rdpscan

rdpscan for CVE-2019-0708 bluekeep vuln This is a quick-and-dirty scanner for the CVE-2019-0708 vulnerability in Microsoft Remote Desktop. Right now, there are about 900,000 machines on the public Internet vulnerable to this vulnerability, so many are to expect a worm soon like WannaCry and...

DFSCoerce

DFSCoerce PoC per l'autenticazione forzata di MS-DFSNM utilizzando i metodi NetrDfsRemoveStdRoot e NetrDfsAddStdRoot scoperto da @xctde. Documentazione: https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-dfsnm/95a506a8-cae6-4c42-b19d-9c1ed1223979 Ispirato da: PetitPotam @topotam77...

CVE-2026-47837

Spring Cloud Config is affected by a Missing Authentication for Critical Function vulnerability in the Server's /monitor endpoint. Webhook requests sent to this endpoint are not properly validated, meaning an authenticated user (Privileges Required: HIGH ) can send crafted webhook requests that c...

EUVD-2026-66638

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

CVE-2026-47837 Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests

Missing Authentication for Critical Function vulnerability in Spring Spring Cloud Config allows Webhook requests to Spring Cloud Config Server's /monitor endpoint are not validated. This issue affects Spring Cloud Config: from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2....

github-search

github-search Una raccolta di strumenti per eseguire ricerche su GitHub. Installazione root@kitploit: git clone https://github.com/gwen001/github-search cd github-search pip3 install -r requirements.txt La maggior parte delle volte GitHub richiede un token per eseguire ricerche. Puoi creare un fi...

CVE-2026-16599

A flaw was found in wget's FTP OPIE/S-KEY authentication functionality. A malicious FTP server or a network attacker can send a specially crafted OPIE challenge. This challenge contains a sequence number that, when processed by wget, can lead to an excessive number of cryptographic computations...

certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

ncrack

ncrack Ncrack è uno strumento di cracking dell'autenticazione di rete ad alta velocità. È stato costruito per aiutare le aziende a proteggere le proprie reti testando proattivamente tutti i loro host e dispositivi di rete per password deboli. Anche i professionisti della sicurezza si affidano a...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

kubebox

= Kubebox small^⎈❏^ Antonin Stefanutti https://github.com/astefanutti@astefanutti // Meta :description: Terminal- und Web-Konsole für Kubernetes // Settings :idprefix: :idseparator: - :experimental: // Aliases ifdef::env-github :note-caption: ℹ️ :icon-check: ✔️ :icon-edit: ✏️ endif::...

freeradius-server

Il server FreeRADIUS Introduzione Il progetto FreeRADIUS Server è un server di policy multi-protocollo ad alte prestazioni e altamente configurabile, che supporta RADIUS, DHCPv4, DHCPv6, DNS, TACACS+ e VMPS. È disponibile secondo i termini della GNU GPLv2. L'uso di RADIUS consente di centralizzar...

cve-2026-41940-PoC

CVE-2026-41940 ⚠ Questo strumento è creato esclusivamente a scopo educativo o di bug bounty. L'uso non autorizzato al di fuori di ambienti controllati è severamente vietato. Descrizione Uno strumento per sfruttare CVE-2026-41940, un bypass critico dell'autenticazione in cPanel & WHM CVSS 10.0, ch...

PetitPotam

PetitPotam Strumento PoC per costringere host Windows ad autenticarsi verso altre macchine tramite MS-EFSRPC EfsRpcOpenFileRaw o altre funzioni : Gli strumenti utilizzano la named pipe LSARPC con interfaccia c681d488-d850-11d0-8c52-00c04fd90f7e perché è più diffusa. Ma è possibile attivarlo anche...

CVE-2020-1472

Script di test ZeroLogon Uno script Python che utilizza la libreria Impacket per testare la vulnerabilità relativa all'exploit Zerologon CVE-2020-1472. Tenta di effettuare il bypass dell'autenticazione Netlogon. Lo script terminerà immediatamente quando il bypass viene eseguito con successo, senz...

evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

evilginx2

Evilginx 3.0 Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server...

howdy

Howdy bietet eine Windows Hello™-ähnliche Authentifizierung für Linux. Nutzen Sie Ihre eingebauten IR-Emitter und Kamera in Kombination mit Gesichtserkennung, um Ihre Identität zu bestätigen. Dank des zentralen Authentifizierungssystems PAM funktioniert dies überall dort, wo Sie sonst Ihr Passwor...

fail2ban

root@kitploit: / | | | | / | | |/ /| ' / | ' \ || ,||/|./,|||| v1.1.0.dev1 20??/??/?? Fail2Ban: ban hosts that cause multiple authentication errors Fail2Ban scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system...

CVE-2026-81032

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...