yolo-cage

yolo-cage: autonomous coding agents that do no harm You're a responsible engineer. You'd never just let an AI run roughshod through your most sensitive systems and codebases. That's why you'd never just shut off the safeguards for a tool like Claude Code. It asks permission for every dangerous...

jsubfinder

JSubFinder is a tool writtin in golang to search webpages & javascript for hidden subdomains and secrets in the given URL. Developed with BugBounty hunters in mind JSubFinder takes advantage of Go's amazing performance allowing it to utilize large data sets & be easily chained with other tools...

JSFScan.sh

JSFScan.sh Blog can be found at https://medium.com/@patelkathan22/beginners-guide-on-how-you-can-use-javascript-in-bugbounty-492f6eb1f9ea?sk=21500dc4288281c7e6ed2315943269e7 Script made for all your javascript recon automation in bugbounty. Just pass subdomain list to it and options according to...

CVE-2025-55449-AstrBot-RCE

Introduction AstrBot =3.5.17 hardcodes a JWT secret in the source code, allowing arbitrary plugin uploads and leading to RCE. Usage root@kitploit: python main.py 'http://127.0.0.1:6185' Source Code https://github.com/AstrBotDevs/AstrBot.git...

CVE-2025-59390-

CVE-2025-59390- The attached POC will allow you to crack the Kerberos signiture in Apache Druid and also, any integer created by ThreadLocalRandom Advisory - Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret...

CVE-2026-55993

camel-atmosphere-websocket Header Injection Reproducer CVE-2026-55993 This project demonstrates a message-header injection in Apache Camel's camel-atmosphere-websocket component, tracked as CVE-2026-55993. The WebSocket consumer copies the connection's query parameters onto the Camel Exchange...

jwt-key-id-injector

JWT Key ID Injector Simple python script to check against hypothetical JWT vulnerability. Let's say there is an application that uses JWT tokens signed HS256 algorithm. An example token looks like the follow: root@kitploit:...

CVE-2022-45771

CVE-2022-45771 The PwnDoc is vulnerable to both path traversal and local file inclusion LFI, which allows unprivileged users to disclose JWT secrets and achive code execution. Requirements: An attacker has valid account with user role The application has a report template with either...

In-Spectre-Meltdown

In-Spectre-Meltdown This tool allows to check speculative execution side-channel attacks that affect many modern processors and operating systems designs. CVE-2017-5754 Meltdown and CVE-2017-5715 Spectre allows unprivileged processes to steal secrets from privileged processes. These attacks prese...

gitbleed_tools

GitBleed Tools - मिरर किए गए Git रिपॉजिटरी से डेटा निकालने के उपकरण परिचय इस रिपॉजिटरी में शेल स्क्रिप्ट हैं जिनका उपयोग क्लोन और मिरर Git रिपॉजिटरी के बीच अंतर डाउनलोड और विश्लेषण करने के लिए किया जा सकता है। Git के व्यवहार में अंतर्निहित विचित्रता के बारे में अधिक जानकारी के लिए कृपया हमारा ब्ल...

apkprobe

APKprobe APK decompiler and secrets scanner for Android security research. Automatically extract API keys , endpoints , tokens , and other leaked credentials from Android applications. Works with .apk, .xapk, .dex, .jar, .class, .smali, .zip, .aar, .arsc, .aab files. Perfect for apk2url extractio...

cred_scanner

credscanner أداة سطر أوامر بسيطة للعثور على بيانات اعتماد AWS في الملفات. مُحسَّنة للاستخدام مع Jenkins وأنظمة CI الأخرى. أعتقد أن هناك أدوات أخرى أفضل متاحة مثل git-secrets، لكنني لم أجد أداة تقوم بفحص سريع وغير دقيق وتتكامل جيدًا مع Jenkins أيضًا. الاستخدام: للتثبيت، ما عليك سوى نسخه إلى المكان...

subjs

subjs subjs URL की सूची या सबडोमेन से जावास्क्रिप्ट फ़ाइलें लाता है। जावास्क्रिप्ट फ़ाइलों का विश्लेषण करने से आपको अप्रलेखित एंडपॉइंट, रहस्य और बहुत कुछ खोजने में मदद मिल सकती है। इसे gau और फिर LinkFinder के साथ जोड़ने की अनुशंसा की जाती है। संसाधन उपयोग स्थापना उपयोग: उदाहरण: root@kitploit: $...

grafanaExp

grafanaExp Exploit Grafana CVE-2021-43798 arbitrary file read vulnerability to automatically detect vulnerability, existing plugins, extract secret key, decrypt server database file, and output datasourrce info. Usage Provides exp and decode functionality. root@kitploit: ➜ ./grafanaExp -h NAME:...

CVE-2026-45332-PoC

CVE-2026-45332: Broken Access Control in Automad CMS Proof of concept for CVE-2026-45332 , a Broken Access Control vulnerability in Automad CMS that allows any unauthenticated attacker to dump the bcrypt password hash and TOTP secret of every administrator account through the setup endpoint, whic...

DumpTheGit

DumpTheGit DumpTheGit searches through public repositories to find sensitive information uploaded to the Github repositories. The tool will flag the matches for potentially sensitive files like credentials, secret keys, tokens etc which have been accidentally uploaded by the developers. DumpTheGi...

FallingSkies-CVE-2023-35885

CVE-2023-35885 Cloudpanel 0-day शोषण लेखक: @EagleTube, @Mzulfahmy, @farphalabs Github : https://github.com/datackmy/FallingSkies-CVE-2023-35885/blob/main/ प्रभावित संस्करण: v2.0.0 – v2.3.0 पैच किया गया संस्करण: v2.3.1 विक्रेता होमपेज: CloudPanel.io उत्पाद: CloudPanel संदर्भ:...

git-all-secrets

git-all-secrets परिचय git-all-secrets एक उपकरण है जो निम्नलिखित कार्य कर सकता है: किसी संगठन के कई सार्वजनिक/निजी गिटहब रिपॉजिटरी को क्लोन करके उन्हें स्कैन करना, किसी संगठन से संबंधित उपयोगकर्ता की कई सार्वजनिक/निजी गिटहब रिपॉजिटरी को क्लोन करके उन्हें स्कैन करना, किसी संगठन की एकल सार्वजनिक/निज...

reposcanner

Reposcanner Reposcanner is a python script to search through the commit history of Git repositories looking for interesting strings such as API keys, inspired by truffleHog. Installation The python Git module is required python3-git on Debian. Docker root@kitploit: docker build -t reposcanner...

CVE-2026-3288

CVE-2026-3288: ingress-nginx Configuration Injection via rewrite-target Annotation Keywords: CVE-2026-3288, ingress-nginx vulnerability, Kubernetes security, nginx configuration injection, rewrite-target annotation, RCE, Secret disclosure, CWE-20, CAPEC-176, ingress-nginx CVE 2026, Kubernetes...