299436 matches found
cypherhound
CypherHound A Python3 terminal application that contains Neo4j cyphers for BloodHound data sets with a script to automate importing them into BloodHound CE. Output Samples Terminal HTML Report HTML Report continued Why? BloodHound is a staple tool for every penetration tester. However, there are...
multi-juicer
Running CTFs and Security Trainings with OWASP Juice Shop is usually quite tricky, Juice Shop just isn't intended to be used by multiple users at a time. Instructing everybody how to start Juice Shop on their own machine works ok, but takes away too much valuable time. MultiJuicer gives you the...
CVE-2022-26138
CVE-2022-26138 POC Description The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users group with the username disabledsystemuser and a hardcoded password. A remote, unauthenticated attacker with knowledge of the...
EDR-Freeze
EDR-Freeze This is a tool that exploits the software vulnerability of WerFaultSecure to suspend the processes of EDRs and antimalware without needing to use the BYOVD Bring Your Own Vulnerable Driver attack method. EDR-Freeze operates in user mode, so you don't need to install any additional...
CVE-2023-32315-Openfire-Bypass
CVE-2023-32315 0x01 Obtain the returned JSESSIONID and csrftoken, construct a request packet to add a user replace JSESSIONID, csrftoken cd CVE-2023-32315-Openfire-Bypass/scanall go mod tidy go run main.go -u http://openfire.com:9090 0x02 Plugin compilation and installation mvn clean package or...
wssip
This repository does not have a README...
CVE-2026-98821
In the Linux kernel, the following vulnerability has been resolved: b...
EUVD-2026-103906
In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...
dnsx
A fast and multi-purpose DNS toolkit designed for running DNS queries Features β’ Installation β’ Usage β’ Running dnsx β’ Wildcard β’ Notes β’ Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...
ipv6_frag_escape
IPV6FRAGESCAPE A reliable unprivileged container / jail escape proof of concept for CentOS / RHEL 10. It rides a now fixed IPv6 fragmentation bug in ip6appenddata closed upstream by 38becddc, no CVE, an in-slab linear overflow into the skbsharedinfo at the tail of a packet's own head object. This...
GhostKatz
GhostKatz Extract LSASS credentials directly from physical memory by abusing signed vulnerable drivers with physical memory read primitives via MmMapIoSpace, bypassing traditional user-mode detection capabilities. This tool was developed in collaboration between Julian PeΓ±a and Eric Esquivel. Thi...
CVE-2022-36946
CVE-2022-36946 Reported-by: Domingo Dirutigliano and Nicola Guerrera While we were working on firegex, our application firewall for CTF Attack-Defence competitions, we stumbled upon a few kernel panics. This strange behavour was than isolated and anlayzed, leading to the discovery of this potenti...
skyhook
Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...
Egyscan
EgyScan V3.4 "Ultra" : Your Digital Fort of Invincibility π° Greetings, Guardians of the Digital Realm! π‘οΈ Prepare to embark on an extraordinary journey with EgyScan V3.0 , the ultimate sentinel that transforms your websites into impregnable fortresses against relentless cyber threats. Let's explor...
Starlink-FI
Starlink User Terminal Modchip This repository accompanies the talk titled "Glitched on Earth by Humans: A Black-Box Security Evaluation of the SpaceX Starlink User Terminal". A slide deck is available here, a recording of the talk should be available soon. The talk covers how we managed to execu...
Estudo-de-Caso-CVE-2024-21413
CVE-2024-21413 β Moniker Link ππ Microsoft Outlook RCE + NTLM Credential Leak β οΈ Legal Notice: This repository is exclusively for educational and security research purposes. All demonstrations were carried out in controlled and isolated environments. The use of these techniques against systems...
certsync
certsync certsync is a new technique in order to dump NTDS remotely, but this time without DRSUAPI : it uses golden certificate and UnPAC the hash. It works in several steps: 1. Dump user list, CA informations and CRL from LDAP 2. Dump CA certificate and private key 3. Forge offline a certificate...
CVE-2024-50633
CVE-2024-50633 π - CVE-2024-50633 : Indico BOLA Vulnerability Discovered and reported a BOLA vulnerability in Indico. π Description CVE-2024-50633 A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive user information by manipulating API...
petereport
PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...
usbpcap
USBPcap - USB Packet capture for Windows End-user installer is available at: http://desowin.org/usbpcap Following informations are intended for developers and power users only. Directory overview: USBPcapCMD - sample user space application USBPcapDriver - filter driver used to capture data Build...