BEAST-PoC

BEAST-PoC chosen-plaintext attack This proof of concept is focused on the cryptography behind the BEAST Browser Exploit Against SSL/TLS attack presented by Thai Duong and Juliano Rizzo on September 23, 2011. This a chosen-plaintext attack and this allow you to retrieve sensitives informations if...

TospoVirus

Building TospoVirus for Distribution: ./build.sh Distribute to a working pineapple with version 2.3: ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null [email protected] "mkdir /tospo" scp -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null dist/tv...

evilTrust

evilTrust Ideal tool for automated deployment of a Rogue AP with template selection + 2FA capability. This tool has several templates to use, including a custom template option, where the attacker can deploy their own template. IMPORTANT : No wired connection is required, so the attack can be...

CVE-2021-3129-exp

Laravel Debug Mode RCE Vulnerability CVE-2021-3129 POC / EXP CVE-2021-3129 EXP / POC ⚠️ Note: Due to the fact that exploitation and detection of this vulnerability require multiple requests, the process may be slow. Usage: python CVE-2021-3129.py usage: python CVE-2021-3129.py -u url --exp Laravel...

smuggler

/ | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler An HTTP Request Smuggling / Desync testing tool written in Python 3 Acknowledgements A special thanks to James Kettle for his research and methods into HTTP desyncs And a special thanks to Ben Sadeghipour...

ntlmv1-multi

NTLMv1 Multiherramienta Esta herramienta revierte hashes NTLMv1 a NTLM o, más específicamente, formatea las respuestas al desafío NTLMv1 en un formato que puede crackearse con el modo 14000 de hashcat. Cálculo de CT3 Si especificas --ct3, calculará los últimos 4 dígitos del NTLM por ti; si...

pentest-a2p2v-core

README Automated Attack Path Planning and Validation A2P2V is a planning and cyber-attack tool that provides the capability for users to determine a set of ranked attack sequences given a specific attacker goal. The aim of the tool is to simplify process so that non-security experts can generate...

weape

wEAPe Script Weape-Wireless-EAP-Extractor ============================================ Extrae automáticamente nombres de usuario EAP 802.1x Desarrollado por Daniel Compton en Info-Assure Ltd https://github.com/commonexploits/weape.git Instalación git clone...

CVE-2021-3129

CVE-2021-3129 PoC for CVE-2021-3129 Laravel For educational purposes only Test Set up the PoC environment $ docker-compose build $ docker-compose up -d Confirm it works See http://localhost:8000/ and make sure the Laravel default page is shown. Exploit $ docker-compose exec attacker sh / python3...

acheron

Acerca de Acheron es una librería inspirada en SysWhisper3/FreshyCalls/RecycledGate, con la mayor parte de la funcionalidad implementada en ensamblador de Go. El paquete acheron se puede usar para añadir capacidades de syscall indirecta a tus herramientas ofensivas en Golang, para eludir AV/EDR q...

EUVD-2026-89616

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scriptin...

nexmon

¿Qué es nexmon? Nexmon es nuestro framework de parcheo de firmware basado en C para chips WiFi Broadcom/Cypress que te permite escribir tus propios parches de firmware, por ejemplo, para habilitar el modo monitor con cabeceras radiotap e inyección de tramas. A continuación, encontrarás una visión...

October CMS - Remote Code Execution

October CMS is susceptible to remote code execution. In affected versions, user input is not properly sanitized before rendering. An authenticated user with the permissions to create, modify, and delete website pages can bypass cms.safemode and cms.enableSafeMode in order to execute arbitrary cod...

Vitest Browser Mode - Local File Read

Vitest is a testing framework powered by Vite. The screenshot-error handler on the browser mode HTTP server that responds any file on the file system. Especially if the server is exposed on the network by browser.api.host- true, an attacker can send a request to that handler from remote to get th...

SiYuan <= 3.6.5 - Unauthenticated Path Traversal

SiYuan = 3.6.5 contains a path traversal via double URL-encoding in the /assets/ route publish mode port 6808, allowing unauthenticated attackers to read arbitrary files inside WorkspaceDir including conf/conf.json which exposes the API token and access auth code. id: CVE-2026-54066 info: name:...

SiYuan <=3.7.2 - SQL Injection

SiYuan before v3.7.3 contains a SQL injection caused by direct concatenation of the keyword parameter in /api/filetree/searchDocs endpoint, letting attackers with publish RoleReader token or unauthenticated in publish mode read and modify database content. id: CVE-2026-69085 info: name: SiYuan...

W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read

W3 Total Cache WordPress plugin = 2.9.4 contains a directory traversal caused by improper handling in setupSources function, letting unauthenticated attackers read arbitrary files, exploit requires manual minify mode enabled with specific filename. id: CVE-2026-9282 info: name: W3 Total Cache =...

decider

Decider Este trabajo está licenciado bajo una Licencia Creative Commons Attribution 4.0 International. Este proyecto hace uso de MITRE ATT&CK® - Términos de uso de ATT&CK. 📰 3.0.0 - Kiosk ya está aquí Decider ahora es sin inicio de sesión y adaptable. Las actualizaciones de contenido se han...

gf

gf A wrapper around grep to avoid typing common patterns. What? Why? I use grep a lot. When auditing code bases, looking at the output of meg, or just generally dealing with large amounts of data. I often end up using fairly complex patterns like this one: ▶ grep -HnrE...

crawpy

Crawpy Otra herramienta de descubrimiento de contenido escrita en Python. Qué hace diferente a esta herramienta de otras: Envía solicitudes HTTP asíncronas, rápido Modo de calibración, aplica filtros por sí mismo Modo de exploración recursiva con banderas adicionales Generación de informes, luego...