masta-cve-2026-48907

MASTA CVE-2026-48907 Scanner Single-file, self-contained scanner for Joomla! JCE Editor Author: Hussein Mohamed masta ghimau !CAUTION 🚨 DISCLAIMER — READ BEFORE USE THIS IS AN INTRUSIVE SECURITY TESTING TOOL. root@kitploit: THIS TOOL IS FOR AUTHORIZED SECURITY ASSESSMENTS ONLY. Scanning systems y...

waf-checker

WAF Checker Este proyecto te ayuda a comprobar qué tan bien protege tu Web Application Firewall WAF tu producto contra ataques web comunes. Se puede ejecutar como un Cloudflare Worker con una interfaz web interactiva incorporada o como una herramienta CLI independiente de Node.js. Características...

CVE-2018-15982_EXP_IE

CVE-2018-15982EXP Usage root@kitploit: msfvenom -p windows/exec cmd=calc.exe -f raw 86.bin msfvenom -p windows/x64/exec cmd=calc.exe -f raw 64.bin python CVE201815982.py -i 86.bin -I 64.bin output exp.swf and index.html。 Demo https://twitter.com/Evi1cg/status/1071284773169950721...

sdc

root@kitploit: +------------------------------------------------------------------------------+ SDC - Self Decrypting Binary Generator Copyright C 2006 Claes M Nyberg +------------------------------------------------------------------------------+ -= What is this root@kitploit: The SDC program...

powercat

powercat Netcat: La versión de PowerShell. Compatible con PowerShell versión 2 y posteriores Instalación powercat es una función de PowerShell. Primero debes cargar la función antes de poder ejecutarla. Puedes colocar uno de los siguientes comandos en tu perfil de PowerShell para que powercat se...

macOSTools

macOSTools Herramientas Ofensivas para macOS AUnit Proyecto de ejemplo XCode para Plugins de Audio Unit MigrationToolPayload Plugin de herramienta de migración SpecialDelivery Plugin de instalador authplugin Plugin de autenticación dylibinjection Código fuente para inyección de dylib. Basado en...

CVE-2015-7501

Lab for Java Deserialization Vulnerabilities This content is related to the paper written for the 12th edition of H2HC magazine. See full paper in: https://www.h2hc.com.br/revista/ Slides and video of the talk will be available soon. Um overview sobre as bases das falhas de desserialização nativa...

Nextjs_Exploit_Tool

Next.js RSC RCE Exploit Tool CVE-2025-55182 Project Introduction CVE-2025-55182 is a high-severity vulnerability in Next.js's Server Component RSC processing chain. An attacker can craft special multipart/form-data requests and forged RSC response chunks to induce the server to execute arbitrary...

wfuzz

Wfuzz - The Web Fuzzer Wfuzz has been created to facilitate the task in web applications assessments and it is based on a simple concept: it replaces any reference to the FUZZ keyword by the value of a given payload. A payload in Wfuzz is a source of data. This simple concept allows any input to ...

wfuzz

Wfuzz - El Fuzzer Web Wfuzz ha sido creado para facilitar la tarea en evaluaciones de aplicaciones web y se basa en un concepto simple: reemplaza cualquier referencia a la palabra clave FUZZ por el valor de un payload dado. Un payload en Wfuzz es una fuente de datos. Este simple concepto permite...

identYwaf

identYwaf es una herramienta de identificación que puede reconocer el tipo de protección web es decir, WAF basándose en inferencia ciega. La inferencia ciega se realiza inspeccionando las respuestas provocadas por un conjunto de cargas ofensivas predefinidas no destructivas, donde estas se usan...

CVE-2025-8088

CVE-2025-8088 PoC Educational Use Only Details about this CVE can be found at: https://nvd.nist.gov/vuln/detail/CVE-2025-8088 ⚠️ Warning: This repository contains a proof-of-concept PoC for CVE-2025-8088. It is intended for educational purposes, research, and lab environments only. Do not use this...

pycrypt

pycrypt Crypter basado en Python que puede eludir cualquier tipo de producto antivirus Nota: root@kitploit: Si el stub es detectado, por favor usa las siguientes ofuscaciones:- 1. https://github.com/machine1337/fudcrypt 2. https://github.com/machine1337/pyobfuscate Importante: root@kitploit: 1...

ssrf-king

🔥 ssrf-king 🔥 v1.12 Latest SSRF plugin for burp that Automates SSRF Detection in all of the Request If you are facing any problems or would like a new feature that is not listed below Please create a new issue below in this form Create New Issue Upcoming Features Checklist ✔️ It will soon have a...

haptyc

Haptyc Marco de Generación de Pruebas ¿Qué es Haptyc? Haptyc es una librería de Python construida para agregar soporte de posiciones de carga útil y tipos de ataque Sniper/Clusterbomb/Batteringram/Pitchfork en Turbo Intruder. Si bien Haptyc logra estos objetivos bastante bien, también introduce u...

haptyc

Haptyc Test Generation Framework What's Haptyc? Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly well it also introduces a simpler way to express...

XORpass

XORpass es un codificador para evadir filtros WAF usando operaciones XOR. Instalación y Uso root@kitploit: git clone https://github.com/devploit/XORpass cd XORpass $ python3 xorpass.py -h Ejemplo de evasión: Usando función PHP clara: Usando evasión XOR de esa función: root@kitploit: $ python3...

xssless

xssless An automated XSS payload generator written in python. Usage 1. Record requests with Burp proxy 2. Select requests you want to generate, then right click and select "Save items" 3. Use xssless to generate your payload: ./xssless.py burpexportfile 4. Pwn! A more detailed tutorial can be fou...

ezXSS

ezXSS is an easy way for penetration testers and bug bounty hunters to test blind Cross Site Scripting. ezXSS is a tool that is designed to help find and exploit cross-site scripting XSS vulnerabilities. One of the key features of ezXSS is its ability to identify and exploit blind XSS...

sickle-pdk

Sickle - Payload Development Kit Sickle is a tool I originally developed to help me be more effective, in both developing and understanding shellcode. However, throughout the course of its development and usage It has evolved into a payload development kit. Although current modules are mostly aim...