ics-forensics-tools

ICSpector: Microsoft ICS Forensics Framework Microsoft ICS Forensics Tools framework is an open-source forensics framework that enables the analysis of Industrial PLC metadata and project files. The framework provides investigators with a convenient way to scan for PLCs and identify any suspiciou...

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

NoArgs

NoArgs: Manipulating and Hiding Process Arguments Twitter: @AzizWho Disclaimer: Educational Use Only This tool is intended solely for educational purposes. I am not liable for any misuse and all users must adhere to applicable laws. Illegal use is prohibited. Introduction NoArgs is a tool designe...

CVE-2021-4034-POC

CREDITS VULNERABILITY AUTHOR: https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/pwnkit-local-privilege-escalation-vulnerability-discovered-in-polkits-pkexec-cve-2021-4034 Reference https://github.com/arthepsy/CVE-2021-4034/blob/main/cve-2021-4034-poc.c...

CVE-2023-3079

Exploit for CVE-2023-3079 Shoutout to @clem1 for finding the ITW exploit. Shoutout to @alisaesage for her prior RCA on the bug. Shoutout to @buptsb for his notes on the bug. Resources Writeups and other resources. https://issues.chromium.org/issues/40065138...

BRC4-BOF-Artillery

Generic This repository includes a collection of generic BOFs I wrote over a period of time. This repository solely focuses on porting and execution, without modifying the original source for stability. While I may conduct further testing in the future, this is not officially supported. Contact...

CVE-2018-20162-digi-lr54-restricted-shell-escape

layout: post title: "CVE-2018-20162: Digi TransPort LR54 Restricted Shell Escape" author: sgo category: security The Digi TransPort LR54 is a high speed LTE router commonly used by industry, infrastructure, retail and public transportation. It supports running python scripts in a restricted...

CVE-2024-24576.jl

CVE-2024-24576 PoC in Julia λ julia main.jl Enter arguments: hello Output: Argument received: hello λ julia main.jl Enter arguments: hello & whoami Output: Argument received: "hello & whoami" λ julia main.jl Enter arguments: hello" & whoami Output: Argument received: "hello" desktop-9zk7mal\lpn...

log4j-log4shell-playground

About A playground for poking at the critical log4j aka Log4Shell CVE-2021-44228 vulnerability mitigations. This particular problem lies within the JndiLookup feature and the log4j ability to interpret ALL the arguments of a logging call. I would expect it to only interpret the format message the...

CVE-2018-6789-Python3

CVE-2018-6789 Exim 4.90.1 RCE Vulnerability Exim 4.90.1 RCE Vulnerability remake for Python3 with arguments passed from CLI Usage: python3 exim.py -t localhost -p 25 -lh 192.168.0.159 -lp 1337...

CVE-2024-23742

CVE-2024-23742 An issue in Loom through 0.196.1 on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. With this tool, we can check if the App is Vulnerable: After validation, we can inject our code, and get a shell Enjoy Your She...

CVE-2024-28085

Wall-Escape CVE-2024-28085 The util-linux wall command does not filter escape sequences from command line arguments. The vulnerable code was introduced in commit cdd3cc7fa4 2013. Every version since has been vulnerable. A full report can be found here. I have nicknamed this bug "WallEscape". This...

Xjar_tips

Xjartips Introduction: Spring Boot JAR 安全加密运行工具, 同时支持的原生JAR. 基于对JAR包内资源的加密以及拓展ClassLoader来构建的一套程序加密启动, 动态解密运行的方案, 避免源码泄露以及反编译. 功能特性 无代码侵入, 只需要把编译好的JAR包通过工具加密即可. 完全内存解密, 降低源码以及字节码泄露或反编译的风险. 支持所有JDK内置加解密算法. 可选择需要加解密的字节码或其他资源文件. 支持Maven插件, 加密更加便捷. 动态生成Go启动器, 保护密码不泄露. 其中xjar...

CVE-2024-4577

This is POC of CVE 2024-4577 This exploit allows attacker to perform RCE in PHP Versions such as PHP 8.3 8.3.8 PHP 8.2 8.2.20 PHP 8.1 8.1.29 Arguments you can check from code! To read more about this particular exploit check nist.gov...

CVE-2026-119146

A flaw was found in ProFTPD. A remote, potentially unauthenticated attacker can trigger a buffer overflow in the modrewrite module by sending File Transfer Protocol FTP command arguments that exceed the internal buffer length. Successful exploitation corrupts session memory and terminates the...

dumpscan

Public development on this tool has been paused but is still being worked on privately. Expect a massive update Q3/Q4 2024. Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3. Features x509...

CVE-2026-110507 Page Builder by SiteOrigin < 2.38.0 - Contributor+ Sensitive Data Disclosure via Post Loop Widget Query Arguments

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft,...

CVE-2026-110507

The Page Builder by SiteOrigin WordPress plugin (versions before 2.38.0 ) is vulnerable to a sensitive data disclosure due to improper restriction of query arguments in its Post Loop widget . The root cause is that the plugin fails to limit the loop to posts the user is authorized to view. This a...

CVE-2026-110879 jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...