git-fsmonitor

This is a documented known issue, but I found this during my research & its pretty useful for RT/PT. Summary: The FSMonitor helper is executed by git on every command like git status, git diff, etc., hence git will blindly launch whatever path we specfic there. Our IDEs runs git status...

CVE-2026-71490 OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...

CVE-2026-71490

In versions of OPNsense prior to 26.1.11 , a flaw in OPNsense\Core\ACL::hasPrivilege() allows users to bypass MVC read-only write protection . The root cause is that directly assigned comma-separated values are appended as a single string and evaluated using an exact comparison when checking use...

EUVD-2026-102140

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...

redis-exploitation

redis-exploitation CONFIG SET For educational purposes only Build $ docker build -t victim . Run $ docker run -d --name victim victim Attack $ docker exec -it victim bash root@34ea33cb2eb2 / ls /var/spool/cron/ root@34ea33cb2eb2 / redis-cli 127.0.0.1:6379 config set dir /var/spool/cron/ OK...

hikvision_CVE-2017-7921_auth_bypass_config_decryptor

hikvisionCVE-2017-7921authbypassconfigdecryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921. https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0876.html/ Description Hikvision IP Cameras Authentication Bypass...

dotclaude-security

dotclaude-security Scan a repo's local .claude/ config — settings.json hooks, MCP server defs, env blocks, permissions.allow — for the RCE and API-key-exfiltration footguns that fire the moment you git clone and open an untrusted repository in Claude Code. It points at the exact dangerous line so...

CVE-2023-0386

CVE-2023-0386 gcc -Wall exp.c pkg-config fuse --cflags --libs -o exp ./exp /tmp...

sysmon-config

sysmon-config | A Sysmon configuration file This is a forked and modified version of @SwiftOnSecurity's sysmon config. It started as a is simply copy of the original repository. We merged most of the 30+ open pull requests. Thus we have fixed many of the issues that are still present in the...

lk_scraper

LinkedIn Scraper Scrapes Any LinkedIn Data Installation $ pip install git+git://github.com/jqueguiner/lkscraper Setup Using Docker compose $ docker-compose up -d $ docker-compose run lkscraper python3 Using Docker only for Selenium server First, you need to run a Selenium server $ docker run -d -...

kube-knark

Kube-Knark Project Trace your kubernetes runtime !! Kube-Knark is an open-source tracer that uses pcap & ebpf technology to perform runtime tracing on a deployed Kubernetes cluster. It is tracing the Kubernetes API execution and master node configuration files permission changes. The trace matchi...

claudleak

claudleak Scans public GitHub repositories for leaked credentials in AI coding tool configuration files .claude/, .cursor/, .continue/, .codex/, CLAUDE.md, AGENTS.md, etc.. Uses TruffleHog for secret detection. Example .claude/ directory: "permissions": "allow": "Bashgo build:",...

cve-2025-24514

🔥 CVE-2025-24514 Remote Vulnerability Check PoC This script is a Python-based PoC that can remotely check for the CVE-2025-24514 vulnerability NGINX configuration manipulation and potential RCE through auth-url injection in ingress-nginx. 🧠 Vulnerability Overview CVE-2025-24514 is a vulnerability...

spybrowse

BrowseSpy Be sure to change the ftp variables throughout the code, these variables contain the username, password, & IP address of the FTP server which receives the files. This code will do the following: 1. Copy itself into the %TMP% directory & name itself ursakta.exe 2. Add a registry entry to...

lssh

lssh ls + ssh = lssh lssh is a terminal-native remote access suite for SSH workflows, cloud inventories, and provider-backed connectors. It lets you select hosts from OpenSSH config, lssh config, or provider inventories, then operate them through native SSH or connector backends such as AWS SSM,...

CVE-2025-60787-Detection-motionEye-RCE-via-Config-Injection

README.md CVE-2025-60787 Detection: motionEye RCE via Config Injection Unauthenticated Remote Code Execution in motionEye Still Images - Image File Name Example PoC payload: $touch /tmp/test.%Y-%m-%d-%H-%M-%S When motion restarts, the shell command executes and creates /tmp/test. Detection Covera...

ingressNightmare-CVE-2025-1974-exps

Ingress Nightmare CVE-2025-1907 Description This vulnerability allows remote attackers to execute arbitrary code on affected installations of kubernetes/ingress-nginx. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HTTP requests. It i...

keepass_CVE-2023-24055_yara_rule

keepassCVE-2023-24055yararule Contains a simple yara rule to hunt for possible compromised KeePass config files How-to Use a yara rule scanner, like yara, loki or thor-lite to scan systems with this rule. The default location for the local KeePass config file is...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

CaddySmith

CaddySmith CaddySmith is a small Python script that reads a Cobalt Strike or Sliver C2 profile and forges a Caddy web server config out of it. The generated Caddyfile turns a regular Linux box into a redirector: legitimate beacon traffic gets reverse-proxied to your team server, and anything else...