cve-2025-29927-lab

CVE-2025-29927 Lab Minimal reproduction lab for CVE-2025-29927 — Next.js middleware authorization bypass CVSS 9.1. Companion to: N-Day Analysis writeup on Medium What this is A Next.js 15.2.2 app vulnerable with a cookie-gated /dashboard route. The middleware auth check can be bypassed by sending...

CVE-2026-47423-dompurify-xss-detector

DOMPurify re-clone logic flaw. Instead of relying on easily stripped source comments or version variables, this tool performs logic fingerprinting on minified production JavaScript bundles to identify unpatched allowed-tag layouts. Vulnerability Summary In DOMPurify versions up to 3.4.4, the...

thm-ice-icecast-rce-privesc

TryHackMe — Ice: Icecast 2.0.1 RCE & Windows Privilege Escalation Platform: TryHackMe Target OS: Windows 7 / Windows Server 2008 R2 Difficulty: Easy Category: Buffer Overflow RCE, Local Privilege Escalation Summary This report documents the full compromise of the Ice machine on TryHackMe, from...

CVE-2026-67182-HTTP-Request-Smuggling-Enables-Front-End-Access-Control-Bypass-rouille-

Security Advisory: HTTP Request Smuggling Enables Front-End Access Control Bypass rouille Assigned CVE ID: CVE-2026-67182 Summary rouille::proxy::proxy and rouille::proxy::fullproxy copy client-supplied request header values into the upstream connection without checking them for control character...

PatchlessCLRLoader

PatchlessCLRLoader PatchlessCLRLoader is a fork of InlineExecute-Assembly to load .NET assembly and direct the output to mailslot. I rewrites it to a standalone loader with the following implementation: AES encryption payload Fileless payload support Patchless AMSI and ETW bypass using hardware...

sccm-http-looter

SCCM HTTP Looter How it works SCCM distribution points DPs are the servers used by Microsoft SCCM to host all the files used in software installs, patches, script deployments, etc. By default, these servers allow access via SMB TCP/445 and HTTP/S TCP/80 and/or TCP/443 and require some type of...

Improper Authorization

Spring Framework is vulnerable to Improper Authorization. The vulnerability is due to a header predicate bypass in pre-flight requests for WebFlux functional endpoints deployed with DispatcherServlet, allowing an attacker to bypass intended header-based restrictions...

mariadb-13-rce-lab

MariaDB 13.0.1-rc RCE Lab Remote code execution on the unmodified, stock MariaDB 13.0.1-rc Docker image as uid 999 mysql. Two exploit variants: Variant| File| Requirements| Notes ---|---|---|--- Pure SQL recommended| exploitpuresql.py| a low-priv MariaDB account + TCP| no host access, no docker, ...

Voidgate

VOIDGATE Description: A technique that can be used to bypass AV/EDR memory scanners. This can be used to hide well-known and detected shellcodes such as msfvenom by performing on-the-fly decryption of individual encrypted assembly instructions, thus rendering memory scanners useless for that...

CVE-2024-2473

CVE-2024-2473 — WPS Hide Login Page Identifier A professional Python scanner to detect Login Page Disclosure in WordPress sites running WPS Hide Login ≤ 1.9.15.2 Coded byVenexy Table of Contents Overview Vulnerability Details How It Works Requirements Installation Usage Output Example Disclaimer...

CVE-2026-11104-Python-SSTI-via-Jinja2-attr-Filter-Bypass

CVE-2026-11104 – Python SSTI via Jinja2 |attr Filter Bypass Program Code Flask root@kitploit: vulnerableapp.py - Flask with Jinja2 SSTI via 'attr' filter from flask import Flask, request, rendertemplatestring app = Flaskname @app.route'/' def index: name = request.args.get'name', 'World' UNSAFE:...

prefetch-tool

Herramienta de Prefetch KASLR para Windows Una herramienta de prueba de concepto para evadir KASLR ASLR del kernel en Windows 11. Inspirada en EntryBleed para Linux. Esta herramienta fue desarrollada como parte de un exploit dirigido a Windows 11 24H2. No soy un experto en canales laterales en...

CVE-2026-11103-GraphQL-Batching-Alias-Rate-Limit-Bypass

3. CVE-2026-11103 – GraphQL Batching Alias Rate Limit Bypass Program Code Node.js + Python Exploit root@kitploit: // graphqlratelimitserver.js - GraphQL with naive rate limiter const express = require'express'; const graphqlHTTP = require'express-graphql'; const buildSchema = require'graphql';...

IronSharpPack

IronSharpPack IronSharpPack is a repo of popular C projects that have been embedded into IronPython scripts that execute an AMSI bypass and then reflective load the C project. IronPython and the DLR have very little, if any, instrumentation that makes it an effective language for the execution of...

ICMPTunnel

icmptunnel is a tool to tunnel IP traffic within ICMP echo request and response ping packets. It’s intended for bypassing firewalls in a semi-covert way, for example when pivoting inside a network where ping is allowed. It might also be useful for egress from a corporate network to the Internet,...

FastJsonAutoTypeBypass

What's this This project is used for studying how to bypass fastJSON AutoType check. Gadget Info Mapping just for fastjson 1.2.47: root@kitploit: package com.FastJson1242; import com.alibaba.fastjson.JSONObject; public class Poc public static void mainString argv String payload ="\n" + " "a": \n"...

JEP290Test

JEP290Test Bypass JEP290 Test...

Christmas

Maldev Academy Maldev Academy Home Maldev Academy Syllabus Christmas Implementing an injection method mentioned by @Hexacorn. This PoC creates multiple processes, where each process performs a specific task as part of the injection operation. Each child process will spawn another process and pass...

otp-bot

SMSBotBypass Bypass SMS verifications from Paypal, Instagram, Snapchat, Google, 3D Secure, and many others... using a Discord Bot or the private API. It's really simple. Imagine that your friend got a Snapchat account, you try to reset his password using the sms system : he's gonna receive the sm...

SMSBotBypass

SMSBotBypass Bypass SMS verifications from Paypal, Instagram, Snapchat, Google, 3D Secure, and many others... using a Discord Bot or the private API. It's really simple. Imagine that your friend got a Snapchat account, you try to reset his password using the sms system : he's gonna receive the sm...