poisontap

PoisonTap - siphons cookies, exposes internal router & installs web backdoor on locked computers Created by @SamyKamkar || https://samy.pl When PoisonTap Raspberry Pi Zero & Node.js is plugged into a locked/password protected computer, it: emulates an Ethernet device over USB or Thunderbolt...

hate_crack

root@kitploit: / | \ / | \ \ | | / \ \ / \ / \ /\ \ \ / | |/ / \ Y // | | \ / \ | | // \ | \ /|| /\ | \ / / // / / / / Installation Installing from source is the only supported path. hatecrack is not distributed on PyPI: pip install hate-crack resolves to a 0.0.0 placeholder that...

macphish

macphish Office for Mac Macro Payload Generator Attack vectors There are 4 attack vectors available: beacon creds meterpreter meterpreter-grant For the 'creds' method, macphish can generate the Applescript script directly, in case you need to run it from a shell. beacon On execution, this payload...

AngryOxide

AngryOxide 😡 A 802.11 Attack tool built in Rust 🦀 ! This tool is for research purposes only. I am not responsible for anything you do or damage you cause while using AngryOxide. Only use against networks that you have permission. AngryOxide was developed as a way to learn Rust, netlink, kernel...

Microsoft365_devicePhish

Microsoft365devicePhish Abusando del flujo de autorización OAuth de Microsoft 365 para ataques de phishing Este es un script simple de prueba de concepto que permite a un atacante realizar un ataque de phishing contra el flujo de autorización OAuth de Microsoft 365. Usando esto, uno puede...

fluxion

Fluxion es el futuro de los ataques MITM WPA Fluxion es una herramienta de auditoría de seguridad e investigación de ingeniería social. Es una remake de linset por vk496 con con suerte menos errores y más funcionalidad. El script intenta recuperar la clave WPA/WPA2 de un punto de acceso objetivo...

CVE-2026-101008

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function mergesplitfile of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument splitfilepath results in command injection. The attack is possible to be...

CVE-2026-101009

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bttask.unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the argument Password can lead to os command injection. The attack...

CVE-2026-101007

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command injection. The attack can be executed remotely. The exploit...

CVE-2026-101005

A vulnerability was detected in October CMS up to 4.3.4. This affects the function validateExternalImageHost of the file System/Classes/ResizeImages.php of the component SSRF Protection. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is n...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

metlo

Metlo API Security Secure Your API. Metlo is an open-source API security platform Metlo is an open source API security tool you can setup in 15 minutes that inventories your endpoints, detects bad actors and blocks malicious traffic in real time. Detect API attacks in real time. Automatically blo...

CVE-2026-101010 aaPanel BaoTa data.py getData sql injection

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

CVE-2026-101010

A SQL injection vulnerability exists in aaPanel BaoTa versions up to 11.8.0 . The flaw is located in the getData function within the file /www/server/panel/class/data.py, where improper handling of the log_type argument allows for exploitation. Attackers can initiate this attack remotely . While ...

EUVD-2026-88123

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument logtype leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl...

BruteLoops

BruteLoops Una biblioteca extremadamente simple que proporciona la lógica fundamental para ataques eficientes de fuerza bruta de contraseñas contra interfaces de autenticación. Documentación La documentación se puede encontrar aquí. Si buscas los antiguos módulos de ejemplo... Mira BFG. Los...

Beleth

Beleth Cracker SSH basado en diccionarios root@kitploit: Usage: ./beleth OPTIONS -c payload Ejecutar payload en el servidor remoto una vez iniciada sesión -h Mostrar esta ayuda -l threads Limitar hilos al número dado. Por defecto: 4 -p port Especificar puerto remoto -P password Usar un único...

nmap-nse-scripts

Repository for NSE Nmap Scripting Engine development. You will find my scripts including non-official ones, libraries, resources and other related material from my workshops. TODO -Finishing SMB2 NSE library -Currently working on password mangling functionality Paulino Calderon calderonwebsec.mx...

threatest

Threatest Threatest es una CLI y un framework en Go para probar la detección de amenazas de extremo a extremo. Threatest te permite detonar una técnica de ataque y verificar que se haya generado la alerta esperada en tu plataforma de seguridad favorita. Lee el anuncio en el blog:...

dvwassl

SSL-enabled Damn Vulnerable Web App Run an SSL-enabled Damn Vulnerable Web App. Why? You might want to test web attack detections over SSL. Build the image root@kitploit: docker build -t dvwassl:latest . Run the container root@kitploit: docker run -d -p 443:443 dvwassl:latest Custom SSL certifica...