extended-ssrf-search

Extended ssrf search This tool search for SSRF using predefined settings in different parts of a request path, host, headers, post and get parameters. First step Rename example.app-settings.conf to app-settings.conf and adjust settings. The most important setting is the callback url. I recommend ...

CVE-2007-2447

CVE-2007-2447 Saikat Karmakar | Oct 14 : 2022 Usage: root@kitploit: python3 exploit-smb-3.0.20.py -lh -lp -t requirements root@kitploit: pysmb argparse P.S. I'm not the author of this cve. I barely had a computer when this cve was created. I tried to create am automated script to exploit...

CVE-2021-44228-log4jVulnScanner-metasploit

CVE-2021-44228-log4jVulnScanner-metasploit open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability preparation POC root@kitploit: git clone https://github.com/TaroballzChen/CVE-2021-44228-log4jVulnScanner-metasploit cd...

log4j_checker

Log4jchecker.py CVE-2021-44228 Description This Python3 script tries to look for servers vulnerable to CVE-2021-44228, also known as Log4Shell, a very critical vulnerability found in Log4j2 Java logging library. It doesn't rely on external DNS log servers to verify and validate the vulnerable...

Nim-RunPE

Nim-RunPE A Nim implementation of reflective PE-Loading from memory. The base for this code was taken from RunPE-In-Memory - which I ported to Nim. You'll need to install the following dependencies: nimble install ptrmath winim I did test this with Nim Version 1.6.2 only, so use that version for...

CVE-2020-15227

CVE-2020-15227 DISCLAIMER! I take no responsibility of using it in wild life environment so please do NOT do it. This thingy is just to demonstrate and for test things for sysadmins I made this exploit according to publishing a CVE of David Grudl The founder of Nette foundation as he did not solv...

CVE-2026-64638-XSS-to-Shell-PoC

CVE-2026-64638 — XSS2Shell Proof of Concept A proof-of-concept PoC tool for validating CVE-2026-64638 , a pre-authentication reflected Cross-Site Scripting XSS vulnerability affecting WordPress installations versions 6.4 – 7.0.2. Overview This tool automates the process of fingerprinting,...

CVE-2026-49176_LPE_POC

CVE-2026-49176 SYSTEM Shell PoC Local privilege-escalation proof of concept for the Windows WalletService vulnerability fixed in July 2026. Technical write-up: CVE-2026-49176 Exploit Development: WalletService to SYSTEM. A standard user creates a Wallet ESE database containing a persisted callbac...

ddoor

ddoor cross platform backdoor using dns txt records What is ddor? ddor is a cross platform light weight backdoor that uses txt records to execute commands on infected machines. Features Allows a single txt record to have seperate commands for both linux and windows machines List of around 10 publ...

LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/loadcontentviaajax which allows arbitrary callback execution of...

PHPJabbers Callback Widget v1.0 - Cross-Site Scripting

There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0. id: CVE-2023-40755 info: name: PHPJabbers Callback Widget v1.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site Scripting...

wnfexec

Overview WnfExec is a C proof of concept library that injects shellcode into a process by hijacking a WNF subscription callback then triggering a state change. There's nothing novel here and was built based on the research of others. My intent was to solidfy the concept in my head, document the...

log4shell-tools

log4shell.tools log4shell.tools è uno strumento che ti consente di eseguire un test per verificare se una delle tue applicazioni è interessata dalle recenti vulnerabilità di log4j: CVE-2021-44228 e CVE-2021-45046. Questo è il codice che fa funzionare https://log4shell.alexbakker.me. Se desideri...

DarkLoadLibrary

DarkLoadLibrary LoadLibrary per operazioni offensive. Come funziona? https://www.mdsec.co.uk/2021/06/bypassing-image-load-kernel-callbacks/ Utilizzo root@kitploit: DARKMODULE DarkModule = DarkLoadLibrary LOADLOCALFILE, // control flags L"TestDLL.dll", // local dll path, if loading from disk NULL,...

log4j-scan

log4j-scan Uno scanner completamente automatizzato, accurato ed estensivo per trovare host vulnerabili a log4j Caratteristiche Supporto per liste di URL. Fuzzing su oltre 60 intestazioni delle richieste HTTP non solo 3-4 intestazioni come negli strumenti visti in precedenza. Fuzzing sui parametri...

ProcessInjection

ProcessInjection Il programma è progettato per eseguire l'iniezione di processi. Attualmente lo strumento supporta 5 tecniche di iniezione di processi. root@kitploit: 1 Vanilla Process Injection 2 DLL Injection 3 Process Hollowing 4 APC Queue 5 KernelCallbackTable Injection Lo strumento accetta...

herpaderping

Process Herpaderping Process Herpaderping is a method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself. Summary Generally, a security product takes action on process...

herpaderping

Process Herpaderping Process Herpaderping è un metodo per oscurare le intenzioni di un processo modificando il contenuto su disco dopo che l'immagine è stata mappata. Ciò risulta in un comportamento curioso da parte dei prodotti di sicurezza e del sistema operativo stesso. Sommario Generalmente, ...

RemoteTLSCallbackInjection

Maldev Academy - RemoteTLSCallbackInjection Collegamenti rapidi Maldev Academy Home Programma di Maldev Academy Moduli correlati di Maldev Academy Nuovo Modulo 34: Callback TLS per Anti-Debugging Nuovo Modulo 35: Threadless Injection Panoramica Questo metodo utilizza i callback TLS per eseguire u...

CVE-2021-1732

CVE-2021-1732 La vulnerabilità si verifica in una mancanza di sincronizzazione tra l'allocazione di memoria nella callback del kernel in modalità utente e l'impostazione dell'attributo tagWND-flag nella funzione win32kfull!NtUserCreateWindowEx del driver grafico Windows. Ciò consente di falsifica...