trick]
浏览器窗口伪造 https://github.com/openworldoperations/FISHY -
[trick]
鼠标光标伪造 https://jameshfisher.github.io/cursory-hack/
硬件交互设备 HID Attack
-
[paper]
打印机利用 http://archive.hack.lu/2010/Costin-HackingPrintersForFunAndProfit-slides.pdf -
[tools]
BadUSB https://mp.weixin.qq.com/s/mIcRNcf5HmZ4axe8N92S7Q
无线入侵 Wireless Attack
[tools]
无需四次握手包破解WPA&WPA2密码 http://www.freebuf.com/articles/wireless/179953.html
服务器带外管理BMC、IPMI
Exploitation
-
[tools]
PE文件转为Shellcode / https://github.com/hasherezade/pe_to_shellcode -
[blog]
Java Runtime.exec(String)执行任意命令 https://www.anquanke.com/post/id/159554https://mp.weixin.qq.com/s/pzpc44-xH932M4eCJ8LxYghttp://jackson.thuraisamy.me/runtime-exec-payloads.html -
[paper]
利用 Java JDBC 驱动利用反序列化漏洞 https://xz.aliyun.com/t/7067 -
[blog]
关于Jackson的CVEs https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 -
[paper]
FastJson漏洞历史 https://github.com/miaochiahao/slides/tree/master/fastjson
权限提升 Privilege Escalation
-
[cheatsheet]
Windows提权笔记 https://xz.aliyun.com/t/2519 -
[cheatsheet]
Windows提权小抄 https://guif.re/windowseop -
[cheatsheet]
Windows本地提权技巧 http://payloads.online/archivers/2018-10-08/1 -
[cheatsheet]
Linux提权小抄 https://guif.re/linuxeop -
[exploit]
Windows-Exploit-Suggester https://github.com/GDSSecurity/Windows-Exploit-Suggester/blob/master/windows-exploit-suggester.py -
[exploit]
Linux-Exploit-Suggester https://github.com/PenturaLabs/Linux_Exploit_Suggester/ -
[exploit]
Windows Exploits https://github.com/abatchy17/WindowsExploits -
[exploit]
Windows Sherlock本地提权漏洞检查 https://github.com/rasta-mouse/Sherlock -
[cheatsheet]
Linux sudo滥用提权 http://touhidshaikh.com/blog/?p=790 -
[blog]
深入解读MS14-068漏洞:微软精心策划的后门?http://www.freebuf.com/vuls/56081.html -
[paper]
Windows特权提升 https://www.exploit-db.com/docs/english/46131-windows-privilege-escalations.pdf -
[tools]
juicy-potato本地提权 https://github.com/ohpe/juicy-potato https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ -
[exploit]
hh.exe提权 https://twitter.com/FlatL1ne/status/1194208167976165376 -
[tools]
Linux本地信息搜集 https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh
持久化后门 Persistent
-
[tools]
Gray Dragon .NET应用Runtime注入工具 / https://www.digitalbodyguard.com/graydragon.html -
[trick]
利用环境变量,在任意.Net应用DLL注入 / https://mobile.twitter.com/subTee/status/864903111952875521 https://docs.microsoft.com/en-us/previous-versions/dotnet/netframework-4.0/bb384689(v=vs.100) -
[tools]
PHP-FPM无文件后门Webshell https://www.anquanke.com/post/id/163197 -
[tools]
利用PrintDialog持久化+执行命令 http://www.hexacorn.com/blog/2018/08/11/printdialog-exe-yet-another-lolbin-for-loading-dlls/ -
[tools]
SystemSettings http://www.hexacorn.com/blog/2018/08/12/systemsettings-exe-yet-another-lolbin-for-loading-dlls/ -
[tools]
二进制加密Webshell https://xz.aliyun.com/t/2744https://github.com/rebeyond/Behinder -
[cheatsheet]
Linux权限维持 https://xz.aliyun.com/t/7338
Post Exploitation
