jwt-hack

JSON Web Token Hack Toolkit A high-performance toolkit for testing, analyzing and attacking JSON Web Tokens. Installation Cargo root@kitploit: cargo install jwt-hack Homebrew root@kitploit: brew install jwt-hack Snapcraft Ubuntu root@kitploit: sudo snap install jwt-hack From source root@kitploit:...

xssor2

XSS'OR XSS'OR - 使用 JavaScript 进行黑客攻击。 在线 你可以试试： https://xssor.io 和 http://xssor.io/ 它包含三大模块：Encode/Decode、Codz、Probe。 安装 Python 3 搭配 Django 3.0. 或 Python 2 搭配 Django 1.11. git clone https://github.com/evilcos/xssor2 或直接下载 cd xssor2 修改 xssor/payload/probe.js root@kitploit: xssor.cmdurl =...

pythem

pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...

CVE-2025-54322

CVE-2025-54322 - XSpeeder SXZOS 预认证 RCE 扫描器 一个针对 CVE-2025-54322 的多线程漏洞扫描器，该漏洞是 XSpeeder SXZOS 固件中的未认证远程代码执行漏洞，影响全球约 70,000+ 台主机。 📋 目录 关于漏洞 功能特性 安装 使用方法 输出 免责声明 致谢 作者 🔍 关于漏洞 CVE-2025-54322 是 XSpeeder SXZOS 固件中发现的一个严重预认证远程代码执行漏洞，该固件用于 SD-WAN 设备、路由器和边缘网络设备。 漏洞详情 CVE ID ：CVE-2025-54322 供应商...

the-book-of-secret-knowledge

"知识就是力量，请谨慎使用！ " 一系列鼓舞人心的清单、手册、速查表、博客、黑客技巧、一行命令、CLI/Web 工具等。 📔 它是什么？ 这个仓库是我日常工作中使用的各种材料和工具的合集。它汇集了大量有用的信息，是一个宝贵的知识来源，我经常翻阅。 🚻 适合谁？ 实际上适合所有人。每个人都能在这里找到自己感兴趣的内容。但坦白说，它主要面向系统和网络管理员、DevOps、渗透测试人员以及安全研究人员。 ℹ️ 贡献 如果你发现任何不合理或不对劲的地方，请提交一个 pull request，并附上有效且理由充分的解释或评论。 本项目有一些简单的规则： 友好且清晰 不令人疲倦 有用...

CVE-2020-5844

CVE-2020-5844 PandoraFMS 7.0-NG 742 中的认证远程代码执行漏洞 拥有管理员权限的攻击者可以上传恶意的PHP文档。通过解码base64文件位置，用户可以获得一个以apache用户身份运行的shell。 由 TheCyberGeek 发现 PoC Python 脚本 root@kitploit: 用法：python3 CVE-2020-5844.py URL USER PASS PHPREVERSESHELL 示例：python3 CVE-2020-5844.py http://10.0.0.2/pandoraconsole admin pandora...

yaralyzer

THE YARALYZER Visually inspect all of the regex matches and their sexier, more cloak and dagger cousins, the YARA matches found in binary data and/or text. See what happens when you force various character encodings upon those matched bytes. With colors. Quick Start root@kitploit: pipx install...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

flask-session-cookie-manager

Flask Session Cookie Decoder/Encoder Original author : Wilson Sumanang Fixes and improvements author : Alexandre ZANNI Imported from saruberoz.github.io Depencencies Python 2 or Python 3 itsdangerous Flask Installation Package BlackArch Linux root@kitploit: pacman -S flask-session-cookie-manager3...

CVE-2024-38077-MadLicense-exploit

CVE-2024-38077 MadLicense - 完整利用框架 📚 演示技术文档 本文档解释框架的每个组件 、为什么存在 以及如何在现代 Windows 上利用堆缓冲区溢出 。 🎯 什么是 CVE-2024-38077？ 漏洞 Windows 远程桌面授权服务 lserver.exe 在 CDataCoding::DecodeData 函数中存在堆缓冲区溢出 。 root@kitploit: ┌─────────────────────────────────────────────────────────────┐ │ 漏洞：大小计算错误 │...

CVE-2022-3602

CVE−2022-3602 Qu'est-ce que c'est ? Ce document et ce référentiel sont une analyse de CVE−2022-3602, un problème de débordement de tampon punycode dans OpenSSL. Il s'agit d'un « anti-POC » le problème ne semble pas exploitable destiné aux personnes qui maintiennent leurs propres builds d'OpenSSL ...

CVE-2026-57228 Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split...

CVE-2026-57228

CVE-2026-57228 is a heap out-of-bounds read in the SMTP MIME quoted-printable decoder (src/util-decode-mime.c) of Suricata versions 7.0.13 through 7.0.17 . When a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte, Suricata reads one ...

CVE-2026-84447 libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS

libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeatedly decode the same base image because processedids is copied per branch and ImageItem::decodeimage has no shared operation budget. This vulnerability is fix...

CVE-2026-93560

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

CVE-2026-93560

A Denial of Service vulnerability exists in the Netty STOMP codec (io.netty/netty-codec-stomp). A remote, unauthenticated attacker can send a specially crafted STOMP frame whose content-length header exceeds the maximum integer value. The long-to-int truncation in the decoder causes an infinite d...

CVE-2026-93560 Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

EUVD-2026-82924

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

CVE-2026-93560

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...

CVE-2026-89059

RESTEasy's IIOImageProvider (in resteasy-core) decodes attacker-supplied image request bodies without enforcing any limit on declared image dimensions or pixel count. A remote, unauthenticated attacker over the network can send a small crafted image declaring enormous dimensions, triggering a ver...