Description: htcap is a web application scanner able to crawl single page application (SPA) in a recursive manner by intercepting ajax calls and DOM changes.

Htcap is a web application scanner able to crawl single page application (SPA) in a recursive manner by intercepting ajax calls and DOM changes. Htcap is not just another vulnerability scanner since it’s focused on the crawling process and it’s aimed to detect and intercept ajax/fetch calls, websockets, jsonp ecc. It uses its own fuzzers plus a set of external tools to discover vulnerabilities and it’s designed to be a tool for both manual and automated penetration test of modern web applications.


Exploit Development


Exploit Development

  • Shellcode Tutorial – Shellcoding for Linux and Windows Tutorial
  • Shellcode Examples – Shellcodes database for study cases
  • Corelan Team – Exploit writing tutorial part 1: Stack based Overflows
  • Corelan Team – Exploit writing tutorial part 2 : Stack Based Overflows – jumping to shellcode
  • Corelan Team – Exploit writing tutorial part 3 : SEH Based Exploits
  • Corelan Team – Exploit writing tutorial part 4 : From Exploit to Metasploit – The basics
  • Corelan Team – Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development
  • Corelan Team – Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR

Oneliner – Nmap – List alive hosts in specific subnet


Nmap – List alive hosts in specific subnet

nmap -sP

sample output:

Nmap scan report for (

Host is up (0.0012s latency).

Nmap scan report for (

Host is up (0.0017s latency).

Nmap scan report for (

Host is up (0.0055s latency).

Nmap scan report for (

Host is up (0.0014s latency).

Nmap done: 256 IP addresses (4 hosts up) scanned in 0.01 seconds


READ ALSO  Sitadel - Web Application Security Scanner

How to disabled windows firewall with command line


How to disabled or enable windows firewall with command line

windows firewall is enable by default on windows.

To Turn Off

netsh advfirewall set allprofile state off

To Turn On

netsh advfirewall set allprofile state on

To check status of Firewall:

netsh advfirewall show allprofiles


How to receive a SMS anonymously


How to receive an SMS anonymously

Sometimes you need to register for a service and they ask for your phone number, but you want to protect your privacy
Some websites are available to provide you with a temporary telephone number to receive SMS.

Description: is FREE service for receive SMS messages online, based on REAL SIM and shows you the exact information received by the modem with Dynamic Sender ID


tested: OK

how to receive sms without phone number

Description: receive sms online


Description: Receive SMS Online For FREE. Get Free SMS here to Verify your Services and APP. Receive Free SMS text Online Worldwide


no tested.



READ ALSO  Online tools - GRABIFY (IP logger)







WhatWeb (web scanner )



WhatWeb is a web scanner



WhatWeb identifies websites. Its goal is to answer the question, “What is that Website?”. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 1700 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.

WhatWeb can be stealthy and fast, or thorough but slow. WhatWeb supports an aggression level to control the trade off between speed and reliability. When you visit a website in your browser, the transaction includes many hints of what web technologies are powering that website. Sometimes a single webpage visit contains enough information to identify a website but when it does not, WhatWeb can interrogate the website further. The default level of aggression, called ‘stealthy’, is the fastest and requires only one HTTP request of a website. This is suitable for scanning public websites. More aggressive modes were developed for use in penetration tests.

Most WhatWeb plugins are thorough and recognise a range of cues from subtle to obvious. For example, most WordPress websites can be identified by the meta HTML tag, e.g. ”, but a minority of WordPress websites remove this identifying tag but this does not thwart WhatWeb. The WordPress WhatWeb plugin has over 15 tests, which include checking the favicon, default installation files, login pages, and checking for “/wp-content/” within relative links.

download : v0.4.9

This product is subject to the terms detailed in the license agreement. For more information about WhatWeb visit:


novahot – A webshell framework for penetration testers.


novahot – A webshell framework for penetration testers.




novahot is a webshell framework for penetration testers. It implements a JSON-based API that can communicate with trojans written in any language. By default, it ships with trojans written in PHP, ruby, and python.



The author does not hold any responsibility for the bad use of this tool, remember that attacking targets without prior consent it’s illegal and punished by law.

Online tools – GRABIFY (IP logger)


GRABIFY Create or Track URLs

website url:


Grabify IP Logger helps you track who has clicked your links. Track IP addresses, find IPs from Facebook, Twitter, friends on other sites.




How to use it:

  1. Enter a URL that you want Grabify to track.
  2. Give the link Grabify generated to the client.
  3. Save your tracking code that was generated when Grabify generated the link.
  4. Enter the tracking code on the home page and click “Tracking Code” to see all the information captured with Grabify.

WiFi HID Injector


WiFi HID Injector – An USB Rubberducky / BadUSB On Steroids.

Description: Remote WiFi HID Keyboard Injector

It stands for WiFi HID Injector. It is a WiFi remotely-controlled {Keyboard, Mouse} Emulator. Practically is an USB Rubberducky or BadUSB device on Steroids!


Youtube tutorial:

QRadar Community Edition


QRadar Community Edition

QRadar Community Edition is a free version of QRadar that is based off of our core enterprise SIEM. Users, students, security professionals, and app developers are encouraged to download QRadar Community Edition to learn and become familiar with QRadar. This version is limited to 50 events per second and 5,000 network flows a minute, supports apps, but is based on a smaller footprint for non-enterprise use. Download, contribute, create, and engage with an ensemble of users leveraging security at home or in labs with QRadar Community Edition 7.3.1.

download: qradar ce