CVE-2024-34351

CVE-2024-34351 Test-bed for CVE-2024-34351: I used the latest vulnerable version of Next.js, which is 14.1.0. Set up the environment with the following command: root@kitploit: npm install npm run dev...

pyt

.. image:: https://travis-ci.org/python-security/pyt.svg?branch=master :target: https://travis-ci.org/python-security/pyt .. image:: https://readthedocs.org/projects/pyt/badge/?version=latest :target: http://pyt.readthedocs.io/en/latest/?badge=latest .. image::...

setup-ipsec-vpn

English | 简体中文 | 繁體中文 | 日本語 | Русский IPsec VPN 서버 자동 설정 스크립트 IPsec/L2TP, Cisco IPsec 및 IKEv2를 지원하는 나만의 IPsec VPN 서버를 단 몇 분 안에 설정하세요. IPsec VPN은 네트워크 트래픽을 암호화하여, 사용자와 VPN 서버 사이에서 인터넷을 통해 이동하는 데이터를 누군가 도청하는 것을 방지합니다. 이는 특히 커피숍, 공항 또는 호텔 방과 같이 보안이 취약한 네트워크를 사용할 때 유용합니다. IPsec 서버로 Libreswan을, L2TP...

wp2shell-cve-2026-63030-root-cause

wp2shell CVE-2026-63030 + CVE-2026-60137: Análisis independiente de causa raíz WordPress core divulgó wp2shell el 2026-07-17 como un RCE crítico no autenticado que afecta a las instalaciones por defecto WordPress 6.9.0-6.9.4, 7.0.0-7.0.1, sin necesidad de plugins. El descubridor original...

peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

openvpn-install

openvpn-install OpenVPN installer for Debian, Ubuntu, Fedora, openSUSE, CentOS, Amazon Linux, Arch Linux, Oracle Linux, Rocky Linux and AlmaLinux. This script will let you setup and manage your own secure VPN server in just a few seconds. What is this? This script is meant to be run on your own...

wpscan

WPScan WordPress Security Scanner WPScan WordPress Vulnerability Database - WordPress Security Plugin INSTALL Prerequisites Optional but highly recommended: rbenv Ruby = 3.3 - Recommended: latest stable Curl = 7.72 - Recommended: latest stable The 7.29 has a segfault The 7.72 could result in...

git-secrets

=========== git-secrets Prevents you from committing passwords and other sensitive information to a git repository. .. contents:: :depth: 2 Synopsis :: root@kitploit: git secrets --scan -r|--recursive --cached --no-index --untracked ... git secrets --scan-history git secrets --install -f|--force...

reaver-wps-fork-t6x

Overview Reaver implements a brute force attack against Wifi Protected Setup WPS registrar PINs in order to recover WPA/WPA2 passphrases , as described in Brute forcing Wi-Fi Protected Setup When poor design meets poor implementation. by Stefan Viehböck. Reaver has been designed to be a robust an...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

CVE-2025-1562

CVE-2025-1562 root@kitploit: POST /index.php?restroute=%2Fautonami-app%2Fplugin%2Finstallandactivate&bwf-nonce=0f2449cddf9a7d692627071cfdef9ecf HTTP/2 Host: wp.192.168.31.110.nip.io User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/91.0.4472.124...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...

CVE-2024-48990-Exploit

CVE-2024-48990 Exploit My full writeup for how I came to re-discovering this N-day and creating my own exploit for it can be found on my blog. Essentially, you can git clone this repository into an attacker-controlled directory, export PYTHONPATH=, and then run main.py with that PYTHONPATH value...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

pritunl

pritunl: エンタープライズVPNサーバー Pritunl は、OpenVPN プロトコルを使用して構築された分散型エンタープライズVPNサーバーです。ドキュメントや詳細情報は、ホームページ pritunl.com にあります。 ソースからのインストール root@kitploit: Install MongoDB if running single host configuration sudo tee /etc/yum.repos.d/mongodb-org.repo EOF mongodb-org name=MongoDB Repository...

FFM

Freedom Fighting Mode FFM FFM is a hacking harness that you can use during the post-exploitation phase of a red-teaming engagement. The idea of the tool was derived from a 2007 conference from @thegrugq. It was presented at SSTIC 2018 video and the accompanying slide deck is available at this url...

pkgxray

pkgxray — npmパッケージ、MCPサーバー、AIエージェント向けのインストール前セキュリティ npmパッケージまたはMCPサーバーをインストールまたは接続する前に 検査し、決定的でエビデンスに裏付けられたSAFE、REVIEW、BLOCKの判定を取得します。ローカルで動作する依存関係ゼロの静的解析 — 通常のスキャンではパッケージコードを実行しません。...

CVE-2026-23744-PoC

説明 MCPJam inspectorは、MCPサーバー向けのローカルファーストの開発プラットフォームです。バージョン1.4.2以前には、リモートコード実行（RCE）の脆弱性が存在し、攻撃者が細工したHTTPリクエストを送信することでMCPサーバーのインストールがトリガーされ、RCEに至る可能性があります。MCPJam inspectorはデフォルトで127.0.0.1ではなく0.0.0.0でリッスンするため、攻撃者は単純なHTTPリクエストによってリモートからRCEを引き起こすことができます。バージョン1.4.3でパッチが適用されました。 影響を受けるバージョン 脆弱性のソース|...

gosec

gosec - Go Security Checker Inspects source code for security problems by scanning the Go AST and SSA code representation. Quick links GitHub Action Local installation Quick start Common usage patterns Selecting rules Output formats Features Pattern-based rules for detecting common security issue...

h2t

h2t - HTTP Hardening Tool Description h2t is a simple tool to help sysadmins to hardening their websites. Until now h2t checks the website headers and recommends how to make it better. Dependences Python 3 colorama requests Install root@kitploit: $ git clone https://github.com/gildasio/h2t $ cd h...