31416 matches found
wfuzz
Wfuzz - 网络模糊测试工具 Wfuzz 旨在简化 Web 应用程序评估中的任务，其基于一个简单的概念：它将 FUZZ 关键字的所有引用替换为给定载荷的值。 Wfuzz 中的载荷是一个数据源。 这个简单的概念允许任何输入注入到 HTTP 请求的任何字段中，从而能够在不同的 Web 应用程序组件（如参数、认证、表单、目录/文件、HTTP 头等）中执行复杂的 Web 安全攻击。 Wfuzz 不仅仅是一个 Web 内容扫描器： Wfuzz 可以通过发现和利用 Web 应用程序漏洞来帮助您保护 Web 应用程序。Wfuzz 的 Web 应用程序漏洞扫描器由插件支持。 Wfuzz...
follina-spring
Follina MS-MSDT exploitation with Spring Boot This repository contains a simple Spring Boot application that acts both as a server to host/activate Follina payloads , and as a generator for malicious Word documents that are ready to be used as attack vectors to exploit CVE-2022-30190. This...
struts-rce
:source-highlighter: pygments = Apache Struts CVE-2017-5638 exploitation This simple web application is built with vulnerable Apache Struts 2.5.10 CVE-2017-5638. It's vulnerable to RCE. == Starting web application To start vulnerable web application, execute: mvn jetty:run The application will be...
CVE-2025-48384
PoC for CVE-2025-48384 See CVE-2025-48384 To run: root@kitploit: git -c protocol.file.allow=always clone --recurse-submodules [email protected]:liamg/CVE-2025-48384.git Example output: root@kitploit: git -c protocol.file.allow=always clone --recurse-submodules CVE-2025-48384 test Cloning int...
cs_yara
csyara Check Cobalt Strike Yara Rules 参考链接 https://github.com/CCob/BeaconEye BeaconEye Bug Fix: https://wbglil.gitbook.io/cobalt-strike/cobalt-strike-gong-ji-fang-yu/untitled-1 rule from https://raw.githubusercontent.com/CCob/BeaconEye/master/BeaconEye.cs beaconEye.yar root@kitploit: rule...
macphish
macphish Office for Mac 宏负载生成器 攻击向量 共有4种攻击向量可供选择： beacon creds meterpreter meterpreter-grant 对于 'creds' 方法，macphish 可以直接生成 Applescript 脚本，方便你在 shell 中运行。 beacon 执行此负载后，它会向我们的监听主机发送信号，并提供受害者的基本系统信息。生成 beacon 负载的最简单方式是： root@kitploit: $./macphish.py -lh 默认情况下使用 curl，但可以通过修改命令模板来使用其他工具（wget、nslookup...
Log4j-Scanner-Exploit
Log4Shell-Scanner-Exploit Bash script that allows identifying and/or exploiting the Log4Shell vulnerability remotely. This tool performs various tests using LDAP payloads and X-Api-Version, User-Agent, and X-Forwarded-For headers. Always use this script with prior authorization from the owner of...
EXOCET-AV-Evasion
EXOCET - AV-evading, undetectable, payload delivery tool Chang Tan AWS Certified Cloud Practitioner and Solutions Architect Associate [email protected] Updated EXOCET Usage Make sure you pack your payloads to avoid any leaks of the crypter's key and further frustrate malware analysts. A...
CVE-2023-41425-RCE-WonderCMS-4.3.2
🚨 WonderCMS RCE Exploit Tool CVE-2023-41425 This Python-based offensive security tool automates the exploitation of a Remote Code Execution RCE vulnerability in WonderCMS 4.3.2 , specifically CVE-2023-41425. It streamlines the process of crafting a malicious ZIP theme module and delivering a...
h0neytr4p
Adjusted for T-Pot This fork of h0neytr4p was revised for T-Pot with the following features: Add Docker support Dockerfile, docker-compose.yml Use a single logfile instead of two Log to JSON instead of CSV Enrich JSON log file with additional info i.e. Cookies, Headers, Destination Port, etc...
Cooolis-ms
Cooolis-ms Wiki Documentation Cooolis-ms is a code execution tool that includes a Metasploit Payload Loader, Cobalt Strike External C2 Loader, and Reflective DLL injection. It is designed to evade static detection of code we intend to execute that contains known signatures, helping red team...
XSSFuzzer
XSS Fuzzer XSS Fuzzer is a simple application written in plain HTML/JavaScript/CSS which generates XSS payloads based on user-defined vectors using multiple placeholders which are replaced with fuzzing lists. It offers the possibility to just generate the payloads as plain-text or to execute them...
php-jpeg-injector
php-jpeg-injector Injects php payloads into jpeg images. Related to this post. Use Case You have a web application that runs a jpeg image through PHP's GD graphics library. Description This script injects PHP code into a specified jpeg image. The web application will execute the payload if it...
php-jpeg-injector
php-jpeg-injector 将php载荷注入jpeg图片中。相关帖子：this post 使用场景 你有一个通过PHP的GD图形库处理jpeg图片的web应用程序。 描述 此脚本将PHP代码注入到指定的jpeg图片中。如果web应用程序解释该图片，它将执行载荷。请确保输入的jpeg未被压缩！ 用法 python3 gd-jpeg.py JPEG PAYLOAD OUTPUTJPEG 例如：python3 gd-jpeg.py cat.jpeg '' infectedcat.jpeg 工作原理 PHP代码被注入到扫描头之后的无用/垃圾（棕色）空间中：...
Follina-CVE-2022-30190-Sample
Follina-CVE-2022-30190-Sample-by-ethical-blue Educational Follina Tool Version history v1.1 — JavaScript payload obfuscation v1.0 — Initial release Features .RTF payload generator Simple HTTP Server for payload Mitigation tips Configuration extractor Easy to use for learning Exploit Executed...
CVE-2020-0688_EXP
CVE-2020-0688EXP CVE-2020-0688EXP Auto trigger payload root@kitploit: python3 CVE-2020-0688EXP.py -h usage: CVE-2020-0688EXP.py -h -s SERVER -u USER -p PASSWORD -c CMD -e optional arguments: -h, --help show this help message and exit -s SERVER, --server ECP Server URL Example: http://ip/owa -u...
zombieant
Zombie Ant Farm: A Kit For Playing Hide and Seek with Linux EDRs. Version 0.5-alpha Why? Because monolithic offensive tools are never enough and building your own offensive strategies and tools is fun. What? Offensive Preloading Primitives and Building Blocks. Distributed Payload Warehousing and...
batchfuscate
batchfuscate A Simple And efficent Script to make your batch payload undectectable. Requirements: root@kitploit: 1. python3 must be installed On Windows & Linux 2. pip install termcolor pip install pystyle pip install tqdm pip install colorama pip install requests Installation:- root@kitploit: 1...
Mezzanine-CMS-6.1.0-XSS
Mezzanine-CMS-6.1.0-XSS CVE-2025-50481 Description A cross-site scripting XSS vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post. CVE: CVE-2025-50481 Affected version:...