CVE-2025-49113

📧 Roundcube ≤ 1.6.10 Post-Auth RCE через десериализацию PHP-объектов CVE-2025-49113 🔍 Разбор Критическая уязвимость удаленного выполнения кода после аутентификации была обнаружена в Roundcube версии ≤ 1.6.10, вызванная небезопасной десериализацией PHP-объектов. Эта серьезная ошибка незаметно...

kurukshetra

Kurukshetra Kurukshetra est un framework web développé dans le but d'être le premier framework open source à fournir une base solide pour héberger des défis de codage sécurisé raisonnablement complexes, tout en offrant la possibilité d'exécuter chaque défi de manière efficace et dynamique en...

kurukshetra

Kurukshetra Kurukshetra is a web framework that’s developed with the aim of being the first open source framework which provides a solid foundation to host reasonably complex secure coding challenges while still providing the ability to efficiently and dynamically execute each challenge on the...

OWASP-mth3l3m3nt-framework

OWASP Mth3l3m3nt Framework A slightly major forgive pun upgrade is on going. This is to bring in things like: Easier coding standard Support for PHP 8 More robust features Fix bug requests sent in. This tool is released under GNU Affero General Public License v3. Modules Packed in so far are:...

fbchecker

ABANDONED Facebook block multiple access with their API FACEBOOK MASS ACCOUNT CHECKER Facebook Mass Account Checker Without Locked Account Simple Installation : root@kitploit: apt install git php -y git clone https://github.com/fdciabdul/fbchecker cd fbchecker php fbcheck.php Usage root@kitploit:...

password-generator

Password Generator For BruteForce or Md5 Crack/Comparison root@kitploit: $ php password-generator --info="victim name,victim surname , victim age , victim email" --info Get all information from victim. --path The area where the file will be saved optional. --md5 The passwords created with this...

cve-2026-67363-67364

Balbooa Forms пред-авторизационный RCE + подмена платежей CVE-2026-67364 / CVE-2026-67363 PoC и шаблоны обнаружения для двух пред-авторизационных уязвимостей в Balbooa Forms combaforms для Joomla, исправленных в 2.4.3.2. CVE-2026-67364 — Пред-авторизационная инъекция PHP-кода - RCE CVSS 9.8...

PhoneMonitor

PhoneMonitor Un outil d'administration à distance pour les appareils Android. La version minimale du SDK pour l'application est l'API 15 et, de par sa nature, le niveau d'API cible est logiquement 21. Instructions : Ouvrez le dossier PhoneMonitor avec Android Studio. Remplacez les chaînes XXXX pa...

CVE-2024-2961-Remote-File-Read

CVE-2024-2961 Удаленное чтение файлов Этот скрипт демонстрирует, как эксплуатировать уязвимость в системах, использующих библиотеку iconv, при некорректной обработке преобразований кодировок символов, описанную в CVE-2024-2961. Он позволяет злоумышленнику читать произвольные файлы с сервера,...

flashsploit

Exploitation Framework for ATtiny85 HID Attacks Twitter - Telegram - Blog Available in Flashsploit is an Exploitation Framework for Attacks using ATtiny85 HID Devices such as Digispark USB Development Board, flashsploit generates Arduino IDE Compatible .ino Scripts based on User Input and then...

Remot3d

Remot3d - An Easy Way To Exploiting Will be updated soon Remot3d - A tool made to generate backdoor to control and exploit a server where the server runs the PHP Hypertext Preprocessor program. Equipped with a backdoor that has been obsfucated, which means that it shoudl generally be FUD Fully...

Chankro

Chankro Votre outil préféré pour contourner disablefunctions et openbasedir lors de vos tests d'intrusion. Comment ça fonctionne Sous Linux, PHP appelle un binaire sendmail lorsque la fonction mail est exécutée. Si putenv est autorisé, nous pouvons définir la variable d'environnement "LDPRELOAD",...

CVE-2019-11043

CVE-2019-11043 Python эксплойт для CVE-2019-11043 root@kitploit: You can use build environment from https://github.com/vulhub/vulhub/tree/master/php/CVE-2019-11043 Использование： root@kitploit: python3 main.py -u http://iptopage/index.php В случае успеха вы увидите: root@kitploit: Base status cod...

CVE-2024-4577

🚀 CVE-2024-4577: Сканер и эксплойт PHP CGI Argument Injection 🛡️ Обзор CVE-2024-4577 — это критическая уязвимость , затрагивающая PHP-приложения, использующие Common Gateway Interface CGI. Этот инструмент выступает в качестве как сканера , так и эксплойта , позволяя специалистам по...

DVWA

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Application DVWA is a PHP/MariaDB web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of...

CVE-2021-3007-docker-poc

CVE-2021-3007 — Laminas/Zend HTTP 역직렬화 RCE 이 저장소는 Zend\Http\Response\Stream laminas-http Nuclei 익스플로잇 템플릿 ├── docker-compose.yml - 취약한 테스트 환경 ├── Dockerfile ├── vulnerable-app/ │ ├── index.php - unserialize 취약점이 있는 엔드포인트 │ └── composer.json - 취약한 종속성 ├── exploit.php - 독립 실행형 익스플로잇 스크립트 └──...

msmap

MSMAP Msmap is a Memory WebShell Generator. Compatible with various Containers, Components, Encoder, WebShell / Proxy / Killer and Management Clients. 简体中文 The idea behind I, The idea behind II, The idea behind III Feature WIP Function Dynamic Menu Automatic Compilation Generate Script...

bantam

Bantam Un outil avancé de gestion de backdoor PHP, avec une empreinte serveur légère, une communication multi-thread et un outil de génération et d'obscurcissement de payload avancé. Il propose un chiffrement de bout en bout avec des clés de chiffrement uniques par requête et un streaming de...

bantam

Bantam An advanced PHP backdoor management tool, with a lightweight server footprint, multi-threaded communication, and an advanced payload generation and obfuscation tool. Features end to end encryption with request unique encryption keys, and payload streaming designed to bypass WAF, IDS, SIEM...

XORpass

XORpass is an encoder to bypass WAF filters using XOR operations. Installation & Usage root@kitploit: git clone https://github.com/devploit/XORpass cd XORpass $ python3 xorpass.py -h Example of bypass: Using clear PHP function: Using XOR bypass of that function: root@kitploit: $ python3 xorpass.p...