Synacktiv ORG

No description.

HopLa Burp Suite Extender plugin - Brings AI capabilities, autocompletion support, and a set of useful payloads to Burp Suite

Frida-based tracer for easier reverse-engineering on Android, iOS, Linux, Windows and most related architectures.

The GPOddity project, aiming at automating GPO attack vectors through NTLM relaying (and more).

Nord Stream is a tool that allows you to extract secrets stored inside CI/CD environments by deploying malicious pipelines. It currently supports Azure DevOps, GitHub and GitLab.

gpoParser is a tool designed to extract and analyze configurations applied through Group Policy Objects (GPOs) in an Active Directory environment.

Enemies Of Symfony - Debug mode Symfony looter

A CLI to exploit parameters vulnerable to PHP filter chain error based oracle.

Group Policy Objects manipulation and exploitation framework

SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting, initial access and lateral movement.

DCOM in memory and fileless lateral movement techniques through .Net deserilization

Octoscan is a static vulnerability scanner for GitHub action workflows.

Azure mindmap for penetration tests

PoC exploiting Aligned Chunk Confusion on Windows kernel Segment Heap

No description.

Local server for IDA Lumina feature

Finding Java/C# gadget chains with CodeQL

No description.

A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine.

Systemd Hardening Helper - Mirror of https://github.com/desbma/shh

Local & remote Windows DLL Proxying

Pwn2Own Vancouver 2023 Ubuntu LPE exploit

The OUned project automating Active Directory Organizational Units ACL exploitation through gPLink poisoning

A tool designed to exploit CVE-2025-54068 and Remote Command Execution if the APP_KEY of the Livewire project is known.

A tool designed to exploit bad implementations of decryption mechanisms in Laravel applications.

CaptainCredz is a modular and discreet password-spraying tool.

IPSpinner works as a local proxy that redirects requests through external services.

Machine-learn password mangling rules

No description.

No description.

Virtual machines manipulation framework

A SOCKS proxy for Citrix.

bbs is a router for SOCKS and HTTP proxies. It exposes a SOCKS5 (or HTTP CONNECT) service and forwards incoming requests to proxies or chains of proxies based on the request's target. Routing can be configured with a PAC script (if built with PAC support), or through a JSON file.

No description.

No description.

No description.

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409) exploit

Proof of concepts demonstrating some aspects of the Windows kernel shadow stack mitigation.

VMX intrinsics plugin for Hex-Rays decompiler

Python3 rewrite of AsOutsider features of AADInternals

Debugger for the Shannon Baseband

Webkit exploit that give arbitrary R/W on 6.XX PS4 firmwares

Dump Kerberos tickets from the KCM database of SSSD

Radmin Server 3 credentials dumper/cracker

Win32 keylogger that supports all (non-ime using) languages correctly

"Two-Face" Rust binary on Linux

IDA helper plugin to reverse engineer Objective-C code

Burp extension to filter JSON on the fly with JQ queries in the HTTP message viewer.

Exploitation code for CVE-2021-40539

io_uring based network scanner written in Rust

A purposely vulnerable application in order to demonstrate PHP payload smuggling techniques for PNG files.

Windows named pipe hooking toolkit

No description.

PoC for CVE-2021-3492 used at Pwn2Own 2021

No description.

CVE-2020-27950 exploit

A simple, reliable and reasonably fast network capture analyzer.

Lists of AMSI triggers (VBA, JScript / VBScript)

No description.

A python script to create a fake GitHub runner and hijack pipeline jobs to leak CI/CD secrets.

No description.

PoC materials to exploit CVE-2019-15846

No description.

Rust ADB client - Mirror of https://github.com/cocool97/adb_client

No description.

Some CTF Write-ups

No description.

A chromium extension exploitation toolkit

Apple artifacts database - Mirror of https://github.com/cocool97/appledb_rs

📦 :octocat: A GitHub Action that performs a security scan of your GitHub Actions.

A pcap capture analysis helper

Reverse engineering scripts designed for extracting Yealink VOIP upgrade files

A tool to decrypt all Synology encrypted archives (SPK, PAT, ...)

Entra ID Password Protection Banned Password Lists

Experimental Linux strace LLM agent

Public repository of Sigma and YARA rules created by Synacktiv

A simple Toolkit to BF and decrypt Windows EntraId CacheData

Tools used for decrypting Canon printers firmwares

No description.

A toy symbolic execution engine, supporting the blog article ...

Arlo file format helper

Exploit code for CVE-2023-42914 / pwn2own Vancouver 2023

No description.

KcMapper is a security auditing tool for Keycloak. It exports your Keycloak configuration (realms, clients, users, roles, etc.) into a Neo4j graph database. This representation enables complex relationship analysis and security auditing through a built-in interactive web UI with pre-defined queries.

A tool to generate and maintain wordlists for Web fuzzing.

A collection of Azure AD/Entra tools for offensive and defensive security purposes

Decrypt reversible secrets encrypted using the default hardcoded key related to CVE-2020-9289 on FortiAnalyzer/FortiManager (the only difference with CVE-2019-6693 is the encryption routine).

PoC materials to exploit CVE-2018-6789

ScriptCase Pre-Authenticated Remote Command Execution exploitation script (CVE-2025-47227, CVE-2025-47228).

KrustyLoader Analysis

Zed Offline Mirror

Automated Network Security with Rust: Detecting and Blocking Port Scanners

No description.

No description.

Ivanti Neurons for ITSM (On Premise) exploits

No description.

A new open-source tool to quickly audit SAP permissions.

Impacket is a collection of Python classes for working with network protocols.

A command-line utility for Windows written in C that creates and configures persistent Event Tracing for Windows (ETW) AutoLogger sessions.

No description.

Exploit used against the Netgear R6700v3 during Pwn2Own Austin 2021

This repository contains Velociraptor artifact and Chainsaw rules to help detect Microsoft Remote Access VPN activity

Exploitations scripts for CVE-2023-42791 and CVE-2024-23666.

WordPress crop-image exploitation

General toolkit related to SAP's SSO mechanism : the Logon Tickets

A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization.

Neverwinter Nights : Enhanced edition exploit

No description.

Sources of Synacktiv's challenge for leHack 2026

No description.

HexaLocker ransomware analysis

Common library for tools implementing GPO attack vectors

Snipe-IT PoC exploit for CVE-2025-59712 and CVE-2025-59713

In-depth ldap enumeration utility

Nounours is a tool designed to test APP_KEYs at scale on Laravel applications.

Proof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.

Official module repository for the Recon-ng Framework.

A Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB), used for example in Active Directory, Exchange and Windows Update.

This repository contains a IDA Python script to recover PrideLocker ESX encryptor strings and a YARA rule

PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

No description.

pwning IPv4 via IPv6

This program uses the statx system call to return file status (extended) in the body file format.

Kerberos unconstrained delegation abuse toolkit

Obfuscate Go builds

John the Ripper jumbo - advanced offline password cracker, which supports hundreds of hash and cipher types, and runs on many operating systems, CPUs, GPUs, and even some FPGAs

Solution for BFS Ekoparty challenge 2019