XLL_Phishing

XLLPhishing Introduction With Microsoft's recent announcement regarding the blocking of macros in documents originating from the internet email AND web download, attackers have began aggressively exploring other options to achieve user driven access UDA. There are several considerations to be...

RTTM

Real Time Threat Monitoring Tool V2.0 Monitoring possible threats of your company on Internet is an impossible task to be achieved manually. Hence many threats of the company goes unnoticed until it becomes viral in public. Thus causing monetary/reputation damage. This is where RTTM comes into...

PyLoggy

PyLoggy PyLoggy es un keylogger de Python simple y potente capaz de registrar pulsaciones de teclado, clics de ratón, tomar capturas de pantalla y más. La herramienta enviará los registros a tu correo electrónico cada minuto puedes cambiar esto. Instalación 1. Clónalo: git clone...

CVE-2023-28467

MyBB 1.8.33 User CP email persistent XSS root@kitploit: - MyBB 1.8.33 User CP email persistent XSS - Mybb version "@cve.com Solution Upgrade MyBB version 1.8.34 or higher...

CVE-2021-34646

CVE-2021-34646 PoC this vulnerability detail by NVD Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the processemailverification function due to a random token generation weakness in the resetandmailactivationlink...

HtmlSmuggling

HtmlSmuggling HTML smuggling is a malicious technique used by hackers to hide malware payloads in an encoded script in a specially crafted HTML attachment or web page. The malicious script decodes and deploys the payload on the targeted device when the victim opens/clicks the HTML attachment/link...

CVE-2022-40347_Intern-Record-System-phone-V1.0-SQL-Injection-Vulnerability-Unauthenticated

CVE-2022-40347: Intern Record System - 'phone', 'email', 'deptType' and 'name' SQL Injection Unauthenticated Exploit Title: Intern Record System - 'phone', 'email', 'deptType' and 'name' SQL Injection Unauthenticated Date: 2022-06-09 Exploit Author: Hamdi Sevben Vendor Homepage:...

PasteMonitor

PasteMonitor Scrape Pastebin API to collect daily pastes, setup a wordlist and be alerted by email when you have a match. Description The PasteMonitor tool allows you to perform two main actions for educational purposes only: Download daily new public pastes Average number of pastes per day:...

InSpy

InSpy ⛔ DEPRECATED. This repo is no longer being maintained. Introduction InSpy is a python based LinkedIn enumeration tool. Version 3.0 introduces the automation of domain and email retrieval in addition to randomized headers and xml output support. Installation Run pip install -r requirements.t...

CVE-2023-43770-PoC

CVE-2023-43770-PoC PoC for Stored XSS CVE-2023-43770 Vulnerability Description Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcubestringreplacer.php behavior. Attack Chain Crafted...

Scythe

Scythe scythe: account enumerator root@kitploit: Account Enumerator is designed to make it simple to perform account enumeration as part of security testing. The framework offers the ability to easily create new modules XML files and speed up the process of testing. This tool was created with 2...

CVE-2023-7028

CVE-2023-7028 Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde 16.1 hasta antes de 16.1.6, 16.2 hasta antes de 16.2.9, 16.3 hasta antes de 16.3.7, 16.4 hasta antes de 16.4.5, 16.5 hasta antes de 16.5.6, 16.6 hasta antes de 16.6.4 y 16.7 hasta antes de 16.7.2, e...

mailMeta

A forensic tool to make analysis of email headers easy to aid in the quick discovery of the attacker. Table of Contents About mailMeta Installation Usage Linux Windows Demo Contributions Inspiration FAQ License About mailMeta What is mailMeta? mailMeta is a python based forensic tool which reads...

Sinister

Sinister root@kitploit: Este pequeño script de Python puede hacer un trabajo realmente impresionante. Sinister es un generador de Keylogger para Windows/Linux, que envía registros de teclas y capturas de pantalla por correo electrónico junto con otra información jugosa de la víctima, escrito en...

domain-protect

domain-protect Domain Protect is now an OWASP project moved to: github.com/domain-protect/domain-protect...

CVE-2024-21413

CVE-2024-21413 - Expect Script POC Microsoft Outlook Leak credentials & Remote Code Execution Vulnerability when chained with CVE-2023-21716 through the preview panel CVSS:3.1 9.8 / 8.5 Outlook should warm you about the risk on opening an external link = but this is not the case! usage:...

CVE-2025-51411

🛡️ CVE Disclosure: CVE-2025-51411 — Reflected XSS in Institute-of-Current-Students Disclosure Date: 25 July 2025 CVE ID: CVE-2025-51411 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the Institute-of-Current-Students v1.0 project, specifically...

UhOh365

UhOh365 Un script que puede ver si una dirección de correo electrónico es válida en Office365. No realiza ningún intento de inicio de sesión, no tiene límite de velocidad y es increíblemente útil para evaluaciones de ingeniería social para encontrar qué correos existen y cuáles no. Microsoft no...

SOGo_web_mail-vulnerability-CVE-2025-50340

CVE-2025-50340: Insecure Direct Object Reference IDOR vulnerability in SOGo Webmail CVE ID: CVE-2025-50340 Reporter: Milad Seddigh Product: SOGo Affected Versions: v5.6.0 Impact: Insecure Direct Object Reference IDOR vulnerability → Allows the user to send emails on behalf of another user. Summar...

SpoofThatMail

SpoofThatMail Bash script to check if a domain or list of domains can be spoofed based in DMARC records File with domains One per line: root@kitploit: sh SpoofThatMail.sh -f domains.txt One single domain: root@kitploit: sh SpoofThatMail.sh -d domain...