bl_sbx

blsbx itunesstored & bookassetd Sandbox Escape This repository contains a proof-of-concept demonstrating how maliciously crafted downloads.28.sqlitedb and BLDatabaseManager.sqlite databases can escape the sandbox of itunesstored and bookassetd on iOS. By abusing their download mechanisms, the POC...

wavecrack

Wavecrack Description A user-friendly Web interface to share an hashcat cracking box among multiple users with some pre-defined options. Screenshots The homepage Adding an hash to crack Seeing the results and some stats Outline This Web application can be used to launch asynchronous password crac...

byob

Questions? Check out the docs or join our Discord support server Disclaimer : This project should be used for authorized testing or educational purposes only. BYOB is an open-source post-exploitation framework for students, researchers and developers. It includes features such as: Command & contr...

goscan

GoScan is an interactive network scanner client, featuring auto-completion, which provides abstraction and automation over nmap. Although it started as a small side-project I developed in order to learn @golang, GoScan can now be used to perform host discovery, port scanning, and service...

hetty

Hetty is an HTTP toolkit for security research. It aims to become an open source alternative to commercial software like Burp Suite Pro, with powerful features tailored to the needs of the infosec and bug bounty community. Features Machine-in-the-middle MITM HTTP proxy, with logs and advanced...

twitter-intelligence

Twitter 情报 一个用 Python 编写的项目，用于在不使用 Twitter API 的情况下进行 Twitter 追踪与分析。 前提条件 本项目是一个 Python 3.x 应用程序。 包依赖项位于 requirements.txt 文件中。运行以下命令以安装依赖项。 root@kitploit: pip3 install -r requirements.txt 数据库 使用 SQLite 作为数据库。 推文数据存储在 Tweet、User、Location、Hashtag、HashtagTweet 表中。 数据库会自动创建。 使用示例 应用工作视图： 获取帮助...

twitter-intelligence

Twitter Intelligence A project written in Python for twitter tracking and analysis without using Twitter API. Prerequisites This project is a Python 3.x application. The package dependencies are in the file requirements.txt. Run that command to install the dependencies. root@kitploit: pip3 instal...

subcrawl

SubCrawl SubCrawl is a framework developed by Patrick Schläpfer, Josh Stroschein and Alex Holland of HP Inc’s Threat Research team. SubCrawl is designed to find, scan and analyze open directories. The framework is modular, consisting of four components: input modules, processing modules, output...

cansina

Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...

cirro

Cirro is an extensible security research platform that enables researchers and penetration testers to collect, analyze, and visualize cloud environments and identity relationships through graph databases. Built with a modular architecture, Cirro can be extended to support multiple platforms and...

telegram-story-scraper

Telegram Story Scraper 📱 A Python script that allows you to automatically scrape and download stories from your Telegram friends using the Telethon library. The script continuously monitors and saves both photos and videos from stories, along with their metadata. TGSS - Main Interface Important...

trivy-java-db

trivy-java-db 概述 trivy-java-db 从 maven-index 仓库数据构建一个 SQLite 数据库，存储 jar 文件的 ArtifactID、GroupID、Version 和 sha1。 该数据库在 Trivy 中用于发现内部没有 GAV 信息的 jars 的相关信息。 更新间隔 每天 00:00 下载 java 索引数据库 你可以通过 Trivy 或 Oras CLI 下载实际编译好的数据库。 Trivy: root@kitploit: TRIVYTEMPDIR=$mktemp -d trivy --cache-dir $TRIVYTEMPDIR...

dicozorus

Dicozorus Dicozorus is a tool to generate and maintain web wordlists. It eliminates the overhead of managing multiple wordlists by storing paths enriched with metadata in a local SQLite database. Just want a great wordlist without the tool? Skip the setup and use lazy.txt. Why Dicozorus? Standard...

pike-agent

Pike Agent pike-agent records and analyzes how programs behave on Linux. It traces a program's activity, indexes it into a database, and lets you chat with an LLM agent about it in a TUI. Example of prompts: Crash diagnosis: This program crashed with a bus error. What happened? Race condition...

CVE-Vulnerability-Information-Downloader

CVE Vulnerability Information Downloader Common Vulnerability Scoring System CVSS is a free and open industry standard for assessing the severity of computer system security vulnerabilities. Exploit Prediction Scoring System EPSS estimates the likelihood that a software vulnerability will be...

Backdooring-ZMM100-FingerPrint-Devices

Hacking Embedded Devices : root@kitploit: Hardware platform ZMM100 : The fingerprint access control device Made by ZKSoftware. Default User/Password : root:solokey Protocol : Telnet 23. Scripts : pwnit.py : Automated tool for hacking devices. hell : second backdoor. leak-data.sh : third backdoor...

CVE-2026-61570

The MPXJ open-source library (versions 5.5.5 through 16.4.1 ) is vulnerable to an XML External Entity (XXE) injection. The flaw exists in the MerlinReader component when parsing XML from the ZTIMEINTERVALS column of a Merlin project SQLite database. Because the DocumentBuilder uses default settin...

CVE-2023-31717

CVE-2023-31717 It is possible to do SQL Injection into the HTTP POST id parameter passed in the body as json, being able to extract confidential information from the SQLite database Payload - "id":"n7c734712-aabf4eb3' AND 2630=LIKECHAR65,66,67,68,69,70,71,UPPERHEXRANDOMBLOB500000000/2 AND...

Teamsniper

Teamsniper Teamsniper es una herramienta para buscar palabras clave en Microsoft Teams, como contraseñas, correos electrónicos, base de datos, etc.. Uso Opciones de Ayuda root@kitploit: usage: Teamsniper.py -h -d DATABASE -a AUTHTOKEN -s SEARCH Teamsniper is a tool for fetching the given keywords...

EUVD-2026-83460

The application protects access through its calculator-style vault passcode, but the stored data is not bound to that authentication boundary. A local actor who can access shared external storage, such as through an authorized non-root ADB shell or another local file-reading context with suitable...