ysonet

YSoNet est un fork de l'original YSoSerial.Net, actuellement maintenu par @irsdl. Sites : ysonet.net ou ysonet.com les deux ouvrent ce dépôt. Un outil de preuve de concept pour générer des payloads qui exploitent la désérialisation non sécurisée d'objets .NET. Qu'est-ce que YSoNet YSoNet...

ufuzz

UFuzz，即 Universal Plug and Fuzz，是一款自动化的 UPnP 模糊测试工具。它会枚举网络上的所有 UPnP 端点，查找可用的服务并对其进行模糊测试。它还支持使用 Burp 代理日志对 HTTP 进行模糊测试。 它专为模糊测试嵌入式系统而设计，因此仅支持单线程。同时，它的载荷集非常有限，因为对这些系统进行模糊测试可能很慢。某些载荷如盲 SQL 注入和命令注入依赖延迟来判断注入是否成功，因此可能出现误报。其他载荷如格式字符串和缓冲区溢出则设计为使用自定义监视器来检测崩溃。...

log4j-payload-generator

0x01 Introduction log4j-payload-generator is a woodpecker framework plugin for generating log4j JNDI injection vulnerability payloads. It can currently generate the following 5 types of payloads with one click. 1. Raw payload 2. upper|lower:x type randomly mixed payload 3. upper|lower:x fully...

SpringPeace

SpringPeace SpringPeace 是一个 GPL-3.0-or-later 的 GUI/CLI 工具，用于为 CVE-2026-43499 生成 Android boot.img payload 候选。Windows 应用程序使用 SpringPeace 界面，自动检查 ADB，读取 boot.img，构建候选 payload.so，然后按 manifest 顺序通过 ADB 进行尝试。 SpringPeace 是一个 GPL-3.0-or-later 的 GUI/CLI，用于为 CVE-2026-43499 生成 Android boot.img payload...

WhatsRCE

WhatsRCE 这是一个自动生成CVE-2019-11932（WhatsApp远程代码执行）漏洞的有效载荷的工具 1. 自动安装GCC（无害命令，你可以看到这是开源的） 2. 保存为 .GIF 文件 如何使用？ root@kitploit: sudo apt install git git clone https://github.com/KeepWannabe/WhatsRCE cd WhatsRCE && bash start.sh 如何获取Shell？ 1. 只需将 .GIF 文件以 文档而非图片 的形式发送给受害者用户 2...

Text4ShellPayloads

Text4ShellPayloads Este proyecto incluye un script de Python que genera comandos maliciosos aprovechando la vulnerabilidad CVE-2022-42889 El servidor vulnerable se configuró según las indicaciones de "Karthik U J" siguiendo el paso en https://github.com/karthikuj/cve-2022-42889-text4shell-docker...

cve-2019-9081

cve-2019-9081 exp genera el payload Basta con pasar el payload como parámetro...

SpringPeace

SpringPeace SpringPeace ist eine GUI/CLI unter GPL-3.0-or-later zur Erstellung von Payload-Kandidaten aus Android boot.img für CVE-2026-43499. Die Windows-App prüft ADB, liest boot.img, erstellt payload.so-Kandidaten und testet sie über ADB in Manifest-Reihenfolge. SpringPeace ist eine GUI/CLI...

sqlicat

sqlicat Framework de SQL Injection em Python puro stdlib...

exploit-development-framework

Exploit Development Framework EDF A modular, educational ex...

AI-for-fastjson-1.2.83-RCE-skill

fastjson-1.2.83-RCEskill AI agent skill for detecting and exp...

Exploit for Code Injection in Exiftool_Project Exiftool

CVE-2021-22204 - ExifTool Arbitrary Code Execution An upgrade...

📄 HTTP/2 Multi-Server HPACK Exhaustion

This code implements a multi-target HTTP/2 resource exhaustion framework designed to stress or overwhelm server implementations through protocol-level amplification techniques. It includes server-specific payload generation for multiple platforms, automated connection orchestration, stream scalin...

Data Agents under Attack: Vulnerabilities in LLM-Driven Analytical Systems

Data agents integrate LLM-driven reasoning with relational data access, executable analytical tools, and multi-step workflow orchestration, making them increasingly central to enterprise analytics. This integration introduces new security vulnerabilities across data resources, database execution,...

Exploit for CVE-2025-66478

CVE-2025-66478-Research-Proof-of-Concept Overview This re...

The Infinite Mutation Engine? Measuring Polymorphism in LLM-Generated Offensive Code

Malware authors have traditionally relied on polymorphic techniques to produce variants in the same malware family, complicating signature-based detection. Integrating generative AI into offensive toolchains enables attackers to synthesize structurally diverse payloads with identical behavior,...

Exploit for Deserialization of Untrusted Data in Facebook React

markdown Summary CVE-2025-55182 Scanner is a high-perfor...

lightweight-msf

Lightweight-MSF !License: MIThttps://img.shields.io/badge...

linux-security-tools

Linux Security Tools Linux security tools, scanners, crackers...

📄 Jinja 2 1.4.0 Tactical RMM SSTI Detection

This proof of concept script detects potential server-side template injection vulnerabilities in web applications using template engines such as Jinja. The script sends a dynamically generated mathematical expression within a template payload to a target URL parameter. If the server evaluates the...