hacks

Hacks Hacky one-off scripts, tests etc...

private-membership

Private Set Membership PSM Problem Statement Private Set Membership PSM is a cryptographic protocol that allows clients to privately query whether the client's identifier is a member of a set of identifiers held by a server in a privacy-preserving manner. At a high level, PSM provides the followi...

ActiveReign

ActiveReign ⚠️ Thank you for your support. This project is no longer publicly maintained. Background A while back I was challenged to write a discovery tool with Python3 that could automate the process of finding sensitive information on network file shares. After writing the entire tool with...

ssh-auditor

SSH Auditor Features ssh-auditor will automatically: Re-check all known hosts as new credentials are added. It will only check the new credentials. Queue a full credential scan on any new host discovered. Queue a full credential scan on any known host whose ssh version or key fingerprint changes...

impacket

Impacket Copyright Fortra, LLC and its affiliated companies. All rights reserved. Impacket was originally created by SecureAuth, and now maintained by Fortra's Core Security. Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level...

cypheroth

Cypheroth Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets. Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same...

sqlmap

sqlmap sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester, and a broad range of switche...

EUVD-2026-44815

listmonk: SQL Injection in /api/subscribers/export bypasses table access control, leaking admin password hashes and SMTP credentials...

CVE-2026-102650

Nuxt Content, a file-based CMS for Nuxt applications, is vulnerable to an unauthenticated Denial of Service (DoS) via the POST /__nuxt_content/:collection/query endpoint in versions 3.0.0 through 3.15.2 . The issue stems from a validation gap in src/runtime/internal/security.ts (specifically the ...

EUVD-2026-118389

Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /nuxtcontent/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite...

msticpy

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

Arjun

Arjun HTTP Parameter Discovery Suite What's Arjun? Arjun can find query parameters for URL endpoints. If you don't get what that means, it's okay, read along. Web applications use parameters or queries to accept user input, take the following example into consideration...

ReadyScript SQL Injection

The vulnerability of the ReadyScript e-commerce management system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CRM Platform SQL Injection

The vulnerability of the platform for creating individual web applications in CRM involves the failure to take measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

Webasyst Shop-Script CMS SQL Injection

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

Webasyst Shop-Script CMS SQL Injection

The vulnerability of the Webasyst framework for designing content management systems and the Shop-Script CMS system lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary SQL code...

CVE-2026-35104

HCL AION is affected by an open redirect vulnerability on the user registration page Signup component. The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. Thi...

ADSearch

ADSearch A tool written for cobalt-strike's execute-assembly command that allows for more efficent querying of AD. Key Features List all Domain Admins Custom LDAP Search Connect to LDAPS Servers Output JSON data from AD instances Retrieve custom attributes from a generic query i.e. All computers...

sopa

sopa A practical client for ADWS in Golang. Sopa implements the ADWS protocol stack MS-NNS + MC-NMF + SOAP, exposing the following command-line features: Object search & retrieval query: runs LDAP-filter searches via WS-Enumeration Enumerate + Pull loop with attribute projection, scope control...

CVE-2026-35104

The HCL AION platform is affected by an open redirect vulnerability within the Signup component on the user registration page. The application fails to validate the value of the 'redirect' query parameter used for post-registration redirection. An attacker could craft a malicious registration lin...