recaptcha

Description This repository contains a technical analysis of Google's antibot reCAPTCHA focusing on: Payload Structure and Values Fingerprinting Techniques Obfuscation Techniques Anti-debugging/Tampering Techniques Virtual Machines Contact Discord: @grecaptcha Telegram: @lyxlobyx Obfuscation...

CVE-2020-0688

CVE-2020-0688 A remote code execution vulnerability exists in Microsoft Exchange Server when the server fails to properly create unique keys at install time. Knowledge of a the validation key allows an authenticated user with a mailbox to pass arbitrary objects to be deserialized by the web...

CVE-2018-1207-better

Exploit PoC for CVE-2018-1207: Dell iDRAC7/iDRAC8 RCE Reverse Shell This repository contains a Proof of Concept python script to demonstrate a remote code execution exploit present in iDRAC7 and iDRAC8 devices with firmware versions 2.52.52.52 and below. This exploit allows attacks to run code as...

CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

fscan

Fscan 中文 Comprehensive intranet scanning tool for automated vulnerability assessment. Version : 2.2.0 Features Scanning Host Discovery - ICMP/Ping alive detection, B/C segment statistics for large networks Port Scanning - TCP connect scan, 133 built-in ports, port groups web/db/service/all...

CVE-2022-36804-Bitbucket-RCE-Analysis

CVE-2022-36804: Bitbucket Remote Command Execution RCE Technical Analysis & Laboratory Exploitation of Null-Byte Argument Injection Vulnerability Summary CVE-2022-36804 is a high/critical Argument Injection vulnerability within the REST API of Atlassian Bitbucket Server and Data Center. While the...

CVE-2025-54123-Poc

CVE-2025-54123 Exploit Hoverfly Authenticated Middleware Command Injection RCE | CVSS 9.8 CRITICAL Vulnerability Hoverfly -u -p -c --shell SHELL -t, --target - Hoverfly API endpoint required -u, --username - Admin username required -p, --password - Admin password required -c, --command -...

BloodHound.py

BloodHound.py BloodHound.py is a Python based ingestor for BloodHound, based on Impacket. The code in this branch is only compatible with BloodHound 4.2 and 4.3. For BloodHound CE, check out the bloodhound-ce branch Installation There are different install methods for BloodHound Community Edition...

WebKit-CVE-2016-4622

WebKit CVE-2016-4622 Analysis: Deep Dive into the Slice ValueOf Fastpath Vulnerability Comprehensive analysis and exploitation of the WebKit JavaScript Core vulnerability that enables memory disclosure through Array.slice manipulation Table of Contents Executive Summary Vulnerability Overview...

sisu

sisu ⚡ Your AWS, as a filesystem. This: grep -l "AdministratorAccess" iam/users//policies.json Instead of this: aws iam list-users --query 'Users.UserName' --output text | \ xargs -I sh -c 'aws iam list-attached-user-policies --user-name --query "AttachedPolicies.PolicyArn" --output text' | \ gre...

bxss

Bxss - Blind XSS Scanner 🚀 Description Bxss is a high-performance Blind XSS scanner that automates the detection of blind XSS vulnerabilities in web applications. ✨ Features Injects Blind XSS payloads into custom headers & parameters Supports multiple HTTP methods PUT, POST, GET, OPTIONS High-spe...

SYNwall

SYNwall Zero config IoT firewall. SYNwall is a project built for the time being as a Linux Kernel Module, to implement a transparent and no-config/no-maintenance firewall. You may want to have a look to the for an example of usage. Basics Usually IoT devices are out of a central control, with low...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

erebus

Escáner de vulnerabilidades basado en parámetros, rápido y personalizable, basado en reglas YAML simples Cómo • Instalar • Plantillas • Interceptor • Uso • Únete a Discord Erebus se utiliza para probar cada parámetro en los objetivos basándose en plantillas YAML, lo que genera cero falsos positiv...

RmiTaste

RmiTaste RmiTaste permite a los profesionales de seguridad detectar, enumerar, interactuar y atacar servicios RMI mediante la llamada a métodos remotos con gadgets de ysoserial. También permite llamar a métodos remotos con parámetros específicos. Aviso de responsabilidad RmiTaste fue creado para...

CVE-2024-9796

CVE-2024-9796 WordPress WP-Advanced-Search = 5.0.12 time-based blind IF - comment Payload: t=wpautosuggest&f=ifnow=sysdate,SLEEP9,0-- wXyW&l=5&type=0&e=utf-8&q=c&limit=5&timestamp=13672261755853'...

CVE-2024-54761

BigAnt Office Messenger 5.6.06 RCE via SQL Injection SQL injection vulnerability in BigAnt Messenger causes RCE vulnerability. Follow the steps to exploit. Usage: CVE-2024-54761.py -h -r RHOST -p RPORT -u USERNAME -P PASSWORD options: -h, --help show this help message and exit -r, --rhost RHOST...

CVE-2021-44228_scanner-main-Modified-

CVE-2021-44228scanner modified - Deprecated Original Script and Repo: https://github.com/CERTCC/CVE-2021-44228scanner Modified by: Alex Pena Applications that are vulnerable to the log4j CVE-2021-44228 issue may be detectable by scanning jar, war, and ear files to search for the presence of...

CVE-2025-65950

CVE-2025-65950: WBCE CMS is Vulnerable to Time-Based Blind SQL Injection through groups Parameter Overview Field| Details ---|--- CVE ID| CVE-2025-65950 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products WBCE/WBCECMS Details Summary A critical SQL Injection...

CLR-Unhook

CLR Unhooking Tool Note: For this to have the effect of a clean CLR, you’d need to manually map the DLL from disk into memory. You cannot use LoadLibraryA/W, because antivirus solutions will detect the DLL load event and may hook it immediately. If you want this behavior, you can look up existing...