NimShellcodeFluctuation

NimShellcodeFluctuation Nim Port of the original repo: https://github.com/mgeeky/ShellcodeFluctuation All comments were copy pasted as they were from the original Repository as they really helped me to understand the technique. For more information about the technique itself I highly recommend...

CVE-2026-97670 Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

The Avada Fusion Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1. This is due to the plugin not properly verifying authorization before dispatching a WordPress action hook whose name is taken from an attacker-supplied form-field valu...

CVE-2026-97670

The Avada (Fusion) Builder plugin for WordPress (versions

CVE-2024-32002

CVE-2024-32002 Repo for testing CVE-2024-32002 combined with Hook...

CVE-2020-27955

Git-lfs Remote Code Execution RCE exploit CVE-2020-27955 .bat / powershell version Vulnerable: git, GitHub CLI gh, GitHub Desktop, Visual Studio Code, SourceTree, SmartGit, GitKraken etc. Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Tested on Windows on: git, GitHub...

CVE-2024-10220-githooks

CVE-2024-10220 Test ref https://irsl.medium.com/sneaky-write-hook-git-clone-to-root-on-k8s-node-e38236205d54...

DInvoke

DInvoke Dynamic replacement for PInvoke on Windows. DInvoke contains powerful primitives that may be combined intelligently to dynamically invoke unmanaged code from disk or from memory with careful precision. This may be used for many purposes such as PE parsing, intelligent dynamic API...

ssl-kill-switch3

SSL Kill Switch 3 Next Generation of iOS Tweak SSLKillSwitch https://github.com/nabla-c0d3/ssl-kill-switch2 with much more functionality! What's New? FIXED Fishhook Support iOS 15+, ARM64/ARM64e, so that you can hook in non-jailbreak era FIXED Rootless Support iOS 15+, ARM64/ARM64e, happy rootles...

HeapCrypt

HeapCrypt Encypting the Heap while sleeping by hooking and modifying Sleep with our own function that encrypts the heap , sleeps for a moment then decrypts the heap : 16bit key xor heap encryption : 16bit key xor heap decryption : References : https://www.arashparsa.com/hook-heaps-and-live-free/...

Kernel-Process-Hollowing

Windows Kernel Mode Process Hollowing This project is a proof of concept of how the Process Hollowing technique works from the kernel level. Resources SSDT Hook Process Hollowing...

cve-2024-32002-submodule-rce

CVE-2024-32002 RCE Submodule A submodule to demonstrate CVE-2024-32002. Demonstrates Remote Code Execution RCE by loading a malicious commit hook into the .git directory of the parent repo. See cve-2024-32002-poc-rce for the working POC that utilises this repo. What this repo contains A malicous...

CVE-2025-10230

CVE-2025-10230: Samba Critical RCE CVSS 10.0 Vulnerability Summary CVE-2025-10230 is a critical remote code execution RCE vulnerability that remained hidden in the Samba codebase for 13 years. The flaw resides in the handling of WINS Windows Internet Name Service registration packets. When...

CVE-2024-32002-poc

Bash Script: !/bin/bash Set Git configuration options git config --global protocol.file.allow always git config --global core.symlinks true Avoid warning messages set default branch to main git config --global init.defaultBranch main Define tell-tale path telltalepath="$PWD/tell.tale" Initialize...

hooky

hooky Questo repository è un sottomodulo per https://github.com/markuta/CVE-2024-32002, che contiene un semplice hook situato in y/hooks/post-checkout per aprire la calcolatrice sui sistemi macOS: open -a Calculator.app Maggiori informazioni sulla vulnerabilità sono disponibili qui e qui...

Malicious code in @brick-v2/brand (npm)

Source: amazon-inspector a194395a620ef40055a22d7beccbab1e1ca0c662afe83b9ee2fb23d07ebaedc5 package.json declares a preinstall hook node index.js || true that loads a prebuilt native addon at prebuilds/-/metrics.node. The addon reads credential-grade environment variables AWSSECRETACCESSKEY and oth...

Malicious code in @galicia-toolkit-nestjs-20-lite/commons (npm)

Source: amazon-inspector 9974df3d2695630f5921c98037f0359ed3948cc0afd0c13d4ad5043819950f15 package.json declares a preinstall hook node index.js || true, which require's a bundled native addon at prebuilds/-/metrics.node. On N-API registration the addon reads AWSACCESSKEYID, AWSSECRETACCESSKEY,...

Malicious code in @galicia-toolkit-cheques-nc/front (npm)

Source: amazon-inspector 29d819cdd288d1d18b8d76fbca2b2113941f344a5a80b2676ea5714367d8af44 Scoped npm package @galicia-toolkit-cheques-nc/front published at version 999.0.3 with UNLICENSED, no README, and no repository. package.json declares a preinstall hook node index.js || true, which loads a...

bedaisy-bypass

bedaisy-bypass Description bedaisy-bypass is a kernel driver designed to bypass reports sent from BEDaisy.sys to BEService.exe. For users not on a UEFI, the project utilizes Infinity Hook. The driver intercepts data communicated through the named pipe between the two services. On receiving a...

CVE-2026-60004-poc-gitea

CVE-2026-60004 Proof-of-Concept PoC Overview This repository contains a proof-of-concept tool for CVE-2026-60004, an authenticated or pre-auth remote code execution RCE vector affecting certain Gitea versions via the diffpatch hook injection technique. The primary implementation is a single Go...

CVE-2026-74936-gc-potato

CVE-2026-74936 A not fancy reproduction. The baseline required some fiddling here. Mozilla describes this issue as a WebAssembly use-after-free. Public fix 9823b5c86ffa keeps the exact trapping wasm::Code alive in JitActivation. The test performs a bad-signature cross-instance tail call. A Debugg...