Winrar-CVE-2023-40477-POC

CVE-2023-4047 PoC By Wild Pointer Read Research: https://wildptr.io/winrar-cve-2023-40477-poc-new-vulnerability-winrar-security-research/ Recvol3.cpp Vulnerability: https://www.rarlab.com/vulnrev3names.html, https://www.win-rar.com/ Vulnerable: WinRAR = 6.22 How to Test? You can generate your own...

socgholish_finder

SocGholish Finder Simple script to scan website for SocGholish inject. It checks for and display inject if found, and it deonfuscates and display a shadowing URL domains usage: finder.py -h -url URL -ua USERAGENT -f FILENAME -p PROXY -s SocGholish finder options: -h, --help show this help message...

CVE-2022-22965_PoC

Spring Framework RCE exploitation Quick pentest notes Step 1: Find some endpoint in your target where is accepted POST/PUT methods + encode your payload URL encode POST /path/upload HTTP/1.1 Host: Origin: Cookie: JSESSIONID=BE65B534335A5A2538624404C063B70C; Content-Type:...

CVE-2023-44487

HTTP2 Rapid Reset Attack: CVE-2023-44487 Quick exploit to test out rapid reset attack CVE-2023-44487. Note: For education purpose only Exploit: Quick exploit to test out rapid reset attack CVE-2023-44487. Note: For education purpose only Table of Contents Installation Usage Installation Clone the...

koyane-framework

Koyane-Framework :: wordlist forge & analysis toolkit Early Stage | | / /| |\ \ / / / \ | \ | || | | || \ / \ | / || || | | || || | | / / | |/ / | | | | \ V / / /\ | | || | | | | |/ // /\ | . . || | | | | || | | || |/ /| |/ / | \ | | | | \ / | || . || | ||| | | / | || |/| || | | |/| || | |...

apxutil

A tool to manipulate Schneider Electric PLC archive files This tool can extract and reassemble PLC "archive" files, used by several Schneider Electric PLC:s, including at least M580, M340 and Quantum. The archive files with an extension of .sta are really a zip archive containing a few files...

synaptic-sentinel

SYNAPTIC Sentinel The vibe-coding security sentinel. An Apache-2.0 agentic security toolkit for projects where most of the code is written by AI. Five deterministic scouts catch the syntactic problems; a Brain Layer BYOK Anthropic decides what really matters and how to fix it — all inside the IDE...

BlueBunny

C2 solution that communicates directly over Bluetooth-Low-Energy with your Bash Bunny Mark II. Send your Bash Bunny all the instructions it needs just over the air. Table of contents Overview Installation & Start Manual communication with the Bash Bunny through Python Troubleshooting Working on...

LHF

Codacy Badge This has been only tested on the newest Kali Linux Distro LHF: Low Hanging Fruit a recon tool for penetration testing To install dependencies: ./Install.sh To start: ./LHF.py + Checking permissions - Rockyou wordlist is missing trying to decompress... + Rockyou wordlist is...

Demo-Exploit-Jackson-RCE

Demo-Exploit-Jackson-RCE Based on the project jackson-rce-via-spel this project serves as an example web application to test multiple attack vectors file upload, forms on the Jackson-databind vulnerability. Introduction Based on an Angular7 frontend and a spring-boot backend different attack...

linux-kernel-algif-aead-checker

CVE-2026-31431 / Copy Fail Checker 🔒 Linux kernel vulnerability checker for the algifaead-based Copy Fail attack path. Detects if your system is vulnerable and provides mitigation steps. Features Kernel version vulnerability range detection AFALG crypto module check Protection status KPTI, SELinu...

ore-mal-pkg-inspector

OreWatch Multi-Ecosystem Malicious Package Detection and Supply Chain Security Scanner A production-grade security tool for detecting malicious packages and supply chain threats across npm, PyPI, Maven, RubyGems, Go, and Cargo ecosystems. Leverages automated threat intelligence collection from...

solr_rce

Apache Solr RCE via Velocity template python usage: python solrrce.py http://x.x.x.x:8983 command getshell encode payload http://www.jackson-t.ca/runtime-exec-payloads.html whoami bash -c echo,d2hvYW1p|base64,-d|bash,-i 0x01 Introduction to Solr Solr is an open-source enterprise search platform...

arsenal

Arsenal Arsenal is just a quick inventory, reminder and launcher for pentest commands. This project written by pentesters for pentesters simplify the use of all the hard-to-remember commands In arsenal you can search for a command, select one and it's prefilled directly in your terminal. This...

CVE-2026-14894

CVE-2026-14894 — Super Forms Unauthenticated File Upload RCE Nonce Leak → datauristring Upload → Code Execution Overview CVE-2026-14894 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Super Forms – Drag & Drop Form Builder WordPress plugin by WebRehab...

CVE-2020-0022

CVE-2020-0022 Many thanks to Insinuator for their amazing blog post and code! Results All the steps mentioned in the insinuator post have been completed, and more. These are a lot of steps to put in a README.md file, so feel free to check out the post from Insinuator mentioned above. The exploit ...

CVE-2021-21389

CVE-2021-21389 BuddyPress 7.2.1 - REST API Privilege Escalation to RCE PoC Full Affected version: 5.0.0 to 7.2.0 User requirement: Subscriber user Method: Privilege Escalation to Administrator and trigger RCE via REST API Endpoint: /v1/members/me endpoint. How to use Docker git clone...

Killer

KILLER TOOL EDR Evasion It's a AV/EDR Evasion tool created to bypass security tools for learning, until now the tool is FUD. Features: Module Stomping for Memory scanning evasion DLL Unhooking by fresh ntdll copy IAT Hiding and Obfuscation & API Unhooking ETW Patchnig for bypassing some security...

SearchPhone

SearchPhone 🕵🏽‍♂️ Is a comprehensive OSINT tool for looking up linked phone number information, using multiple APIs to gather information from various sources. Developed for use with Python from the terminal. 👁 ✨ Features 📱 Phone Number Validation - Validates and formats phone numbers using...

NetSpecter

NetSpecter NetSpecter is a lightweight yet powerful asynchronous OSINT and reconnaissance engine built in Python. It combines multi-source intelligence gathering DNS, WHOIS, Web, TLS, HTTP, Geo, Reverse DNS with Shodan-powered security intelligence and full raw data access, providing a complete...