shortscan

🌀 Shortscan An IIS short filename enumeration tool. Functionality Shortscan is designed to quickly determine which files with short filenames exist on an IIS webserver. Once a short filename has been identified the tool will try to automatically identify the full filename. In addition to standard...

automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...

cypheroth

Cypheroth Automated, extensible toolset that runs cypher queries against Bloodhound's Neo4j backend and saves output to spreadsheets. Description This is a bash script that automates running cypher queries against Bloodhound data stored in a Neo4j database. I found myself re-running the same...

chiasmodon

Chiasmodon Chiasmodon is an OSINT tool that allows users to gather information from various sources and conduct targeted searches based on domains, Google Play applications, email addresses, IP addresses, organizations, URLs, and more. It provides comprehensive scanning capabilities, customizable...

GHunt

🌐 GHunt Online version : https://osint.industries 🐍 Now Python 3.13 compatible ! 😊 Description GHunt v2 is an offensive Google framework, designed to evolve efficiently. It's currently focused on OSINT, but any use related with Google is possible. Features : CLI usage and modules Python library...

POC_CVE-2024-40492

CVE-2024-40492: Stored XSS to ATO Description Stored Cross-Site Scripting XSS is a type of security vulnerability typically found in web applications. It occurs when an attacker is able to inject malicious scripts into a web application, and those scripts are stored on the server. When other user...

EUVD-2026-87521

OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access siblin...

CVE-2019-6467

CVE-2019-6467 BIND nxdomain-redirect For educational purposes only Run root@kitploit: $ docker run --rm --name cve-2019-6467 -it -p 53:53/udp knqyf263/cve-2019-6467 Exploit Normal query root@kitploit: $ dig @127.0.0.1 nxdomain.example.com nxdomain can be replaced by anything that means non-existe...

s2-062

s2-062 Remote Code Execution S2-062 CVE-2021-31805 Verification POC Verification method vulfocus range issue The poc inside validates against the s2-061 range, with the parameter id; the new range uses the parameter name The main reason for identifying it as id is that I can't think of any good...

s3enum

s3enum s3enum is a fast and stealthy Amazon S3 bucket enumeration tool. It leverages DNS instead of HTTP, which means that requests are not logged in S3 server access logs. It was originally built back in 2016 to target GitHub. Installation root@kitploit: go install github.com/koenrh/s3enum@lates...

CVE-2016-2434

CVE-2016-2434...

EUVD-2025-26372

A vulnerability was identified in Tenda CH22 1.0.0.1. This issue affects the function formSetSambaConf of the file /goform/SetSambaConf. The manipulation of the argument sambauserNameSda leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available an...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

CVE-2022-3602

CVE−2022-3602 What is this? This document and repository is a write-up of CVE−2022-3602, a punycode buffer overflow issue in OpenSSL. It's an "anti-POC" the issue does not appear to exploitable intended for folks who maintain their own OpenSSL builds and for compiler maintainers. There is a...

ExtensionSpoofer

ExtensionSpoofer ExtensionSpoofer is a Visual Basic .NET desktop app that demonstrates how file names and icons can be visually manipulated on Windows while the underlying executable file type remains unchanged. It uses the Unicode Right-to-Left Override character U+202E to reverse displayed...

ratched

ratched ratched is a Man-in-the-Middle MitM proxy that specifically intercepts TLS connections. It is intended to be used in conjunction with the Linux iptabes REDIRECT target; all connections that should be intercepted can be redirected to the local ratched port. Through the SOORIGINALDST sockop...

eavesarp

Eavesarp A reconnaissance tool that analyzes ARP requests to identify hosts that are likely communicating with one another, which is useful in those dreaded situations where LLMNR/NBNS aren't in use for name resolution. Brought to you by: Requirements/Installation This is only gon' work on Kali o...

The vulnerability of the Enlogic SCADA system’s virtual controller “ENTEK” arises from incorrect restrictions on the path name to the catalog, allowing a intruder to write arbitrary files.

The vulnerability of the Enlogic SCADA system “ENTEK”’s virtual controller is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files...

RCLocals

RCLocals Inspired by 'Autoruns' from Sysinternals, RCLocals analyzes all Linux startup possibilities to find backdoors, also performs process integrity verification, scan for DLL injected processes and much more Things covered: ·List GPG keys trusted by the system ·Installed Packages ·File...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...