log4shellpoc

Simple Spring Boot application vulnerable to CVE-2021-44228 Log4Shell This proof-of-concept application for CVE-2021-44228 a.k.a log4shell is a part of my writeup. For the complete exploit details, refer to the writeup. Instructions Run: root@kitploit: docker run --rm -p 8080:8080 --name...

android-hardware-attestation-demo

Android hardware attestation bypass — demo This repository accompanies a Quarkslab article on Android hardware Key Attestation and exists to illustrate it. It is a small, end-to-end proof of concept that shows a simple bypass: an analyst on a rooted phone defeats a backend's hardware attestation...

optee_ftpm

OP-TEE integration for the MS TPM 2.0 Reference Implementation fTPM fTPM TA The fTPM Trusted Application TA provides a secure firmware implementation of a TPM using the MS reference implementation. The platform specific integration code is kept in this repository. This is a fork from the the MS...

CVE-2022-34302

🕷️ CVE-2022-34302 - New Horizon Datasys Boot Loader Vulnerability New Horizon Datasys Reboot Restore Boot Loader - Bring Your Own Vulnerable UEFI Application BYOVUA - Secure Boot bypass via signed bootloader with built-in custom PE/COFF loader that loads unsigned UEFI applications. 📑 Table of...

ipxe

iPXE network bootloader iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as: boot from a web server via HTTP or HTTPS, boot from an iSCSI, FCoE, or AoE SAN, control the boot process with a script, create interactiv...

BareMetal-RAM-Dumper

BareMetal RAM Dumper Una herramienta bare-metal simple para x86 diseñada para arrancar desde un disco/USB y volcar la RAM del sistema directamente al medio de arranque. Se basa en interrupciones de BIOS para arrancar y realizar operaciones de disco, y entra en modo unreal para acceder a memoria p...

UEFI-Security-Research-Howyar-SysReturn-NetCopy

🌊 UEFI Security Research - Howyar SysReturn NetCopy Under the cloak of Secure Boot, some architectures sink deeper than the vulnerabilities that exposed them. Some binaries are revoked. Some patches are shipped. But deep below the surface, old habits leave traces. This is what remains when a...

cve-2026-22732-poc

CVE-2026-22732 — Proof of Concept Spring Security silently drops HTTP response security headers. Demo / educational use only; run it against nothing but this local app. | ---|--- CVE| CVE-2026-22732 CWE-425, published 2026-03-19 CVSS 3.1| 9.1 CRITICAL — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Direct...

Magisk

Este no es un producto compatible oficialmente por Google Introducción Magisk es un conjunto de software de código abierto para personalizar Android, compatible con dispositivos superiores a Android 6.0. Algunas características destacadas: MagiskSU : Proporciona acceso root para aplicaciones Magi...

MoveEdr

MoveEDR If you're admin you can force Windows to delete or move folders and files around immediately after booting before services are started. This can be used to disable EDRs. Usage !CAUTION There is an issue with CrowdStrike which results in a bootloop with the message "INACCESSIBLEBOOTDEVICE"...

kali-nethunter-installer

Kali NetHunter Installer This Kali NetHunter installer is basically just a zip file generated by build.py from the folder layout contained here. Follow the instructions below to create the Kali NetHunter installer zip. All you have to do is flash it through Recovery/TWRP or Magisk for a complete...

log4j2-exploit

Log4Shell CVE-2021-44228 proof of concept Requirement Java JDK/JRE 8 or later version curl exploitable Simple spring boot application that serves a login page with user and password. It logs the user name when POSTed to /. It is not required for the application to log any user provided input...

BlackLotus

BlackLotus BlackLotus es un innovador bootkit UEFI diseñado específicamente para Windows. Incorpora una omisión integrada de Secure Boot y protección Ring0/Kernel para prevenir cualquier intento de eliminación. Este software tiene el propósito de funcionar como un cargador HTTP. Gracias a su...

BitUnlocker

BitUnlocker Downgrade Attack A proof of concept for accessing BitLocker-encrypted disks in under 5 minutes on fully patched Windows 11 machines through a boot manager downgrade attack, leveraging the SDI vulnerability originally documented as CVE-2025-48804. The July 2025 patch fixes this in...

Super-UEFIinSecureBoot-Disk

Super UEFIinSecureBoot Disk Super UEFIinSecureBoot Disk es una prueba de concepto no mantenida ni mejorada activamente imagen de arranque con el cargador de arranque GRUB2 diseñada para ser utilizada como base para unidades flash USB de recuperación. Característica clave: el disco es completament...

incus-os

Introducción IncusOS es una imagen de SO inmutable dedicada a ejecutar Incus. Está basado en Debian 13 y construido usando mkosi. IncusOS puede instalarse en sistemas modernos amd64 x8664 y arm64. Esto tiene como objetivo proporcionar una forma muy rápida, segura y fiable de ejecutar un servidor...

cve-2016-1000027-poc

PoC for CVE-2016-1000027 This is a demo Spring Boolt application that is affected by CVE-2016-1000027. Steps to reproduce the vulnerability 1. Start a vulnerable server com.gypsyengineer.server.Server. 2. Run com.gypsyengineer.client.Exploit. The Exploit class reads payload.bin and sends it to th...

initroot

initroot: Motorola Bootloader Kernel Cmdline Injection Secure Boot & Device Locking Bypass CVE-2016-10277 By Roee Hay / Aleph Research, HCL Technologies First stage exploit: Tethered jailbreak This exploit gains an ephemeral unrestricted root access on the device. For example, on cedric some...

Crassus

Herramienta de descubrimiento de escalada de privilegios Crassus para Windows Inicio rápido 1. En Process Monitor, selecciona la opción Enable Boot Logging. 2. Reinicia. 3. Una vez que hayas iniciado sesión y Windows se haya estabilizado, ejecuta Process Monitor nuevamente. 4. Cuando se te...

CVE-2026-98135

The Linux kernel contains a vulnerability in the ntfs filesystem driver where the is_boot_sector_ntfs() function incorrectly accepts a value of 0 or other non-power-of-two counts for the sectors_per_cluster field in the boot sector. When a zero value is processed by parse_ntfs_boot_sector(), the ...