spring4shell_behinder

Spring4shellbehinder What is this? A batch rapid exploitation tool for the Spring4Shell vulnerability CVE-2022-22965. Contributors 4nth0ny @Friday Lab Issues/PRs are welcome. : Environment python 3.x Behinder3.0 Beta9 Installation root@kitploit: python3 -m pip install -r requirements.txt Usage...

CVE-2025-51859

CVE-2025-51859 Vulnerability description Chaindesk, a web application for constructing AI Agents, is vulnerable to Stored Cross-Site Scripting XSS in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the...

CVE-2019-9978

CVE-2019-9978 - Social Warfare WordPress Plugin RCE system'cat /etc/passwd' ✅ Step 2 – Start a Python HTTP Server Use Python to serve your payload: root@kitploit:...

CVE-2017-11882-metasploit

CVE-2017-11882-metasploit This is a Metasploit module which exploits CVE-2017-11882 using the POC below: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about. Installation 1. Copy the cve201711882.rb to /usr/share/metasploit-framework/modules/exploits/windows/local...

harpoon

Harpoon root@kitploit: / / / / / // / / / / / / \ / / // / / / // / // / // / / / / // //,// / .//// // // , , "o" o -- -- o / \ o / \ \o / / | X | / / \ / / \ \ / / / -. .- A collection of scripts and payloads and such for hacking containers and k8s junk...

PhantomEvasion

PHANTOM EVASION 3.0 Phantom-Evasion is an antivirus evasion tool written in python both compatible with python and python3 capable to generate almost fully undetectable executable even with the most common x86 msfvenom payload. The following OSs officialy support automatic setup: 1. Kali Linux 2...

BetterXencrypt

root@kitploit: \ \ / |/ | \ / / ../ | | | // \ \ / \ \ // \ / / \ | | /\ | || \ | //\ \ | /\ | / || /|| / / / / / / / / || BetterXencrypt A better version of Xencrypt.Xencrypt it self is a Powershell runtime crypter designed to evade AVs. cause Xencrypt is not FUD anymore and easily get...

HtmlSmuggling

HtmlSmuggling HTML smuggling is a malicious technique used by hackers to hide malware payloads in an encoded script in a specially crafted HTML attachment or web page. The malicious script decodes and deploys the payload on the targeted device when the victim opens/clicks the HTML attachment/link...

plution

plution Prototype pollution scanner using headless chrome What this is Plution is a convenient way to scan at scale for pages that are vulnerable to client side prototype pollution via a URL payload. In the default configuration, it will use a hardcoded payload that can detect 11 of the cases...

CVE-2018-3191

CVE-2018-3191 payload generator Download: https://github.com/voidfyoo/CVE-2018-3191/releases Usage root@kitploit: java -jar weblogic-spring-jndi.jar e.g.: root@kitploit: java -jar weblogic-spring-jndi.jar rmi://192.168.1.1:1099/Exp Notes weblogic-spring-jndi-12.2.1.3.jar for weblogic: 12.2.1.3...

waf-checker

WAF Checker This project helps you check how well your Web Application Firewall WAF protects your product against common web attacks. It can be run as a Cloudflare Worker with a built-in interactive Web UI or as a standalone Node.js CLI tool. Features Core Testing Enter a target URL, pick HTTP...

CVE-2022-44877-white-box

Docs Paper : https://docs.google.com/document/d/1rQ7e9i2AFzHbASfRu3nkgjIswbrS2AB2i7V9OK3dJLs/edit?usp=sharing Libprochider : https://github.com/gianlucaborello/libprocesshider /var/www/html YouTube Demo : https://www.youtube.com/watch?v=V0HgzE8IElA&t=343s tested machine box CentOS 7 - CentOS Web...

Shelter

Shelter Shelter is a completely weaponized sleep obfuscation technique that allows to fully encrypt your in-memory payload making an extensive use of ROP. This crate comes with the following characteristics: AES-128 encryption. Whole PE encryption capability. Removal of execution permission durin...

sdc

root@kitploit: +------------------------------------------------------------------------------+ SDC - Self Decrypting Binary Generator Copyright C 2006 Claes M Nyberg +------------------------------------------------------------------------------+ -= What is this root@kitploit: The SDC program...

zkar

ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...

FakeImageExploiter

FakeImageExploiter v1.4 - backdoor images.jpg.ps1 root@kitploit: CodeName: Metamorphosis Version release: v1.4 Stable Author: pedro ubuntu r00t-3xp10it Distros Supported : Linux Ubuntu, Kali, Mint, Parrot OS Suspicious-Shell-Activity SSA RedTeam develop @2017 Legal Disclamer: root@kitploit: The...

The-Axer

The axer will replace the manual procedure of creating your payloads with msfvenom , making it easier and a lot quicker Contact The Owner THE AXER WILL LET YOU CHOOSE THE PLATFOR , FORMAT , ENCODER , Bind with another file and alot of other features...

sickle-pdk

Sickle - Payload Development Kit Sickle is a tool I originally developed to help me be more effective, in both developing and understanding shellcode. However, throughout the course of its development and usage It has evolved into a payload development kit. Although current modules are mostly aim...

CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Stored Cross-Site Scripting XSS in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by craftin...

-EXPLOIT-CVE-2023-36025

EXPLOIT CVE-2023-36025 - Description Windows SmartScreen Security Feature Bypass Vulnerability Usage NOTE handler waiting for tcp request for target P.S configure CVE-2023-36025.vbs file to change the ip and port to machine ip and port that is being used for the TCP handler configure reverse TCP...