4119 matches found
Anvil
Runtime-first privilege escalation and attack surface assessment for Windows thick clients. Anvil is a runtime-first privilege escalation and attack surface assessment tool for Windows thick client applications. Rather than scanning the filesystem blindly, it pairs Procmon capture with Windows...
clients
Bitwarden Client Applications This repository houses all Bitwarden client applications except the mobile applications iOS | android. Please refer to the Clients section of the Contributing Documentation for build instructions, recommended tooling, code style tips, and lots of other great...
ThunderDNS
ThunderDNS This tool can forward TCP traffic over DNS protocol. Non-compile clients + socks5 support. Run Setting up NS records on our domain: Please wait for clearing DNS-cache. Simple server run: python3 ./server.py --domain oversec.ru Simple server run Dockerfile: docker run -e DOMAIN='' Simpl...
heimdall_webserver
ATTENTION, this project is on a beta version, there's a lot of bugs and problem, if you want to help the project use this on a lab not in yout real environment. NO, there's not https implemented yet, it will come on the next upgrade Heimdall It's a tool to manage vulnerables packages in your nix...
CVE-2025-55580
CVE-2025-55580 - SolidInvoice Stored Cross-Site Scripting XSS in Clients Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Client Module. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users' browsers...
msmap
MSMAP Msmap is a Memory WebShell Generator. Compatible with various Containers, Components, Encoder, WebShell / Proxy / Killer and Management Clients. ็ฎไฝไธญๆ The idea behind I, The idea behind II, The idea behind III Feature WIP Function Dynamic Menu Automatic Compilation Generate Script Lite Mode...
aura-botnet
Aura Botnet C2 Server The botnet's C2 server utilizes the Django framework as the backend. It is far from the most efficient web server, but this is offset by the following: Django is extremely portable and therefore good for testing/educational purposes. The server and database are contained...
SMBetray
SMBetray Version 1.0.0. This tool is a PoC to demonstrate the ability of an attacker to intercept and modify insecure SMB connections, as well as compromise some secured SMB connections if credentials are known. Background Released at Defcon26 at "SMBetray - Backdooring and Breaking Signatures" I...
CVE-2023-36874
CVE-2023-36874 For demonstration purposes only. Exploit works on vulnerable Windows clients/servers. Compile code and create c:\test\system32 directories. Place your wermgr.exe in that directory and run compiled PoC...
boringssl
BoringSSL BoringSSL is a fork of OpenSSL that is designed to meet Google's needs. Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no...
byob
Questions? Check out the docs or join our Discord support server Disclaimer : This project should be used for authorized testing or educational purposes only. BYOB is an open-source post-exploitation framework for students, researchers and developers. It includes features such as: Command & contr...
CVE-2026-108362
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence...
CVE-2026-108361
The Privasys Remote Attestation TLS Clients (specifically Privasys/ra-tls-clients ) is vulnerable to a Time-of-Check Time-of-Use (TOCTOU) race condition in versions before 0.9.1 . An attacker with local access can modify workload code, data, and configuration at runtime after a successful connect...
CVE-2026-108362
Privasys Remote Attestation TLS Clients versions prior to 0.11.0 are vulnerable to a diversion attack due to an Origin Validation Error (CWE-346). The software fails to require an explicitly authorized platform identity, meaning it accepts TEE attestation evidence from any unrevoked platform. A n...
EUVD-2026-97681
Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with apitoken set to an env reference via /config/dump to read SECRETK...
CVE-2020-27955-LFS
Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...
CVE-2026-109082
A flaw in the keycloak-services component of Keycloak affects the Client-Initiated Backchannel Authentication (CIBA) implementation. The root cause is a failure to verify that a client is authorized to use the CIBA flow, which allows public clients to bypass security requirements. An attacker cou...
NachoVPN
NachoVPN ๐ฎ๐ NachoVPN is a Proof of Concept that demonstrates exploitation of SSL-VPN clients, using a rogue VPN server. It uses a plugin-based architecture so that support for additional SSL-VPN products can be contributed by the community. It currently supports various popular corporate VPN...
PT-2026-109666
Name of the Vulnerable Software and Affected Versions openapi-typescript-codegen versions prior to 0.31.1 Description Code injection occurs when the software processes an OpenAPI document containing unescaped values interpolated into single-quoted string literals. An attacker controlling the...
CVE-2026-108269
Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before...