wholeaked

Introduction , ,' ', Utku Sen's |,-' wholeaked /c '\ ' |' -. "When you have eliminated the impossible, /-' \ whatever remains, however improbable, /'-'\ must be the truth" - Sherlock Holmes ' \ wholeaked is a file-sharing tool that allows you to find the responsible person in case of a leakage...

CredSniper

CredSniper Overview Benefits Basic Usage Installation Screenshots Gmail Module Maintainer Contributing Overview Easily launch a new phishing site fully presented with SSL and capture credentials along with 2FA tokens using CredSniper. The API provides secure access to the currently captured...

http2smugl

http2smugl This tool helps to detect and exploit HTTP request smuggling in cases it can be achieved via HTTP/2 - HTTP/1.1 conversion by the frontend server. The scheme is as follows: 1. An attacker sends a crafted HTTP/2 request to the target server, which we call frontend. 2. The request is...

v0ltpwn

V0LTpwn V0LTpwn CVE-2019-11157 is a software-controlled fault attack on x86 processors. It is the first attack corrupting the integrity of SGX enclaves. Description All recent Intel processors exhibit a software interface for controlling core voltages without rebooting the system. This feature is...

RAT-via-Telegram

RAT-via-Telegram Dviros's notes: Windows Remote Post Breach Tool via Telegram Python 2.7, Originally created by Ritiek, Forked and modified by mvrozanti and then myself. The whole purpose of this tool is to demonstrate as a "PoC" the control of an already breached machine, via Telegram. As the sa...

harden-docker-seccomp

harden-docker-seccomp Idempotent script to block AFALG socket creation for all Docker containers on a host as mitigation for CVE-2026-31431 "Copy Fail". Background CVE-2026-31431 is a local privilege escalation in the Linux kernel's authencesn cryptographic template, present in kernels built...

Volumiser

Volumiser Introduction Volumiser is a command line tool and interactive console GUI for listing, browsing and extracting files from common virtual machine hard disk image formats. The tool was written to combat a regular problem where massive 100G+ disk images are often hard to work with or...

CGA-H5H4-WH9J-F8MR

Bulletin has no description...

targetedKerberoast

targetedKerberoast targetedKerberoast is a Python script that can, like many others e.g. GetUserSPNs.py, print "kerberoast" hashes for user accounts that have a SPN set. This tool brings the following additional feature: for each user without SPNs, it tries to set one abuse of a write permission ...

EDRSilencer

EDRSilencer Inspired by the closed source FireBlock tool FireBlock from MdSec NightHawk, I decided to create my own version and this tool was created with the aim of blocking the outbound traffic of running EDR processes using Windows Filtering Platform WFP APIs. This tool offers the following...

CVE-2026-41940

CVE-2026-41940 — WHM/cPanel Authentication Bypass Research Tool This repository contains a Proof-of-Concept PoC script based on the authentication bypass chain for cPanel/WHM via the whostmgrsession cookie and HTTP headers. After a successful compromise, the script changes the root password and...

pixel-ksu-root

pixel-ksu-root Root a stock, locked-bootloader Google Pixel from an unprivileged adb shell, using a kernel CVE — no unlock, no flash, no vendor help. A userspace-reachable kernel bug yields a short-lived read/write primitive. That primitive is spent late-loading a KernelSU module into the running...

LEAKEY

LEAKEY 🔑 LEAKEY is a tool is for validation of leaked API tokens/keys found during pentesting and Red Team Enegagments. The script is really useful for Bug Hunters inorder to validate and determine the impact of leaked credentials. LEAKEY uses a json based signature file located at...

ShodanX

ShodanX⚡ – A terminal-powered recon and OSINT tool built on top of the Shodan Services. Features | Installation | Usage | Post Installation Setup Features🔧: 🔐 shodanx auth – Configure and store your Shodan API key securely. 🔓 shodanx login – Validate your access level and API key status. 🏢 shodan...

vulpy

Vulpy - Web Application Security Lab Vulpy is a web application developed in Python / Flask / SQLite that has two faces. GOOD : Tries to code with secure development best practices in mind. BAD : Tries to code like possibly you. :p Is developed has a laboratory for the following courses: Secure...

Solitude

Solitude Solitude is a privacy analysis tool that enables anyone to conduct their own privacy investigations. Whether a curious novice or a more advanced researcher, Solitude makes the process of evaluating user privacy within an app accessible for everyone. Important Note Prior to installing...

n8n-databricks-path-join

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · n8n-databricks-path-join n8n-databricks-path-join n8n 2.42.0 - n8n GmbH GHSA-89p4-6h98-c7xm and GHSA-rqch-9jrh-cr8w introduced toPathSegment: encodeURIComponent plus reject '' / . / ... getSpace.operation.ts...

Graffiti

NOTE : Never upload payloads to online checkers Graffiti is a tool to generate obfuscated oneliners to aid in penetration testing situations. Graffiti accepts the following languages for encoding: Python Perl Batch Powershell PHP Bash Graffiti will also accept a language that is not currently on...

nextcloud-ldap-put-isadmin

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-ldap-put-isadmin nextcloud-ldap-put-isadmin Nextcloud Server 35.0.0 - Nextcloud GmbH PUT /cloud/users/id lets a delegated Users admin edit a target unless that target is in the local group admin. PATCH on th...

nextcloud-federated-ocm-token

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · nextcloud-federated-ocm-token nextcloud-federated-ocm-token Nextcloud Server 35.0.0 - Nextcloud GmbH A federated share secret is minted as an unscoped PERMANENTTOKEN app password for the sharer. The recipient API...