cosa-nostra

Cosa Nostra Cosa Nostra is an open source software clustering toolkit with a focus on malware analysis. It can create phylogenetic trees of binary malware samples that are structurally similar. It was initially released during SyScan360 Shanghai 2016. I basically maintain it since 2016 for my one...

kurukshetra

Kurukshetra Kurukshetra is a web framework that’s developed with the aim of being the first open source framework which provides a solid foundation to host reasonably complex secure coding challenges while still providing the ability to efficiently and dynamically execute each challenge on the...

hakuin

Hakuin is a Blind SQL Injection BSQLI optimization and automation framework written in Python 3. It abstracts away the extraction logic and allows users to easily and efficiently dump databases from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization...

fapro

FaPro Free,Cross-platform,Single-file mass network protocol server simulator 中文Readme Description FaPro is a Fake Protocol Server tool, Can easily start or stop multiple network services. The goal is to support as many protocols as possible, and support as many deep interactions as possible for...

Blisqy

1. Blisqy Blisqy is a tool to aid Web Security researchers to find Time-based Blind SQL injection on HTTP Headers and also exploitation of the same vulnerability. The exploitation enables slow data siphon from a database currently supports MySQL/MariaDB only using bitwise operation on printable...

CVE-2023-49970

CVE-2023-49970 Customer Support System 1.0 - SQL Injection Vulnerability in the "subject" Parameter During "saveticket" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...

dvna

Damn Vulnerable NodeJS Application DVNA Damn Vulnerable NodeJS Application DVNA is a simple NodeJS application to demonstrate OWASP Top 10 Vulnerabilities and guide on fixing and avoiding these vulnerabilities. The fixes branch will contain fixes for the vulnerabilities. Fixes for vulnerabilities...

CVE-2021-41648

CVE-2021-41648 CVE-2021-41648 Inyección SQL en online-shopping-system El sistema online-shopping-system es vulnerable a ataques de inyección SQL no autenticados, ciegos basados en errores/booleanos y basados en errores. El parámetro proId en la página /action.php no sanitiza la entrada del usuari...

quasibot

quasiBot quasiBot 0.3 - Léeme 07.08.14 Agenda QuasiBot es un complejo gestor de webshells escrito en PHP, que opera sobre backdoors basados en web implementados por el propio usuario. Usando backdoors PHP preparados, quasiBot funciona como un C&C que intenta comunicarse con cada backdoor. La...

CVE-2021-2471

CVE-2021-2471 - XXE in MySQL Connector/J Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/J. Supported versions that are affected are 8.0.26 and prior. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access ...

phishlulz

PhishLulz PhishLulz is a Ruby toolset aimed at automating Phishing activities. When you start a phishing campaign, a dedicated Amazon EC2 Debian 7 instance is spawned. The VM comes with various open source tools that have been glued together. The two main components are: PhishingFrenzy...

PhoneMonitor

PhoneMonitor Una herramienta de administración remota para dispositivos Android. La versión mínima de SDK para la aplicación es API 15 y, por su naturaleza, el nivel de API objetivo tiene sentido que sea 21. Instrucciones: Abre la carpeta PhoneMonitor con Android Studio. Reemplaza las cadenas XXX...

go-sniffer

go-sniffer Capture mysql,redis,http,mongodb etc protocol... 抓包截取项目中的数据库请求并解析成相应的语句，如mysql协议会解析为sql语句,便于调试。 不要修改代码，直接嗅探项目中的数据请求。 中文使用说明 Support List: mysql Redis Http Mongodb Kafka developing ... Demo: root@kitploit: $ go-sniffer en0 mysql Setup: support : MacOS...

enumdb

enumdb Enumdb is a relational database brute force and post exploitation tool for MySQL and MSSQL. When provided a list of usernames and/or passwords, it will cycle through each host looking for valid credentials. By default, enumdb will use newly discovered credentials to automatically search fo...

CVE-2026-75133

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

ncrack

ncrack Ncrack is a high-speed network authentication cracking tool. It was built to help companies secure their networks by proactively testing all their hosts and networking devices for poor passwords. Security professionals also rely on Ncrack when auditing their clients. Ncrack was designed...

CVE-2019-12086-jackson-databind-file-read

jackson-CVE-2019-12086 Vulnerability Description When Default Typing is enabled, and the classpath contains mysql-connector-java version 8.0.15 released on 2019.2.1 or earlier, an attacker can read arbitrary files by sending malicious JSON data. The mysql-connector-java library is the commonly us...

CVE-2023-21971_Analysis

CVE-2023-21971 Connector/J RCE Analysis References Remote Code Execution RCE in com.mysql:mysql-connector-j | CVE-2023-21971 | Snyk New Vulnerability in MySQL JDBC Driver: RCE and Unauthorized DB Access MYSQL JDBC Deserialization Analysis - 跳跳糖 tttang.com Vulnerability Overview Vulnerability in...

EUVD-2026-68608

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2026-75133

The Keep Backup Daily WordPress plugin (versions before 2.1.4 ) contains a sensitive information exposure vulnerability in the kbd_cron_process parameter. The parameter is publicly accessible without authentication, allowing an unauthenticated attacker over the network to trigger a full MySQL dat...