serval

A Netcat style backdoor for pentesting and pentest challenges Serval is a lightweight, easy-to-use, binary for spawning reverse and bind shells for pentests or pentesting exercises. Serval is cross platform and can be compiled for both Windows 32 & 64-bit and Linux 32 and 64-bit. Note: Due to the...

shells

Shellz 一个快速简便生成常见反弹shell的脚本。 特别适合在需要PowerShell和Python反弹shell时使用，这些shell的格式正确配置往往很麻烦。 PowerShell 反弹shell 在提示符和工作目录上方显示用户名@计算机.域名 包含部分和完整的AMSI绕过。 TCP、UDP和SSL shell 新增自定义TCP反弹shell！ 新增自定义SSL反弹shell！ 反射加载 theart42 的 出色 Sharpcat! Windows PowerShell 和 Core PowerShell 用于上传和下载文件的函数。（使用 sc0tfree 的 Updog）...

pwncat

pwncat pwncat is a post-exploitation platform for Linux targets. It started out as a wrapper around basic bind and reverse shells and has grown from there. It streamlines common red team operations while staging code from your attacker machine, not the target. pwncat used to only support Linux, b...

HackTools

Welcome to HackTools ! Introduction — Preview — Install — Build — Support !NOTE Psst... Loved HackTools? 👀 Check out Penflow - our new security testing companion! Try it at map.penflow.sh 🚀 !NOTE Dear Users, We're excited to announce a major revamp of our app! Due to recent changes and multiple...

shellerator

Shellerator Shellerator is a simple CLI/TUI tool aimed to help pentesters quickly generate reverse, bind and web shells in multiple programming languages like Bash, Powershell, Netcat, PHP, ASPX, etc. Another similar project for the generation of one-line file downloading commands is based on thi...

Brosec

Overview tl;dr Brosec is a terminal based reference utility designed to help us infosec bros and broettes with useful yet sometimes complex payloads and commands that are often used during work as infosec practitioners. An example of one of Brosec's most popular use cases is the ability to genera...

Kautilya

Kautilya Kautilya is a toolkit which provides various payloads for a Human Interface Device which may help in breaking in a computer during penetration tests. By nikhilmitt List of Payloads Windows Gather Gather Information Hashdump and Exfiltrate Keylog and Exfiltrate Sniffer WLAN keys dump Get...

JustTryHarder

JustTryHarder JustTryHarder is a cheat sheet which will aid you through the PWK course & the OSCP Exam. Inspired by PayloadAllTheThings Feel free to submit a Pull Request & leave a star to share some love if this helped you. 💖 Hacktoberfest friendly! Yes, we are open to Pull Requests for...

RedGhost

RedGhost Linux post exploitation framework designed to assist red teams in persistence, reconnaissance, privilege escalation and leaving no trace. Payloads Function to generate various encoded reverse shells in netcat, bash, python, php, ruby, perl SudoInject Function to inject sudo command with...

c2-cloud

About The Project The C2 Cloud is a robust web-based C2 framework, designed to simplify the life of penetration testers. It allows easy access to compromised backdoors, just like accessing an EC2 instance in the AWS cloud. It can manage several simultaneous backdoor sessions with a user-friendly...

flashsploit

Exploitation Framework for ATtiny85 HID Attacks Twitter - Telegram - Blog Available in Flashsploit is an Exploitation Framework for Attacks using ATtiny85 HID Devices such as Digispark USB Development Board, flashsploit generates Arduino IDE Compatible .ino Scripts based on User Input and then...

erl_mouse

erlmouse version 1.1 Alright, I've improved several things to increase chances of finding a vulnerable device or network. Most are not public facing, have been patched, or are so oscure that it can be difficult to find a target. Nevertheless, we persist. You can now scan every IP address in china...

Harmonic

Harmonic Suite Beginning of a linux toolset for managing and interfacing with reverse shells code is still currently in a quick and dirty state, with little exception handling. With a strong inspiration in UNIX philosophy, the basic idea is to have a daemon for handling arbitrary end points connd...

Cybersec

Offensive CyberSec Cheat Sheet A highly dynamic, single-file HTML cheat sheet designed for Red Teamers, Pentesters, and CTF players. Tired of typing the same Reverse Shell payloads and constantly replacing your local IP and port? This tool eliminates the "Typo Fatigue" and cognitive load during...

Exploit for OS Command Injection in Devcode Openstamanager

CVE-2025-69212 OpenSTAManager --check Vulnerabili...

MAL-2026-6235 Malicious code in yianzzkf6687 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a59a0aee58573b3030b9d541980fa9d7df8ea55d4e6cc5b3bb349452b908d0e9 On npm install, the postinstall hook scripts/postinstall.js detach-spawns scripts/shell.js with detached: true, stdio: 'ignore', windowsHide: true an...

MAL-2026-6217 Malicious code in aikaf788812 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c91950cef6a5f877a4a9bca074501e4c910dc50008d4c8c2623ddc21f08e31f2 Package masquerades as a string-utility library but ships a postinstall backdoor. On npm install, scripts/postinstall.js spawns scripts/shell.js as a...

CVE-2018-25320

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to...

EUVD-2018-21841

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to...

CVE-2018-25320 ACL Analytics 11.x - 13.0.0.579 Arbitrary Code Execution

ACL Analytics versions 11.x through 13.0.0.579 contain an arbitrary code execution vulnerability that allows attackers to execute arbitrary commands by leveraging the EXECUTE function. Attackers can use bitsadmin to download malicious PowerShell scripts and execute them with system privileges to...