Windows
-
无Powershell.exe的Powershell工具 / https://github.com/Ben0xA/nps
-
全阶段的Powershell渗透测试脚本 / https://github.com/samratashok/nishang
-
命令执行 Living off the Land https://github.com/api0cradle/LOLBAS
-
C# 后渗透测试库 SharpSploit 介绍 https://posts.specterops.io/introducing-sharpsploit-a-c-post-exploitation-library-5c7be5f16c51
-
[blog]
Windows执行命令和下载文件总结 https://www.cnblogs.com/17bdw/p/8550189.html -
[trick]
使用Rundll32运行.Net程序 https://blog.xpnsec.com/rundll32-your-dotnet/ -
[tools]
.NET DllExport https://github.com/3F/DllExport
Linux
- 纯Bash实现的后渗透工具 / https://github.com/TheSecondSun/Bashark/
凭据窃取 Credentials
-
[tools]
SafetyKatz https://github.com/GhostPack/SafetyKatz -
[tools]
Shellcode Dump LSASS https://osandamalith.com/2019/05/11/shellcode-to-dump-the-lsass-process/ -
[tools]
内网密码搜集和解密工具 https://github.com/klionsec/Decryption-tool
横向移动 Letaral Movement
-
[tools]
端口扫描 wrriten in GO https://github.com/ffuf/ffuf/tree/master -
[tools]
域信息搜集,域管理员的六度空间 https://github.com/BloodHoundAD/SharpHound -
[usage]
NMap空闲隐蔽扫描 https://nmap.org/book/idlescan.html -
[blog]
使用meterpreter进行NTLM中继攻击 https://diablohorn.com/2018/08/25/remote-ntlm-relaying-through-meterpreter-on-windows-port-445/ -
[tools]
Responder NetBIOS名称欺骗和LLMNR欺骗 https://github.com/SpiderLabs/Responder -
[tools]
NTLM Relay 攻击 Exchange Web Services https://github.com/Arno0x/NtlmRelayToEWS -
[tools]
SMB中间人劫持 https://github.com/quickbreach/SMBetray -
[tools]
代理隧道 https://github.com/txthinking/brook -
[tool]
代理隧道 https://github.com/Dliv3/Venom
绕过检测 Defense Evasion
-
[book]
效果不错的免杀,使用C#绕过杀毒软件 -
[tools]
生成免杀的Metasploit Payload / https://github.com/Veil-Framework/Veil -
[code]
自定义Meterpreter加载 / http://www.freebuf.com/articles/system/53818.html -
[blog]
九种姿势执行Mimikaz -
[blog]
使用.Net可执行程序进行渗透 -
[blog]
ATT&CK 攻击矩阵 躲避防御 -
[blog]
绕过下一代杀软 -
[blog]
Windows NTFS特殊文件夹绕过检测 -
[paper]
Winnti Bootkit http://williamshowalter.com/a-universal-windows-bootkit/ -
[paper]
UEFI Rootkit https://www.welivesecurity.com/2018/09/27/lojax-first-uefi-rootkit-found-wild-courtesy-sednit-group/ -
[twitter]
Linux Bash 混淆 https://twitter.com/DissectMalware/status/1025580967384305664 -
[tools]
免杀工具 AVEThttps://github.com/govolution/avet -
[blog]
绕过CrowdStrike检测 https://0x00sec.org/t/bypassing-crowdstrike-falcon-detection-from-phishing-email-to-reverse-shell/10802 -
[blog]
10 种绕过杀毒软件的方式 https://blog.netspi.com/10-evil-user-tricks-for-bypassing-anti-virus/ -
[tools]
DLL Side Loding Attack Gen https://github.com/Mr-Un1k0d3r/MaliciousDLLGenerator -
[tools]
BypassAV ShellCode Loader https://github.com/k8gege/scrun -
[blog]
Protecting Your Malware with blockdlls and ACG 利用微软自身提供的安全机制来反EDR https://blog.xpnsec.com/protecting-your-malware/ -
[blog]
Detecting Parent PID Spoofing https://blog.f-secure.com/detecting-parent-pid-spoofing/ -
[tips]
对抗EDR的三个重要特征: 1. Process Relationship / 2. Suspicious Network / 3. Command Line. -
