Example Usage
┌─────────────────────────────────────────────────────────────────┐ │ ATTACK FLOW DIAGRAM │ ├─────────────────────────────────────────────────────────────────┤ │ │ │ 1. npm install 2. preinstall hook 3. Download │ │ ───────────────► ─────────────────────► ──────────────────► │ │ setup_bun.js Bun runtime │ │ │ │ 4. Execute payload 5. Credential theft 6. Exfiltrate │ │ ───────────────────► ──────────────────► ─────────────────► │ │ bun_environment.js TruffleHog scan GitHub repos │ │ │ │ 7. Self-propagate 8. Create runner 9. Destroy │ │ ────────────────────► ─────────────────► ─────────────────► │ │ Infect 100+ pkgs "SHA1HULUD" Wipe on failure │ │ │ └─────────────────────────────────────────────────────────────────┘
See also
dnsx
Open Source
Fast and multi-purpose DNS toolkit from ProjectDiscovery. Resolves domains, performs wildcard filter…
ffuf
Open Source
Kali
Fast web fuzzer written in Go. Supports directory discovery, parameter fuzzing, virtual host discove…
deepce
Open Source
Docker Enumeration, Escalation of Privileges and Container Escapes (DEEPCE)…
AD-Attacks-by-Service
Open Source
Active Directory Penetration Testing for Red Teams…
cscan
Open Source
Enterprise-grade Distributed Asset & Vulnerability Scanner. Features: Port Scanning, Subdomain Brute…
eraser
Open Source
🧹 Cleaning up images from Kubernetes nodes…