Alex dhondta

WordPress Debug Log File Parser

This is a small tool using Tinyscript for parsing and searching into a debug log from WordPress and displaying errors and URLs seen.

$ pip install tinyscript
$ tsm install wp-log-parser

OUI/MAC Organization Finder

This is a small tool using Tinyscript for finding the organization associated with a given OUI or MAC address.

$ pip install tinyscript
$ tsm install oui

Git Web Recovery

This is a small tool using Tinyscript and PyBots for downloading a .git folder left on a Web server. Note that this tool does NOT rely on Directory Indexing.

$ pip install pybots tinyscript
$ tsm install git-web-recovery

Pentester Academy Download Tools

This is a set of tools using Tinyscript in order to download resources from pentesteracademy.com and compress videos.

pta-downloader: allows to download resources given some course identifiers while compressing downloaded videos if needed.
video-compressor: allows to compress videos a posteriori.

$ pip install tinyscript
$ tsm install pta-downloader

PDF password bruteforcer

This is a small tool using Tinyscript and pypdf or pikepdf to bruteforce the password of a PDF given an alphabet (defaults to printables) and a length (default is 8).

$ pip install pypdf tinyscript
$ tsm pdf-password-bruteforcer

Evil Pickle creation tool

This is a Tinyscript wrapper for this Gist, working with Python 2 and 3.

$ pip install tinyscript
$ tsm install evil-pickle-maker

Craft CMS SEOmatic 3.1.4 SSTI Exploit (CVE-2018-14716)

This is an automation of this exploit using Tinyscript and Pybots for getting config settings or user properties.

$ pip install tinyscript
$ tsm install craftcms-seomatic-ssti

Firefox-Decrypt modified for dictionary attack on master password

This script is the modification of this excellent project, a tool to extract passwords from Mozilla (Firefox™, Waterfox™, Thunderbird®, SeaMonkey®) profiles, to make it support dictionary attack. This is published as a Gist as the related PR was refused (for a reason I completely understand) and with the consent of the author.

$ pip install tinyscript
$ tsm install firefox_decrypt_modified

For the main options, please refer to the original project. You can provide a wordlist of master passwords for a dictionary attack as follows:

ClipperCMS 1.3.0 Code Execution Exploit

This is a variation of this exploit using Tinyscript and Pybots for uploading a shell.

$ pip install tinyscript
$ tsm install clippercms-shell-uploader

	#!/bin/bash

	# Note: you might prefer latexmk -c since latexmk is great. It doesn't clean all of these, but see
	# https://tex.stackexchange.com/questions/83341/clean-bbl-files-with-latexmk-c/83386#83386

	exts="-blx.aux -blx.bib -blx.bib .acn .acr .alg .algorithms .aux .bbl .bcf .blg .brf .dvi .fdb_latexmk .fls .glg"\
	" .glo .gls .glsdefs .idx .ilg .ind .ist .keys .listing .loa .lof .log .lol .lot .maf .mtc .mtc0 .mw .nav .nlo"\
	" .out .pdfsync .ptc .pyg .run.xml .snm .synctex.gz .syntex.gz(busy) .tdo .thm .toc .vrb .xdy"

	for x in "${@:-.}"; do