hashcatch

hashcatch Hashcatch deauthenticates clients connected to all nearby WiFi networks and tries to capture the handshakes. It can be used in any linux device including Raspberry Pi and Nethunter devices so that you can capture handshakes while walking your dog Written by @SivaneshAshok PoC of hashcat...

cve-2023-45612_exploit

cve-2023-45612exploit CVE-2023-45612 is a high severty security probem that allows XXE XML eXternal Entity attacks on Ktor's XML serialization that has been patched in 2023. Reproduction of the security problem Below is a detailed way of how I reproduced the problem. IntelliJ IDEA project First, ...

Dorkwright

Dorkwright - Google Dorking Tool Dorkwright is a powerful Python-based Google dorking utility that automates the extraction of file links from Google search results and optionally downloads them. It uses Playwright for browser automation and includes CAPTCHA handling, progress indicators, and a...

vuln-chain-lab

File Upload Bypass + Stored XSS PoC Lab A deliberately vulnerable web application demonstrating how a file upload bypass chains with stored XSS to create backdoor admin accounts, even when CSP, CORS, and CSRF protections are in place. Full Blog Post: KurtiseBear Blog This is an educational lab fo...

CVE-2024-53677-POC

CVE-2024-53677 A kind old vulnerability that effect Apache Struts leading to LFI, and remote exection. more info about the vulnerability you can refer to this great blog. Apache Struts path traversal → RCE CVE-2024-53677 POC usage I have send much time make this as custamizable as possiable becau...

SharpNoPSExec

SharpNoPSExec File less command execution for lateral movement. SharpNoPSExec will query all services and randomly pick one with a start type disable or manual, the current status stopped and with LocalSystem privileges to reuse them. Once it select the service it will save its current state,...

CVE-2024-38077-check

Vulnerability analysis asynchronous pdf file. My ability is limited, unable to achieve RCE yet. Please advise, masters. For vulnerability verification, just change the IP. if name == 'main': printlogo connecttolicenseserver"192.168.6.132"...

CVE-2025-64512

Make sure to fill the parameter i.e Target and Uploaddir...

CVE-2026-64633

CVE-2026-64633 Analysis Payloads Files payloads/ — generated payload documents treatment + control variants payloads/manifest.json — payload manifest with pids / pairs...

dawgmon

dawgmon - Dawg the Hallway Monitor SUMMARY The name of this tool is based upon an episode season 10, episode 10 of South Park in which Cartman is Dawg the Hallway Monitor patrolling the hallways of his school. It's a tool which helps one to monitor changes which have taken place on a Linux-based...

PackMyPayload

PackMyPayload - Emerging Threat of Containerized Malware Jump to supported formats This tool takes a file or directory on input and embeds them into an output file acting as an archive/container. It can serve purpose for a Proof-of-Concept presenting emerging risk of container file formats with...

Gitea-Forgejo-CVE-2025-68937

Arbitrary template expansion vulnerability in Gitea and Forgejo This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Summary While checking Forgejo's and Gitea's source code to better understand how templating is performed, I discovered a vulnerability...

CVE-2019-11932

CVE-2019-11932 The address of system and the gadget must be replaced by the actual address found by an information disclosure vulnerability. After replacing address of system and gadget. Run the code to generate the corrupted GIF file: notroot@osboxes:/Desktop/gif$ make...

CVE-2024-20767

Proof of Concept script for CVE-2024-20767 Overview get-the-files.py is a Python script that exploits a vulnerability in Adobe ColdFusion Servers CVE-2024-20767 to read files from the server. The script is based on a method outlined at https://jeva.cc/2973.html. Disclaimer This script is provided...

AsmResolver

AsmResolver AsmResolver is a library for reading, modifying and reconstructing Portable Executable PE files. It supports PE images running natively on Windows, as well as images containing managed .NET metadata. AsmResolver is released under the MIT license. Main Features AsmResolver has a lot of...

cve-2022-23636-poc

CVE-2022-23626 - m1k1o's Blog Authenticated RCE Authenticated Remote Code Execution via file upload vulnerability in m1k1o's Blog v1.3 and below. Description The ajax.php?action=uploadimage endpoint does not properly validate uploaded file types, allowing an authenticated user to upload a PHP...

Malicious code in pystr-codec (PyPI)

Source: kam193 9f8b8630f88afc0b4a1aedeefb4e20adbf3fb9dea06f64747fb0bdf65c0a7bc1 Package embeds a malicious PTH file that on every Python startup executes obfuscated JavaScript code, using a Bun engine. It then exfiltrates credentials to a public Github repository, establishes persistence awaiting...

CVE-2026-65891

CVE-2026-65891 — Joomla JCE Rename PoC Proof-of-concept scanner for CVE-2026-65891 in the Joomla Content Editor JCE extension. Improper input validation in the JCE file manager rename function allows an authenticated user with file-management permissions to: create hidden files dot-prefixed names...

CVE-2021-22005-metasploit

CVE-2021-22005-metasploit the metasploit scriptPOC/EXP about CVE-2021-22005 VMware vCenter Server contains an arbitrary file upload vulnerability preparation POC git clone https://github.com/TaroballzChen/CVE-2021-22005-metasploit cd CVE-2021-22005-metasploit mkdir -p...

CVE-2012-5519

cups-root-file-read.sh ⭐ a bash implementation of the metasploit 'cupsrootfileread.rb' module designed for pentesting and CTFs. mainly a short exercise in bash scripting. intended to be a self-contained program that exploits CVE-2012-5519 on linux systems; it provides the user with an interactive...