ida_ifl

IFL - Lista interactiva de funciones Licencia: CC-BY https://creativecommons.org/licenses/by/3.0/ Un pequeño plugin cuyo objetivo es proporcionar una forma fácil de navegar entre funciones y sus referencias. Además, permite importar informes generados por, por ejemplo, PE-sieve en IDA. Soporta:...

CVE-2019-15858

CVE-2019-15858 Unauthenticated Remote Code Execution at Woody Ad Snippets PoC An unauthenticated options import vulnerability combined with a stored XSS vulnerability can lead to remote code execution in the WordPress Woody Ad Snippets 90,000+ active installations. Woody Ad Snippets is a plugin...

CVE-2024-25641-CACTI-RCE-1.2.26

CVE-2024-25641 - Cacti 1.2.26 - Arbitrary file write to RCE 🌵 Authenticated RCE Cacti version v1.2.26 Summary An arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to execute arbitrary PHP code ...

IronPE

IronPE - Minimal Windows PE manual loader written in Rust. Rust PE Loader / Manual Mapping Implementation IronPE is a minimal Windows PE manual loader written in Rust for both x86 and x64 PE files. This project is a Rust reimplementation of my previous project dotNetPELoader , which implemented a...

shellstack

ShellStack Version 1.0 ShellStack is a PHP based backdoor management tool. This Tool comes handy for "HACKERS" who wish to keep a track of every website they hack. The tool generates a backdoor file which you just have to upload to the site and put the backdoor URL in the shells.txt present in th...

CVE-2026-88845

The MasterStudy LMS WordPress Plugin versions before 3.7.50 is vulnerable to an unauthorized action due to a lack of capability or nonce checks on an administrative maintenance action. This flaw allows any authenticated user , such as a subscriber, to trigger the action and create published conte...

CVE-2026-88845 MasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create published content on the site attributed to their own accoun...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

CallObfuscator

CallObfuscator Obfuscate hide the PE imports from static/dynamic analysis tools. Theory This's pretty forward, let's say I've used VirtualProtect and I want to obfuscate it with Sleep, the tool will manipulate the IAT so that the thunk that points to VirtualProtect will point instead to Sleep, no...

UnhookMe

UnhookMe - Dynamically unhooking imports resolver In the era of intrusive AVs and EDRs that introduce hot-patches to the running processes for their enhanced optics requirements, modern adversaries must have a robust tool to slide through these watchguards. The propsed implementation of dynamic...

ATutor-2.2.4-Language-Exploit

ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Exploit Title: ATutor 2.2.4 Arbitrary File Upload / RCE CVE-2019-12169 Date: 5/24/19 Exploit Author: liquidsky JMcPeters Vendor Homepage: https://atutor.github.io/ Software Link: https://sourceforge.net/projects/atutor/files/latest/download...

reconvault

ReconVault 🔍 The recon notes organizer bug bounty hunters actually asked for. ReconVault is a dark-themed, terminal-aesthetic desktop app for Linux built for security researchers, bug bounty hunters, and CTF players. Ditch the scattered text files and spreadsheets — organize every target's...

SlackShell

SlackShell Description & Changelog v1.0 This PowerShell module includes various functions that utilize the Slack API to create a command and control channel. The main function, Start-Shell, will connect to a user-specified Slack channel and authenticate using a supplied API authentication token f...

CVE-2022-1565

WordPress Plugin WP All Import = 3.6.7 - Remote Code Execution RCE Authenticated root@kitploit: Ngày: 05 tháng 11 năm 2023 Tác giả khai thác: Việt HÙng https://github.com/phanthibichtram12 Trang chủ của nhà cung cấp: https://www.wpallimport.com/ Link phần mềm:...

plaso

Plaso Plaso Langar Að Safna Öllu - super timeline all the things Plaso Plaso Langar Að Safna Öllu, or super timeline all the things , is a Python-based engine used by several tools for automatic creation of timelines. Plaso default behavior is to create super timelines but it also supports creati...

Alcatraz

Alcatraz Alcatraz is a x64 binary obfuscator that is able to obfuscate various different pe files including: .exe .dll .sys Overview Alcatraz Requirements Usage Features Obfuscation of immediate moves Control flow flattening ADD mutation Entry-point obfuscation Lea obfuscation Anti disassembly...

pycdc-studio

pycdc-studio 中文说明 A Qt Widgets desktop UI for exploring Python bytecode with pycdc / pycdas, inspecting native decompilation results, importing Pyarmor oneshot output, and retrying unsupported code objects with AI fallback. The app supports both Windows and Linux desktop environments. Screenshots...

burp-exporter

Exporter Extension for Burp Suite Community and Pro Follow us to know more about tips and others extensions Description Exporter is a Burp Suite extension to copy a request to a file or the clipboard as multiple programming languages functions. It also adds a tab called Exporter where you can...

Import Legacy Media <= 0.1 - Cross-Site Scripting

A cross-site scripting vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4535 info: name: Import Legacy Media = 0.1 - Cross-Site...

Motors Car Dealer & Classified Ads <= 1.4.0 - Unauthenticated settings import/export

includes/options.php in the motors-car-dealership-classified-listings aka Motors - Car Dealer & Classified Ads plugin through 1.4.0 for WordPress allows unauthenticated options changes. id: CVE-2019-17228 info: name: Motors Car Dealer & Classified Ads = 1.4.0 - Unauthenticated settings...