[blog]
Antivirus Evasion with Python https://medium.com/bugbountywriteup/antivirus-evasion-with-python-49185295caf1 -
[tool]
JS免杀Shellcode https://github.com/Hzllaga/JsLoader -
[tool]
利用杀毒软件销毁自身 https://www.rack911labs.com/research/exploiting-almost-every-antivirus-software/ -
[tool]
免杀合集 https://github.com/TideSec/BypassAntiVirus -
[tool]
Apache/Nginx端口转发,隐藏TeamServer https://github.com/threatexpress/cs2modrewrite -
[tool]
《使用C#编写自定义后门负载》学习笔记及免杀尝试 https://xz.aliyun.com/t/6222 -
[tool]
杀软进程名检查 https://github.com/gh0stkey/avList/ -
[blog]
Windows免杀新技术 Process Herpaderping https://jxy-s.github.io/herpaderping/
C&C
-
[tools]
ICMP后门 https://github.com/inquisb/icmpsh -
[tools]
Windows远控 in C# https://github.com/quasar/QuasarRAT -
[tools]
Defcon后渗透工具,大宝剑 https://github.com/zerosum0x0/koadic -
[tools]
Custom Command and Control https://labs.mwrinfosecurity.com/tools/c3 -
[paper]
CobaltStrike教程文档 https://wbglil.gitbooks.io/cobalt-strike/ -
[blog]
PowerGhost挖矿病毒分析 https://www.freebuf.com/articles/system/219715.html -
[tools]
隐藏网络连接的后门 https://github.com/BeetleChunks/redsails -
[tools]
Powershell反连后门 https://github.com/ZHacker13/ReverseTCPShell -
[tool]
JS VBS Payload生成器 https://github.com/mdsecactivebreach/CACTUSTORCH -
[tool]
基于Golang的C2,DeimosC2 https://github.com/DeimosC2/DeimosC2
数据外传 Data Exfiltration
杂项 Misc
-
[forum]
Hack the box https://www.hackthebox.eu/ -
[tools]
代码生成手绘图 https://www.websequencediagrams.com/ -
[tools]
本地代码生成ascii文本绘图 graph::easy -
[tricks]
技巧汇总 https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet#lbwh-anchor
匿名邮箱和短信接收平台
中间人 MITM
安卓安全 Android
[paper]
Frida操作手册 https://github.com/hookmaster/frida-all-in-one
逆向分析 Reverse
-
[tools]
NSA发布逆向分析框架Ghidra https://www.nsa.gov/resources/everyone/ghidra/ -
[tools]
Modern Java Bytecode Editor https://github.com/Col-E/Recaf
爆破 & 字典 Wordlist
- 常见服务的暴力破解 https://github.com/lanjelot/patator
- 看起来很强的弱密码 https://github.com/r35tart/RW_Password
- 超全Payload https://github.com/swisskyrepo/PayloadsAllTheThings
扫描&自动化
- 分布式扫描器WDScanner https://www.freebuf.com/sectool/203772.html
云安全
Web安全
- https://github.com/qazbnm456/awesome-web-security
[tool]
Web扫描通用辅助函数集 https://wsltools.readthedocs.io/en/latest/[tool]
Web爬虫,基于Chrome Headless https://github.com/chaitin/rad
XXE
-
[tools]
XXE盲打外传工具 https://github.com/TheTwitchy/xxer -
[tools]
攻击Java RMI https://github.com/NickstaDB/BaRMIe
Java安全
[book]
Java安全 https://github.com/anbai-inc/javaweb-sec[tools]
优化版本yso https://github.com/zema1/ysoserial
前端黑魔法
paper
反爬虫JS破解与混淆还原手册 https://github.com/LoseNine/Restore-JS
Defense
入侵检测 Detection
-
[blog]
针对微软活动目录(AD)的七大高级攻击技术及相应检测方法 https://www.anquanke.com/post/id/161815 -
[blog]
攻防对抗:活动目录中的欺骗技术 https://www.anquanke.com/post/id/162210 -
[tools]
Webshell查杀 http://www.shellpub.com/
主机加固
[blog]
隐藏其他用户的进程信息 https://linux-audit.com/linux-system-hardening-adding-hidepid-to-proc/