Fudge

Fudge I had some success with on Phishing engagements by base64 encoding the contents of a file, putting it into a HTML file and having it decode and drop when the user opened the HTML file. Usage There are precompiled binaries available on the releases tab for both Windows 64-bit and Linux 64-bi...

AdvPhishing

Check For Mp4: https://www.instagram.com/tukbuck/reel/DTBBBknj-nd/ Note: If you want to activate this tool or want same project with working condition then first pay: ETHERC20 wallet address: 0xe48df3c0e1713518096c7d2d0a2dce70aa85cd33 Follow on Social Media Platforms Contribute us Want to Learn t...

Cooper

Cooper, noun, a maker or repairer of casks and barrels It's a "fish in a barrel" joke. I enjoy puns! A Python tool for ingesting HTML and producing HTML source suitable for phishing campaigns. Cooper simplifies the process of cloning a target website or email for use in a phishing campaign. Just...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

dalfox

Looking for the Go v2.x version? Dalfox v3 is a complete rewrite in Rust. The Go codebase is preserved on the v2 branch and continues to receive security backports. See SECURITY.md for the support policy, and the migration guide for what changed in v3. Dalfox is a powerful open-source tool that...

cve-collector

CVE-Collector Simple Latest CVE Collector Written in Python There are various methods for collecting the latest CVE Common Vulnerabilities and Exposures information. This code was created to provide guidance on how to collect, what information to include, and how to code when creating a CVE...

HtmlSmuggling

HtmlSmuggling HTML smuggling is a malicious technique used by hackers to hide malware payloads in an encoded script in a specially crafted HTML attachment or web page. The malicious script decodes and deploys the payload on the targeted device when the victim opens/clicks the HTML attachment/link...

CVE-2021-24563

CVE-2021-24563 Frontend Uploader alert/XSS/ ---------------------...

reverie

reverie Automated Pentest Tools Designed For Parrot Linux this tool will make your basic pentesting task like Information Gathering, Security Auditing, And Reporting so this tool will do every task fully automatic. Usage Guide Download / Clone git clone https://github.com/baguswiratmaadi/reverie ...

domato

Domato 🍅 一个 DOM 模糊测试器 由 Ivan Fratric 编写和维护，[email protected] 版权所有 2017 Google Inc. 保留所有权利。 根据 Apache 许可证 2.0 版（“许可证”）获得许可； 除非遵守许可证，否则您不得使用此文件。 您可以在以下位置获取许可证副本： root@kitploit: http://www.apache.org/licenses/LICENSE-2.0 除非适用法律要求或书面同意，否则按“原样”分发软件， 不附带任何明示或暗示的保证或条件。 请参阅许可证，了解管理权限和限制的具体语言。 使用方法...

MrHandler

MR.HANDLER MR.Handler is a specialized tool designed for responding to security incidents on Linux systems. It connects to target systems via SSH to execute a range of diagnostic commands, gathering crucial information such as network configurations, system logs, user accounts, and running...

evildork

evildork👁️ Dork only one specific domain or all subdomains available Dork targeting a general target likely to be a person Produce an html output result page with all the dorks links Be aware that Google after some tries will add some captcha to check if you're a bot or not. Installation 📥 git...

device-pharmer

device-pharmer 并发打开 Shodan 搜索结果、指定的 IP、IP 范围、域名或文本文件中的 IP 列表，并打印页面的状态和标题（如果适用）。添加 -u 和 -p 选项可尝试登录页面，首先查找表单登录，如果失败则尝试 HTTP 基本认证。 使用 -f SEARCHSTRING 在 HTML 响应中查找特定字符串，以测试认证是否成功。将所有响应的设备记录到以 Shodan 搜索词或目标 IP/域名加 results.txt 命名的文件中。搜索响应页面 HTML 时有一点需要注意：某些表单登录页面在认证请求后返回的是 JSON 对象响应，而不是登录后页面的 HTML...

huntr-com-bug-bounties-collector

huntr.com bugs collector New bug bountyvulnerabilities collector Requirements Chrome with GUI If you encounter trouble with script execution, check the status of VMs GPU features, if available. Chrome WebDriver Preview root@kitploit: python3 main.py 2024-02-20 16:14:47.836189 1. Arbitrary File...

HTMLSmuggler

HTMLSmuggler ✉️ HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling. Description The full explanation what is HTML Smuggling may be found here. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion...

EntraFalcon

EntraFalcon EntraFalcon is a PowerShell-based assessment tool for pentesters, security analysts, and system administrators to evaluate the security posture of a Microsoft Entra ID environment. Designed for ease of use, EntraFalcon runs on PowerShell 5.1 and 7, supports both Windows and Linux, and...

CVE-2006-3392

CVE-2006-3392 Description Webmin 1.290之前版本和Usermin 1.220之前版本在解码HTML之前调用了simplifypath函数，这允许远程攻击者读取任意文件，例如使用"..%01"序列，该序列绕过了在从文件名中移除"%01"等字节之前对"../"序列的移除。注意：这是与CVE-2006-3274不同的问题。 Execution root@kitploit: $ python3 CVE-2006-3392.py -u http://127.0.0.1:10000 / \ \ / / | | \ / \ / \ / / | \ \ / \ \ |...

Leantime-POC

Leantime-POC CVE-2024-27474, CVE-2024-27476, CVE-2024-27477 Descripción Las siguientes vulnerabilidades fueron identificadas en la versión 3.0.6 del sistema de gestión de proyectos orientado a objetivos Leantime. CVE-2024-27474 Una vulnerabilidad de falsificación de petición en sitios cruzados CS...

CVE-2026-11645

CVE-2026-11645 - Google Chrome中V8远程代码执行漏洞 快速使用 root@kitploit: python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe 漏洞利用说明 严重性: HIGH CVSS: 8.8 影响: 机密性、完整性、可用性 发布时间: 2026-06-09 技术摘要 在Google Chrome...

JCS

JCS Joomla Component Scanner made for penetration testing purpose on Joomla CMS JCS can help you with the latest component vulnerablities and exploits. Database can update from several resources and a Crawler has been implemented to find components and component's link. This version supports...