The interactive web server.
HTTPLabs let you inspect HTTP requests and forge responses.



go get
go install


yaourt httplab

On systems where snap is supported:

snap install httplab

Binary distribution
Each release provides pre-built binaries for different architectures, you can download them here:


Usage of httplab:
-a, --auto-update Auto-updates response when fields change. (default true)
-b, --body string Specifies the inital response body. (default "Hello, World")
-c, --config string Specifies custom config path.
--cors Enable CORS.
--cors-display Display CORS requests. (default true)
-d, --delay int Specifies the initial response delay in ms.
-H, --headers strings Specifies the initial response headers. (default [X-Server:HTTPLab])
-p, --port int Specifies the port where HTTPLab will bind to. (default 10080)
-s, --status string Specifies the initial response status. (default "200")
-v, --version Prints current version.

Key Bindings

Key Description
Tab Next Input
Shift+Tab Previous Input
Ctrl+a Apply Response changes
Ctrl+r Resets Request history
Ctrl+s Save Response as
Ctrl+f Save Request as
Ctrl+l Toggle Responses list
Ctrl+t Toggle Response builder
Ctrl+o Open Body file
Ctrl+b Switch Body mode
Ctrl+h Toggle Help
Ctrl+w Toggle line wrapping
q Close popup
PgUp Previous Request
PgDown Next Request
Ctrl+c Quit

HTTPLab uses file to store pre-built responses, it will look for a file called .httplab on the current directory if not found it will fallback to $HOME. A sample file can be found here.
HTTPLab is heavily inspired by wuzz

Telebix is an application that communicates with a Bot on the Telegram to receive commands and send information from an infrastructure monitored by Zabbix, which also sends messages in real time if any problems occur in the infrastructure, it is totally written in Python with Shell Script and has a graphical interface to help the network administrator more intuitively. The application can run on any computer as long as all credentials are properly posted.

How to use

Creating a bot

In the search bar on Telegram, type "BotFather" and send the command "/newbot".

The BotFather will ask for a name for your bot, after it will ask for a username as well.

Copy the generated access Token.

Send any message to your bot by Telegram.


git clone
cd Telebix
chmod +x
sudo ./ --install


In the Settings tab are the fields to be populated with the Zabbix login information, bot token and Telegram user ID (or Group ID).

The token you already have after creating the Bot.

To get the user ID you can use the "GET ID" button in the settings tab after talking to the bot or add manually,
access the address below by changing TOKENHERE by the token you copied, there will be your user ID.

You can use the ID of any group that you are entered as well.

Commands Available

[+] /graphs hostname - List images graphs of specific host
[+] /webs - List monitored web scenarios
[+] /status - List status of zabbix
[+] /events - List last five events
[+] /help - Help and information
[+] /hosts - List hosts
[+] /users - List users

A Shellcode Encrypter & Decrypter, Using XOR Cipher to enc and dec shellcode.


git clone && python --help

Usage Example


python --shellcode x41x41x42x42 --key SECRETKEY --option encrypt


python --shellcode x41x41x42x42 --key SECRETKEY --option decrypt

Finding Shellcode For Any Architecture


usage: [-h]  [-s SHELLCODE]  [-k KEY]  [-o OPTION]

Encrypting & Decrypting Shellcode

optional arguments:
-h, --help show this help message and exit
Shellcode To Encrypt & Decrypt
-k KEY, --key KEY Key Of The Shellcode To Encrypt & Decrypt
-o OPTION, --option OPTION
Argument For Encrypting & Decrypting Shellcode

A project written in Python to twitter tracking and analysis without using Twitter API.


  • This project is a Python 3.x application.
  • The package dependencies are in the file requirements.txt. Run that command to install the dependencies.
pip3 install -r requirements.txt


  • SQLite is used as the database.
  • Tweet data are stored on the Tweet, User, Location, Hashtag, HashtagTweet tables.
  • The database is created automically.

Usage Example
Get help

 python3 -h 

Get tweets by username

 python3 --username "HaberSau" 

Get tweets by query

 python3 --query "sakarya" 

Get tweet at a specific date range

 python3 --username "HaberSau" --since 2015-09-10 --until 2015-09-12 --maxtweets 10 

If you get location of tweets, add –location “True” param but application will be slower due to new response times.

 python3 --query "sakarya" --location "True"

Analysis performs analysis processing. User, hashtag and location analyzes are performed.

Get help:

python3 -h

for location analysis

python3 analysis py --location

location analysis runs through address http://localhost:5000/locations
You must write Google Map Api Key in to display google map.


Runs hashtag analysis.

python3 --hashtag

Runs user analysis.

python3 --user

Graphical User Interface used for gui application

TLS-Scanner is a tool created by the Chair for Network and Data Security from the Ruhr-University Bochum to assist pentesters and security researchers in the evaluation of TLS Server configurations.
Please note: TLS-Scanner is a research tool intended for TLS developers, pentesters, administrators and researchers. There is no GUI. It is in the first version and may contain some bugs.

