WantasticCore

Wantastic A self-hosted WireGuard mesh with a browser admin portal, all in one container. Try the demo → · Join Discord → Why Wantastic The overlay-VPN space is crowded — Tailscale, Headscale, NetBird, wg-easy. They all stop at "your devices can reach each other." Wantastic keeps going. 1. You...

noPac

About Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user Changed from sam-the-admin. Usage root@kitploit: SAM THE ADMIN CVE-2021-42278 + CVE-2021-42287 chain positional arguments: domain/username:password Account used to authenticate to DC. options: -h, --hel...

SharpGPOAbuse

SharpGPOAbuse SharpGPOAbuse is a .NET application written in C that can be used to take advantage of a user's edit rights on a Group Policy Object GPO in order to compromise the objects that are controlled by that GPO. More details can be found at the following blog post:...

CVE-2021-39475

CVE-2021-39475 XSS on admin reviews page https://www.warcloudsecurity.com/ecommerce/admin/reviews.php?action=preview&rID=1&page=0...

WHOREPRESS

Wordpress login checker Install root@kitploit: npm install --global whorepress Usage make sure you have a list with format url:username:pass root@kitploit: whorepress list.txt Arguments list Arguments| Description ---|--- --admin-only| check only for admin priviledge --debug| debug error output...

CVE-2025-4601

CVE-2025-4601 - WordPress RealHomes Theme = 4.4.0 - Privilege Escalation 🔥 Vulnerability Summary The WordPress theme RealHomes versions = 4.4.0 is vulnerable to a privilege escalation vulnerability. This allows authenticated users with low privileges such as subscribers to escalate their roles to...

Fast-Google-Dorks-Scan

Fast Google Dorks Scan The OSINT project, the main idea of which is to collect all the possible Google dorks search combinations and to find the information about the specific web-site: common admin panels, the widespread file types and path traversal. The 100% automated. Usage example:...

CVE-2024-21338-x64-build-

CVE-2024-21338 Local Privilege Escalation from Admin to Kernel vulnerability on Windows 10 and Windows 11 operating systems with HVCI enabled...

EDR-GhostLocker

GhostLocker: AppLocker-Based EDR Neutralization Introduction After my article on Fairy-Law , where I used kernel mitigations to disable Endpoint Detection & Response EDR solutions, diversenok pointed out that IFEO exclusions Image File Execution Options were too invasive for third-party...

Invoke-SessionHunter

Invoke-SessionHunter Retrieve and display information about active user sessions on remote computers. No admin privileges required. The tool leverages the remote registry service to query the HKEYUSERS registry hive on the remote computers. It identifies and extracts Security Identifiers SIDs...

FuguHub-8.4-Authenticated-RCE-CVE-2024-27697

FuguHub 8.4 Authenticated RCE Fuguhub is a Cloud Media Server Software. The version tested was the debian version at this link: https://fuguhub.com/articles/FuguHub-for-Debian An issue in Real Time Logic LLC FuguHub v.8.4 allows a local attacker to execute arbitrary code via a crafted script to t...

CVE-2024-27198

EN GenTeamCityExploit is a PoC tool that targets a vulnerability in the TeamCity server CVE-2024-27198. It enables the discovery of a TeamCity version and the creation of a new admin user by exploiting an authentication bypass flaw. Features Extracts the version of the TeamCity server. Checks for...

Belsen_Group-et-exploitation-de-la-CVE-2022-40684

BelsenGroup and exploitation of CVE-2022-40684 Context On January 29, 2025, a user of the cybercriminal forum BelsenGroup published a message claiming to hold 15,000 compromised Fortinet devices, with configuration files and VPN passwords. He now offers 1,000 exclusive targets for sale on the dar...

Monitorizer

Monitorizer The Ultimate Subdomain Monitoring Framework Installation ❗ Disclaimer --- Admin users are able to execute code on the local server make sure to change the default password at otherwise use it at your own risk Using docker root@kitploit: $ curl...

CVE-2023-32315

CVE-2023-32315 - Ignite Realtime Openfire Path Traversal Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author phith0n and K3ysTr0K3R Description Openfire is an XMPP server licensed under the Open Source...

CVE-2023-44811

CVE-2023-44811 mooSocial v3.1.8 is vulnerable to Cross Site Request Forgery CSRF which allows attacker to change admin password once an authenticated admin user clicks on the malicious crafted HTML page. I am providing 2 HTML Pages which will when clicked by an authenticated admin user will chang...

CVE-2025-54918-POC

CVE-2025-54918 – Proof of Concept PoC ⚠️ Important Notice IMPORTANT: To test CVE-2025-54918 , you must create a DNS record in the target Active Directory environment. Always consult with the client and obtain explicit authorization before testing, as this can impact DNS and authentication behavior...

Gin-Vue-admin-poc-CVE-2022-21660

Gin-Vue-admin Vertical Privilege Escalation Vulnerability and Code Analysis - CVE-2022-21660 1. Foreword Welcome everyone to give this project a star.http https://github.com/flipped-aurora/gin-vue-admin/ root@kitploit: After finishing the article, applying for a CVE was somewhat troublesome, but...

CVE-2022-32199

CVE-2022-32199 ScriptCase python CVE-2022-32199.py -t 127.0.0.1 -u admin -p admin -path windows/win.ini Example of deleting file in the root directory...

CVE-2023-22515

Red Team Tool - Confluence Unauthorized Add Admin User CVE-2023-22515 Exploit Tool Vulnerability Scope root@kitploit: 8.0.0 = Confluence Data Center and Confluence Server = 8.0.4 8.1.0 = Confluence Data Center and Confluence Server = 8.1.4 8.2.0 = Confluence Data Center and Confluence Server =...