wordpress-cve-2024-10924-exploit

WordPress CVE-2024-10924 Exploit 📌 Resumen Este repositorio contiene un exploit de prueba de concepto PoC para CVE-2024-10924, una vulnerabilidad en el plugin de WordPress Really Simple SSL que permite omitir la autenticación de dos factores 2FA. Los atacantes pueden explotar esta falla para...

CredSniper

CredSniper Overview Benefits Basic Usage Installation Screenshots Gmail Module Maintainer Contributing Overview Easily launch a new phishing site fully presented with SSL and capture credentials along with 2FA tokens using CredSniper. The API provides secure access to the currently captured...

Ares

Project Ares Project Ares Injector Project Ares Injector is a Proof of Concept PoC loader written in C/C++ based on the Transacted Hollowing technique. The loader injects a PE into a remote process and features: PPID spoofing CIG to block non-Microsoft-signed binaries Dynamic function resolution...

LetsMapYourNetwork

Omniscient - Let’s Map Your Network v2.0 Table of Contents 1. WHAT IT IS 2. WHY IT IS 3. WHERE TO USE IT 4. Presentations 5. Key Features 6. Installation Guidelines 7. HOW TO USE IT 8. Understand Node 9. Contributer 10. LMYN In Action 11. Roadmap 12. Contact Information WHAT IT IS It is utmost...

CVE-2025-8110

CVE-2025-8110 — Gogs Symlink Traversal → RCE Overview CVE-2025-8110 is a critical vulnerability in Gogs self-hosted Git service versions = 0.13.3. The PutContents API validates file paths for directory-traversal ../ but does not resolve symbolic links before writing. An authenticated user can pus...

git-hound

🐾 GitHound Un cazador de secretos que combina coincidencia de patrones, ataque de parches y captura por lotes. Resumen GitHound rastrea claves API, secretos y credenciales expuestos en todo GitHub combinando dorks de GitHub con coincidencia de patrones, detección contextual y análisis del histori...

CVE-2025-27007-OttoKit-exploit

CVE-2025-27007: Vulnerabilidad de Escalada de Privilegios en OttoKit SureTriggers Explotación de CVE-2025-27007, una vulnerabilidad crítica de escalada de privilegios no autorizada en el plugin OttoKit anteriormente conocido como SureTriggers para WordPress. Este repositorio describe cómo un...

CVE-2023-27163

CVE-2023-27163 - SSRF en Request Baskets Prueba de concepto de SSRF en Request Baskets texto alternativo Las versiones de Request Baskets anteriores a la 1.2.1 son vulnerables a ataques de Server Side Request Forgery SSRF a través del componente /api/baskets/name. uso root@kitploit: git clone...

CVE-2025-43990-Magento-RCE

Magento APSB25-94 — Carga de archivo no autenticada a RCE Resumen Explota la carga de archivos no autenticada en Magento / Adobe Commerce a través de la carga de archivos customoptions del carrito de invitado de la API REST. Cadena de ataque root@kitploit: 1. GraphQL → leak product SKU 2. REST AP...

evilqr

Evil QR Toolkit demonstrating another approach of a QRLJacking attack, allowing to perform remote account takeover, through sign-in QR code phishing. It consists of a browser extension used by the attacker to extract the sign-in QR code and a server application, which retrieves the sign-in QR cod...

munge

MUNGE Uid 'N' Gid Emporium MUNGE MUNGE Uid 'N' Gid Emporium es un servicio de autenticación para crear y validar credenciales de usuario. Está diseñado para ser altamente escalable para su uso en un entorno de clúster HPC. Proporciona una API portátil para codificar la identidad del usuario en un...

grafeo

ACT Platform is now called grafeo! Grafeo is a versatile platform to create custom data models, collect and share knowledge. It is a flexible, well-rounded solution that can be used for any purpose. Developed as part of the ACT research project, it remains at the core of ACT and powers the ACT...

CVE-2022-24112-POC

CVE-2022-24112-POC Apache APISIX 2.12.1 Remote Code Execution by IP restriction bypass and using default admin AIP token Full walkthrough https://kavigihan.medium.com/apache-apisix-2-12-1-remote-code-execution-5f920b22ccff...

SilentMoonwalk

SilentMoonwalk PoC Implementation of a fully dynamic call stack spoofer TL;DR SilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. Authors...

CitrixADC-CVE-2020-8300

Detect Citrix ADC SAML action or SAML iDP Profile config vulnerable to CVE-2020-8300 using Citrix ADC NITRO API EXAMPLE & '.\CitrixADC-CVE-2020-8300.ps1' -NSIPProtocol http -NSIP 10.10.10.10 -user nitro -pass "SshhhItsASecret" If this proves useful to anyone I will develop further with the...

Cve-api

Parse & filter the latest CVEs from https://cve.mitre.org Docs Usage http://localhost:4000/cve?target=KEYWORD The year parameter is optional. http://localhost:4000/cve?target=KEYWORD&year=YEAR Examples http://localhost:4000/cve?target=ruby%20on%20rails...

Instagram-Crawler

Instagram-Crawler Non API. Crawling post photo, likes, comments, date ... by username, hashtags Installation 1. Make sure you have Chrome browser installed. 2. Download chromedriver and put it into driver folder: ./driver/chromedriver 3. Install requirements pip install -r requirements.txt...

github-endpoints

github-endpoints Encuentra endpoints en GitHub. Descripción Esta herramienta Go realiza búsquedas en GitHub y analiza los resultados para encontrar endpoints de un dominio determinado. Instalación root@kitploit: go install github.com/gwen001/github-endpoints@latest o root@kitploit: git clone...

Get-PDInvokeImports

Get-PDInvokeImports Description: Get-PDInvokeImports is tool PowerShell module which is able to perform automatic detection of P/Invoke, Dynamic P/Invoke and D/Invoke usage in assembly. Showing all locations from where they are referenced and Exports all to DnSpyBookmarks.xml This PS module could...

buster

Description Buster is an advanced OSINT tool used to: Get social accounts of an email using multiple sourcesgravatar,about.me,myspace,skype,github,linkedin,previous breaches Get links to where the email was found using google,twitter,darksearch and paste sites Get breaches of an email Get domains...