logparser

Logparser Logparser provides a machine learning toolkit and benchmarks for automated log parsing, which is a crucial step for structured log analytics. By applying logparser, users can automatically extract event templates from unstructured logs and convert raw log messages into a sequence of...

DisableSMBCompression

DisableSMBCompression CVE-2020-0796 Flaw Mitigation - Active Directory Administrative Templates The little we know about the new SMB3 flaw, is that we've been provided this mitigation for SMB3 servers: root@kitploit: Set-ItemProperty -Path...

ExportHider

ExportHider ExportHider generates a C++ DLL template which contains a code stub that allows you to hide Exported Functions from the Export Directory of the DLL on the filesystem. After putting the function definitions and compiling the file, you won't see the hidden export functions through PE Fi...

CVE-2024-4040

Exploit Code for CVE-2024-4040 Overview This exploit code targets the CVE-2024-4040 vulnerability, allowing unauthorized access to user accounts by reading and validating tokens stored in the "sessions.obj" file. If the tokens are valid, hackers can gain entry to the targeted accounts. Unlike oth...

Android-Imgui-Template

Android ImGui Template Android menu template using Zygisk + ImGui. https://github.com/user-attachments/assets/816113d9-611d-4909-a08e-0f4e8ab6d03b Requirements Android NDK r27 ndk;27.0.12077973 Build Locally root@kitploit: export ANDROIDNDKHOME=/path/to/ndk/27.0.12077973 $ANDROIDNDKHOME/ndk-build...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Vulnearability Report of the New Jersey official site Bootstrap 4.0.0 Found in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Vulnerability info: Medium 28236 XSS in data-template, data-content and data-title properties of tooltip/popover...

BITB

BITB Browser templates for Browser In The Browser BITB attack. More information: https://mrd0x.com/browser-in-the-browser-phishing-attack/ Usage Each folder has a index.html file which has 4 variables that must be modified: XX-TITLE-XX - The title that shows up for the page e.g. Sign in to your...

CVE-2023-22527

CVE-2023-22527 - RCE Remote Code Execution Vulnerability In Confluence Data Center and Confluence Server PoC Detect nuclei -v -t /path/to/template.yam; -u http://ip:port/ Exploit python3 CVE-2023-22527.py -u ip:port -lh listen-host -lp listen-port...

Payload-and-Polyglot-Lists

Payload & Polyglot Lists Found a payload that doesn't work? Please open an issue with the payload, target context, and what you expected to happen. Pull requests with fixes or new payloads are always welcome. Research is ongoing. This project is under active development and will be updated...

RTI-Toolkit

RTI-Toolkit Remote Template Injection Toolkit Description RTI-Toolkit is an open-source PowerShell toolkit for Remote Template Injection attack. This toolkit includes a PowerShell script named PS-Templator.ps1 which can be used from both an attacking and defensive perspective. The following table...

CVE-2022-24086

CVE-2022-24086 Tested with: magento 2.4.3 and sample data Docker image: docker.io/bitnami/magento:2.4.3-debian-10-r0 First Name: root@kitploit: var this.getTemplateFilter.filter$order.shippingaddress.cityvar...

serverless-application-model

AWS SAM transform The AWS Serverless Application Model AWS SAM transform is a AWS CloudFormation macro that transforms SAM templates into CloudFormation templates. To use the SAM transform, add to the of your CloudFormation template...

CVE-2019-11581

Atlassian Jira unauthenticated template injection CVE-2019-11581 I Building 1. Bug versions root@kitploit: 4.4.x 5.x.x 6.x.x 7.0.x 7.1.x 7.2.x 7.3.x 7.4.x 7.5.x 7.6.x before 7.6.14 the fixed version for 7.6.x 7.7.x 7.8.x 7.9.x 7.10.x 7.11.x 7.12.x 7.13.x before 7.13.5 the fixed version for 7.13.x...

XanXSS

XanXSS XanXSS is a reflected XSS searching tool DOM coming soon that creates payloads based from templates. Unlike other XSS scanners that just run through a list of payloads. XanXSS tries to make the payload unidentifiable, for example: root@kitploit: /cLIcKMe!XaNxss With XanXSS every payload is...

TJ-OPT

TJ-OPT Release Date September 9th 2024 Introduction As a pentester, there are many great resources, cheat sheets, and guidelines that contain a large amount of valuable information. However, it can be frustrating and time-consuming to find these notes or resources that are scattered all over the...

GenCrushSSTIExploit

EN GenCrushSSTIExploit is a PoC exploit tool targeting the SSTI Server-Side Template Injection vulnerability in CrushFTP CVE-2024-4040. This tool demonstrates how to exploit this vulnerability for educational and ethical hacking purposes only. Features Establishes a session with the CrushFTP serv...

CVE-2020-7384

CVE-2020-7384 This is a small exploit in bash which I had made while solving one of the boxes from Hack The Box. The exploit is modified from the original exploit here: https://github.com/justinsteven/advisories/blob/master/2020metasploitmsfvenomapktemplatecmdi.md Usage dos2unix CVE-2020-7384.sh...

CVE-2024-24919

CVE-2024-24919 Nuclei Template to discover CVE-2024-24919. A path traversal vulnerability in CheckPoint SSLVPN. BTW. Great article, that was my inspiration to write this simple template at 2:00 AM. Resource: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/...

GenGravSSTIExploit

EN GenGravSSTIExploit is a PoC Python script that exploits an authenticated Server-Side Template Injection SSTI vulnerability in Grav CMS versions = 1.7.44 CVE-2024-28116. This vulnerability allows a user with editor permissions to execute OS commands on a remote server. Note : This script requir...

CVE-2023-30145

Description: Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection SSTI vulnerability via the formats parameter. Affected Component: All versions that are below 2.7.0 Fixed version: Fixed Versions: 2.7.4 Step to reproduce : Detection: 1.open below...