In order to compile and use TLS-Scanner, you need to have Java and Maven installed, as well as TLS-Attacker in Version 2.5

$ cd TLS-Scanner
$ mvn clean package

Alternatively, if you are in hurry, you can skip the tests by using:

$ mvn clean package -DskipTests=true

If you want to use TLS-Scanner as a library you need to install it with the following command:

$ mvn clean install

For hints on installing the required libraries checkout the corresponding GitHub repositories.
Please note: In order to run this tool you need TLS-Attacker version 2.5

In order to run TLS-Scanner you need to run the jar file in the apps/ folder.

$ java -jar apps/TLS-Scanner.jar -connect localhost:4433

You can specify a host you want to scan with the -connect parameter. If you want to improve the performance of the scan you can use the -threads parameter (default=1).

Bashark aids pentesters and security researchers during the post-exploitation phase of security audits.

To launch Bashark on compromised host, simply source the script from terminal: $ source Then type help to see Bashark's help menu


  • Single Bash script
  • Lightweight and fast
  • Multi-platform: Unix, OSX, Solaris etc.
  • No external dependencies
  • Immune to heuristic and behavioural analysis
  • Built-in aliases of often used shell commands
  • Extends system shell with post-exploitation oriented functionalities
  • Stealthy, with custom cleanup routine activated on exit
  • Easily extensible (add new commands by creating Bash functions)
  • Full tab completion


WinSpy: Windows Reverse Shell Backdoor Creator With ip poisener.


  • 1 – metasploit-framework
  • 2 – xterm
  • 3 – apache2
  • 4 – whiptail


sudo apt-get install git
git clone
cd winspy
chmod +x
chmod +x

Tested on :

  • BackBox Linux
  • Kali linux
  • Parrot os




PatrOwl is a scalable, free and open-source solution for orchestrating Security Operations.
PatrowlManager is the Front-end application for managing the assets, reviewing risks on real-time, orchestrating the operations (scans, searches, API calls, …), aggregating the results, relaying alerts on third parties (ex: Incident Response platform like TheHive, Splunk, …) and providing the reports and dashboards. Operations are performed by the PatrowlEngines instances. Don't forget to install and deploy them 😉

Project pitch desk


Fully-Developed in Python, PatrOwl is composed of a Front-end application PatrowlManager (Django) communicating with one or multiple PatrowlEngines micro-applications (Flask) which perform the scans, analyze the results and format them in a normalized way. It remains incredibly easy to customize all components. Asynchronous tasks and engine scalability are supported by RabbitMQ and Celery. 

The PatrowlManager application is reachable using the embedded WEB interface or using the JSON-API. PatrowlEngines are only available through generic JSON-API calls (see Documentation).

Discover sub-domains by searching through Certificate Transparency logs.
What is CT?
Certificate Transparency (CT) is an experimental IETF standard. The goal of it was to allow the public to audit which certificates were created by Certificate Authorities (CA). TLS has a weakness that comes from the large list of CAs that your browser implicitly trusts. If any of those CAs were to maliciously create a new certificate for a domain, your browser would trust it. CT adds benefits to TLS certificate trust: Companies can monitor who is creating certificates for the domains they own. It also allows browsers to verify that the certificate for a given domain is in the public log record.
These logs end up being a gold mine of information for penetration testers and red teams.

What can you find with ct-exposer?
ct-exposer will query the CT logs for a given domain, and then try to do DNS lookups for the domains to see which ones exist in DNS. In my experience, so far, I've found numerous sub-domains that were not located with ‘' google searches. Keep in mind that the domains that do not resolve, they can either be old domains, or internal only domains (Ex: you need access to the internal DNS server to resolve them).

Python3, gevent, requests, and urllib3.

pip3 install -r requirements.txt


usage: [-h] -d DOMAIN [-u] [-m]

optional arguments:
-h, --help show this help message and exit
-d DOMAIN, --domain DOMAIN
domain to query for CT logs, ex:
-u, --urls ouput results with https:// urls for domains that
resolve, one per line.
-m, --masscan output resolved IP address, one per line. Useful for
masscan IP list import "-iL" format.

Example output

python3 -d
[+]: Downloading domain list...
[+]: Download of domain list complete.
[+]: Parsed 76 domain(s) from list.

[+]: Domains found:

[+]: Domains with no DNS record:

bettercap is the Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and attacks.

How to Install
A precompiled version is available for each release, alternatively you can use the latest version of the source code from this repository in order to build your own binary.
Make sure you have a correctly configured Go >= 1.8 environment, that $GOPATH/bin is in $PATH, that the libpcap-dev and libnetfilter-queue-dev (this one is only required on Linux) package installed for your system and then:

$ go get
$ cd $GOPATH/src/
$ make build && sudo make install

This command will download bettercap, install its dependencies, compile it and move the bettercap executable to /usr/local/bin.
Now you can use sudo bettercap -h to show the basic command line options and just sudo bettercap to start an interactive session on your default network interface, otherwise you can load a caplet.
Once bettercap is installed, you can download/update system caplet with the command:

sudo bettercap -eval "caplets.update; q"

In order to update to an unstable but bleeding edge release from this repository, run the commands below:

$ go get -u
$ cd $GOPATH/src/
$ make build && sudo make install

Documentation and Examples
The project is documented in this wiki.