The vulnerability of DesktopServicesHelper on macOS operating systems allows a hacker to increase their privileges.

The vulnerability of DesktopServicesHelper in macOS operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to gain increased privileges...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

failpoint

failpoint An implementation of failpoints for Golang. Fail points are used to add code points where errors may be injected in a user controlled fashion. Fail point is a code snippet that is only executed when the corresponding failpoint is active. Quick Start use failpoint-ctl 1. Build...

CVE-2017-9822

CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution RCE DotNetNuke DNN versions between 5.0.0 - 9.3.0 are affected to deserialization vulnerability that leads to Remote Code Execution RCE. DotNetNuke uses the DNNPersonalization cookie to store anonymous users’ personalization...

AppleDOS

AppleDOS CVE-2018-4407 Based on CVE-2018-4407 https://lgtm.com/blog/applexnuicmperrorCVE-2018-4407, this tweet, and this video. The bug is heap overflow vulnerability in bad packet handling when OS try to send ICMP message containing segments from bad packet back to the sender. This POC will...

CVE-2026-105283

The ash_typescript library (versions 0.1.0 to 0.19.0 ) is vulnerable to a Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability. An unauthenticated attacker can trigger an error that lacks a specific handling clause in AshTypescript.Rpc.ErrorBuilder.build_error_resp...

shfz

shfz A scenario-based web application fuzzng tool that supports fuzz generation by genetic algorithm. Features Easy to customize fuzzing test by scripting fuzzing scenario in JavaScript / TypeScript Third-party packages can be used in fuzzing scenario script Genetic algorithm fuzz generation...

CVE-2018-1000199

CVE-2018-1000199 The Linux ptrace code virtualizes access to the debug registers, and the virtualization code has incorrect error handling. This means that if you write an illegal value to, say, DR0, the internal state of the kernel's breakpoint tracking can become corrupt despite the fact that t...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

CVE-2019-16279

CVE-2019-16279 （CVE-2019-16279）dos This bug exploit a memory error when sending too many \r\n in a single connexion. Example $ curl http://127.0.0.1:8080 HELLO! $ ./CVE-2019-16279.sh 127.0.0.1 8080 $ curl http://127.0.0.1:8080 curl: 7 Failed to connect to 127.0.0.1 port 8080: Connection refused...

CVE-2023-3897

CVE-2023-3897 Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...

dontgo403

dontgo403 is a tool to bypass 40X errors. Installation Grab the latest release for your OS from RELEASES Outdated atm Or compile by your own RECOMMENDED: git clone https://github.com/devploit/dontgo403; cd dontgo403; go get; go build Customization If you want to edit or add new bypasses, you can...

Pymap-Scanner

Pymap-Scanner Features 1-Basic Gui 2-Speed Scan 3-Custom Services 4-User Control 5-Error Control 6-Useful parameters And More. Installation Modules $ Pyqt4 $ Nmap RequirementsThird +xsltproc +SCREENSHOT...

etl-parser

etl-parser Event Trace Log file reader in pure Python etl-parser is a pure Python 3 parser library for ETL Windows log files. ETL is the default format for ETW as well as the default format for the Kernel logger. etl-parser has no system dependencies, and will work well on both Windows and Linux...

Testability-CVE-2014-1266

TestableSecurity This is a small proof-of-concept that lifts out the vulnerable SSLVerifySignedServerKeyExchange from Apple's libsecurityssl to demonstrate that the signing code is readily unit testable in isolation. While there's been some talk that this bug wasn't easily tested, the code in...

ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

CVE-2025-24963

CVE-2025-24963 - Vitest Browser Mode - Local File Read ​CVE-2025-24963 is a medium-severity vulnerability CVSS 3.1 score: 5.9 affecting the @vitest/browser package, a component of the Vitest testing framework powered by Vite. This vulnerability arises from improper input validation in the...

ThreatIngestor

ThreatIngestor Utilities Scripts to improve ThreatIngestor usage and help with minimizing errors. All scripts contain the following optional argument to allow for higher verbosity in stdout: python3 scripts/ -v A quick list of all available scripts: Script| Example| Description ---|---|---...

python-paddingoracle

python-paddingoracle: A portable, padding oracle exploit API UPDATED FOR PYTHON 3 python-paddingoracle is an API that provides pentesters a customizable alternative to PadBuster and other padding oracle exploit tools that can't easily without a heavy rewrite be used in unique, per-app scenarios...