hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install root@kitploit: $ pip install hsecscan Usage root@kitploit: $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D...

oregami

Oregami """ What is this register used for? Hmm.. I'll just rename it to veryuniquename, do a textual search, and find all references! Ok.. Waiting for the search to end.. any minute now.. Done! Now I just need to understand which of the search result is relevant to the current usage frame of the...

zizzania

zizzania zizzania captura tráfico inalámbrico escuchando handshakes WPA y volcando solo aquellos marcos adecuados para ser descifrados un beacon + tramas EAPOL + datos. Para acelerar el proceso, zizzania envía tramas IEEE 802.11 DeAuth a las estaciones cuyo handshake se necesita, manejando...

macstealer

MacStealer: Wi-Fi Client Isolation Bypass 1. Introduction This repo contains MacStealer. It can test Wi-Fi networks for client isolation bypasses CVE-2022-47522. Our attack can intercept steal traffic toward other clients at the MAC layer, even if clients are prevented from communicating with eac...

CVE-2026-98061

The Linux kernel contains a vulnerability in the BPF verifier where tail calls made directly from synchronous callback frames trigger a verifier bug. The root cause is that prepare_func_exit() marks register R0 as precise for callbacks, but the tail-call path synthesizes R0 instead of deriving it...

pyrmax

pyrmax Decoder and encoder for Ubiquiti AirMAX wire-protocol frames, covering both the AC WA firmware and M XW/XM firmware series. Decode of the cleartext outer headers is driven by Kaitai Struct schemas under ksy/. The AC payload version-gated, switched on msgtype, with the deauth XOR-unmask is...

lacuna-rs

lacuna-rs Ghost-frame call-stack spoofing + runtime indirect syscalls for Windows x64 — ported to Rust. Ported from LACUNA Chain lacunachain.c by Mohamed Alzhrani 0xmaz. lacuna-rs is a reusable Rust crate that provides the same primitives as the original C TTP, structured so it can be dropped int...

rtl8812au

RTL8812AU/21AU and RTL8814AU linux driver with monitor mode and frame injection The master branch is based on https://github.com/ulli-kroll/rtl8821au branch v4.3.22-beta/rework. According to rtwversion.c the real driver version is 4.3.20. The branch v4.3.21 may be built for RTL8814AU or...

CVE-2026-21014-CAN-Bus-Frame-Replay-Attack-on-Automotive-ECU

CVE-2026-21014 – CAN Bus Frame Replay Attack on Automotive ECU Program Code Python SocketCAN sim root@kitploit: canreplaysim.py - Simulates CAN bus replay import time canmessages = def sendcanmsgid, data: printf"CAN msgid:x: data.hex" canmessages.appendmsgid, data def receivecan: return...

uxss-poc

Universal Cross Site Scripting PoC This is a PoC for CVE-2015-0072 for sequentialy get the targeted websites cookies. Disclaimer This Proof of Concept is for educational purpose only. Please do not use it against any system without prior permission. You are responsible for yourself for what you d...

QCSuper

QCSuper QCSuper is a tool communicating with Qualcomm-based phones and modems, allowing to capture raw 2G/3G/4G and for certain models 5G radio frames, among other things. It will allow you to generate PCAP captures of it using either a rooted Android phone, an USB dongle or an existing capture i...

CVE-2021-37740

Proof of Concept for CVE-2021-37740 Table of Contents Introduction The Vulnerability Executing the PoC Remediation Coordinated Vulnerability Disclosure License Change Log Introduction CVE-2021-37740 is a denial of service DoS vulnerability that affects firmware v3.0.3 of the KNXnet/IP Secure rout...

quickjack

Quickjack Quickjack is an intuitive, point-and-click tool for performing advanced and covert clickjacking and frame slicing attacks. Use the Quickjack tool directly at http://samy.pl/quickjack/quickjack.html by @SamyKamkar // [email protected] // http://samy.pl // Dec 22, 2014 Code available...

esp32_esp8266_attacks

ESP32/ESP8266 Wi-Fi Attacks This repository is part of a research outcome from theASSET Research Group. This repository demonstrates 3 Wi-Fi attacks against the popular ESP32/8266 IoT devices: Zero PMK Installation CVE-2019-12587 - Hijacking ESP32/ESP8266 clients connected to enterprise networks;...

r00kie-kr00kie

r00kie-kr00kie Descargo de responsabilidad Este es un exploit PoC para la vulnerabilidad kr00k CVE-2019-15126. Este proyecto tiene únicamente fines educativos y no puede ser utilizado para violar la ley ni para beneficio personal. El autor de este proyecto no se responsabiliza por cualquier daño...

XSSTracer

XSSTracer v1.3 by 1N3 @CrowdShield https://crowdshield.com XSSTracer is a small python script that checks remote web servers for Clickjacking, Cross-Frame Scripting, Cross-Site Tracing and Host Header Injection. root@kitploit: Usage: ./xsstracer...

nexmon

¿Qué es nexmon? Nexmon es nuestro framework de parcheo de firmware basado en C para chips WiFi Broadcom/Cypress que te permite escribir tus propios parches de firmware, por ejemplo, para habilitar el modo monitor con cabeceras radiotap e inyección de tramas. A continuación, encontrarás una visión...

fracture

Fracture FragAttacks WiFi Penetration Framework CVE-2020-24586 / CVE-2020-24587 / CVE-2020-24588 Fracture automates three novel attack chains via 802.11 frame injection. It exploits the A-MSDU aggregation vulnerability in WPA2/WPA3 to inject arbitrary plaintext frames into encrypted networks —...

CVE-2026-93805

The Linux kernel contains a vulnerability in the cfg80211 component where cfg80211_rx_mlme_mgmt() and cfg80211_tx_mlme_mgmt() fail to properly validate the lengths of MLME callback frames before accessing their contents. Specifically, the functions only verify that frames are at least 2 bytes lon...

EUVD-2026-86143

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate ath11k can receive HT/VHT/HE frames whose reported MCS is above the maximum that can be expressed in the corresponding mac80211 rate space e.g. an HE frame...