Python-Rootkit

python-rootkit This is a full undetectable python RAT which can bypass almost all antivirus and open a backdoor inside any windows machine which will establish a reverse https Metasploit connection to your listening machine. ViRu5 life cycle Bypass all anti-virus. Inject a malicius powershell...

CLEANSTART-2026-SP65833 Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a...

CVE-2026-35191 affects multiple packages. Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection...

CLEANSTART-2026-ER85100 When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details...

CLEANSTART-2026-UE71064 HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. See references f...

CVE-2021-3456

CVE-2021-3456 A practical chain that starts with an innocuous PDF file and ends up in a reverse shell on an AWS EC2 instance The Beginning: Crafting a PDF Payload It all begins on the front end of the attack. Using PowerShell’s built‑in WScript object we embed a script inside a PDF that will be...

Malicious code in zzhelloworld_socktest (RubyGems)

Source: amazon-inspector 4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f On require "zzhelloworldsocktest", the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768, reopens STDIN, STDOUT, and STDERR onto that socket, and exec...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

CVE-2026-33829-Writeup

CVE-2026-33829-Writeup Vulnerability Case Study: CVE-2026-33829 Windows Snipping Tool NTLM Coercion Executive Summary This write-up details the technical replication of CVE-2026-33829 , an information disclosure vulnerability within the modern Windows Snipping Tool application framework. By abusi...

azazel

Azazel V 0.1 The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin. -- 1 Enoch 2:8 Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily...

opensnitch

Join the project community on our server! OpenSnitch is a GNU/Linux application firewall. •• Key Features • Download • Installation • Usage examples • In the press •• Key features Interactive outbound connections filtering. Block ads, trackers or malware domains system wide. Ability to configure...

wotop

Web-On-Top-Of-Protocol WOTOP ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introduction WOTOP is a tool meant to...

Reproducing-ConnMan-1.34

Connection Manager Copyright C 2007-2012 Intel Corporation. All rights reserved. Functionality and features The following features are built-in into Connection Manager: - Generic plugin infrastructure - Device and network abstraction with basic storage support - IPv4, IPv4-LL link-local and DHCP...

ssj

SSJ - Your everyday Linux distribution gone Super Saiyan. Introduction SSJ is a silly little script that makes use of Docker installed on your everyday Linux distribution Ubuntu, Debian, etc. and magically arms it with hundreds of penetration testing and forensic tools. Technical Details SSJ pull...

challack

Proof-of-concept code for CVE-2016-5696 This code currently allows reseting connections or injecting into sessions. The attack is implemented against both clients and servers. For detailed information, consult the original publication: Off-Path TCP Exploits: Global Rate Limit Considered Dangerous...

CVE-2018-19629

CVE-2018-19629 Test Environment Docker test environment for CVE-2018-19629 - Hyland Perceptive Content Server Denial of Service. Vulnerability Details Field| Value ---|--- CVE ID| CVE-2018-19629 Severity| High DoS Affected Versions| Hyland Perceptive Content Server 7.1.5 Patched Version| 7.1.5...

CVE-2018-6537.RCE

CVE-2018-6537 The exploit targets Sync Breeze running on Windows 10 x86, build: 16299 , affecting version 10.4.18 , where an unauthenticated attacker can perform a SEH overflow via a TCP-connection, resulting in remote code execution. This exploit assumes all security mitigations are disabled e.g...

RDP-Guard

RDP Guard RDP Guard monitors failed RDP sign-in attempts in the Windows Security log and blocks abusive remote IP addresses through Windows Firewall. Defaults Event ID: 4625 LogonType: 3 or 10 Threshold: 3 or more audit failures Check interval: 15 minutes Firewall rule name:...

spybrowse

BrowseSpy Be sure to change the ftp variables throughout the code, these variables contain the username, password, & IP address of the FTP server which receives the files. This code will do the following: 1. Copy itself into the %TMP% directory & name itself ursakta.exe 2. Add a registry entry to...

quicmap

quicmap Pretty fast QUIC service scanner quicmap is a relatively fast QUIC service scanner that removes the need to use multiple tools to identify QUIC services, protocol version in use as well as supported ALPN's. Main features Scan arbitrary hosts, IP addresses, networks and ports and identify...

CVE-2026-0257-PoC

CVE-2026-0257 — PAN-OS GlobalProtect Authentication Bypass Remote Detection PoC Detection only. No exploitation. No credentials submitted. No cookies forged. Overview CVE-2026-0257 is an authentication bypass vulnerability CWE-565 — Reliance on Cookies without Validation and Integrity Checking in...