cve-2019-17240

Bludit = 3.9.22 - Bruteforce Mitigation Bypass This is small project where I rewrite this python script into golang. Purpose of this project was to learn Golang and understand how this exploit work. Usage root@kitploit: $ ./brutepass -sdasds flag provided but not defined: -sdasds Usage of...

openssh-portable

Portable OpenSSH OpenSSH is a complete implementation of the SSH protocol version 2 for secure remote login, command execution and file transfer. It includes a client ssh and server sshd, file transfer utilities scp and sftp as well as tools for key generation ssh-keygen, run-time key storage...

sshprank

Description A fast SSH mass-scanner, login cracker, banner grabber and password auth checker tool using the python-masscan and shodan module. Usage root@kitploit: hacker@blackarch $ sshprank -H / / / / / / / / / / / / /// | / / / // / / / // / / / / , opts | mode options -h - single host, cidr,...

sshprank

Descripción Una herramienta rápida de escáner masivo SSH, cracker de inicios de sesión, capturador de banners y verificador de autenticación por contraseña que utiliza los módulos python-masscan y shodan. Uso root@kitploit: hacker@blackarch $ sshprank -H / / / / / / / / / / / / /// | / / / // /...

Mythic-Macro-Generator

Mythic-Macro-Generator Script en Python3 para generar macros de MS Office que lanzan payloads JXA de Mythic. Este script genera una macro de Office que usa osascript para descargar y ejecutar el payload JXA .js de Mythic. Pasos: 1. Configura el servidor C2 de Mythic y genera un payload "apfell" j...

MacPersistenceChecker

MacPersistenceChecker See EVERYTHING that runs on your Mac. Understand WHY it runs. Decide WHAT stays. TL;DR MacPersistenceChecker shows you everything that runs automatically on your Mac , explains why it matters , and helps you decide what to keep or remove. → Find malware → Detect hidden...

CVE-2023-2982

CVE-2023-2982 WordPress Social Login and Register Discord, Google, Twitter, LinkedIn = 7.6.4 - Authentication Bypass Info The WordPress Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4...

QRLJacking

QRLJacking - A New Social Engineering Attack Vector Find documentation in our Wiki. What is QRLJacking? QRLJacking or Quick Response Code Login Jacking is a simple social engineering attack vector capable of session hijacking affecting all applications that rely on the “Login with QR code” featur...

IMAPLoginTester

IMAPLoginTester IMAPLoginTester is a simple Python script that reads a text file with lots of e-mails and passwords, and tries to check if those credentials are valid by trying to login to the respective IMAP servers. Usage: root@kitploit: usage: imaplogintester.py -h -i INPUT -o OUTPUT -s -t...

CVE-2021-24647

CVE-2021-24647 CVE-2021-24647 Pie Register 3.7.1.6 - Unauthenticated Arbitrary Login Info root@kitploit: usage: exploit.py -h -w URL -p PATH options: -h, --help show this help message and exit -w URL, --url URL URL of the WordPress site -p PATH, --path PATH Path of the Login Page /login/ or...

webvulscan

WebVulScan Synopsis WebVulScan is a web application vulnerability scanner. It is a web application itself written in PHP and can be used to test remote, or local, web applications for security vulnerabilities. As a scan is running, details of the scan are dynamically updated to the user. These...

CVE-2022-44877

Centos Web Panel 7 Unauthenticated Remote Code Execution - CVE-2022-44877 root@kitploit: + Centos Web Panel 7 Unauthenticated Remote Code Execution + Centos Web Panel 7 - log ➜ CVE-2022-44877 cat log examplelog ➜ CVE-2022-44877 echo "examplelog $whoami" log ➜ CVE-2022-44877 cat log examplelog...

CVE-2023-26469-Jorani

CVE-2023-26469 Exploitation Tool Overview This is a Proof of Concept PoC exploit tool for Jorani 1.0.0, which allows attackers to achieve remote code execution through path traversal and log injection techniques. ⚠️ Warning: This tool is intended for security research and authorized testing only...

CVE-2024-7593

CVE-2024-7593 Detection How does this detection method work? This template matches on the following versions, if there is a match then the host is considered vulnerable: root@kitploit: - "22.2" - "22.3" - "22.3R2" - "22.5R1" - "22.6R1" - "22.7R1" To prevent producing any FPs it also matches on th...

CVE-2026-24061-payload

Original source:https://github.com/K3ysTr0K3R/CVE-2026-24061 CVE-2026-24061 - GNU InetUtils telnetd Argument Injection Authentication Bypass GNU InetUtils versions 1.9.3 through 2.7 are vulnerable to a remote authentication bypass vulnerability in the telnetd server. The telnetd daemon fails to...

Breacher

Breacher A script to find admin login pages and EAR vulnerabilites. Features Multi-threading on demand Big path list 482 paths Supports php, asp and html extensions Checks for potential EAR vulnerabilites Checks for robots.txt Support for custom patns Usages Check all paths with php extension...

fakelogonscreen

FakeLogonScreen FakeLogonScreen es una utilidad para falsificar la pantalla de inicio de sesión de Windows con el fin de obtener la contraseña del usuario. La contraseña ingresada se valida contra Active Directory o la máquina local para asegurarse de que sea correcta y luego se muestra en la...

research-cve-2026-85649

CVE-2026-85649 | Holloway Chew, Kean Ho's Knowledge Research On 2026-08-26, a security vulnerability CVSS: 7.9, High7 was reported in Holloway Chew, Kean Ho's Actualizer v1.2.0 and below. The tool assumed that the mkpasswd command always produces a valid yescrypt password hash. In situations wher...

kismet

https://www.kismetwireless.net The Kismet docs can be most easily found and read at the Kismet website The docs repository is at: root@kitploit: $ git clone https://www.kismetwireless.net/git/kismet-docs.git and mirrored on Github at: root@kitploit: $ git clone...

EUVD-2026-87518

@openclaw/whatsapp npm before 2026.8.1 exposes the WhatsApp login tool through the generic channel-tool path without preserving the originating sender's owner status, so the owner-only tool boundary is not enforced. An admitted non-owner sender able to steer the tool can request a forced login an...