tor-rootkit

tor-rootkit A Python 3 standalone Windows 10 / Linux Rootkit. The networking communication get's established over the tor network. This rootkit is WIP. Disclaimer Use for educational purposes only. How to use 1. Clone the repo and change directory: root@kitploit: git clone...

EUVD-2026-78208

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

CA Common Services privilege escalation CVE-2016-9795 revisited Description In one of my pentests, I stumbled across the casrvc SUID binary which is part of CA Common Services suite. As I found out, the binary is vulnerable to local privilege escalation. As a matter of fact, a public CVE...

CVE-2018-12463

CVE-2018-12463 Vulnerabilidad de entidad externa XML XXE en /ssc/fm-ws/services en Fortify Software Security Center SSC 17.10, 17.20 y 18.10 permite a usuarios remotos no autenticados leer archivos arbitrarios o realizar ataques de falsificación de solicitudes del lado del servidor SSRF mediante ...

CVE-2019-6340

Drupal Drupal 8.6.x RCE Exploit CVE del exploit: CVE-2019-6340 CMS: Drupal Versión del CMS: Drupal 8.6.x probada condición: Drupal 8.6.x, 8.6.10 o Drupal 8.5.11 El módulo RESTful Web Services está habilitado...

Scrummage

Scrummage VERSIÓN 3.9 Mejora en la gestión de dependencias migración a Poetry Verificación de tipos más estricta de variables. Mejora del anonimato del archivo de configuración mediante cifrado. Ahora es difícil editar manualmente el archivo de configuración y se recomienda no editarlo manualment...

Onionscan

despliegue de onionscan ¡nota! este repositorio es una versión parcheada de https://github.com/s-rah/onionscan y está diseñado para ejecutarse desde una consola de Google Cloud desde hunchly en https://github.com/hunchly/funchly/tree/main/onionscan que se ha utilizado como base y se ha modificado...

Remote-Desktop-Services-Remote-Code-Execution-Vulnerability-CVE-2019-0708-

Remote-Desktop-Services-Remote-Code-Execution-Vulnerability-CVE-2019-0708- exploit de rce , hecho para funcionar con pocsuite3 https://github.com/knownsec/pocsuite3 instala el pocsuite 3 desde el enlace de arriba. Si tienes algún problema , contacta con el equipo knownsec-404 No abras ningún issu...

norimaci

Norimaci "Norimaci" is a simple and lightweight malware analysis sandbox for macOS. This tool was inspired by "Noriben". Norimaci uses the features of OpenBSM or Monitor.app to monitor macOS system activity instead of Sysinternals Process Monitor procmon. Norimaci consists of 3 Python scripts...

nerve

Motor de Explotación, Reconocimiento y Vulnerabilidades de Red N.E.R.V.E Tabla de Contenidos Continuous Security About NERVE What is NERVE Features Prerequisites Installation Deployment Recommendations Installation - Docker Installation - Bare Metal Installation - Multi Node Upgrade Security Usag...

heartbleedscanner

Heartbleed Scanner Network Scanner for OpenSSL Memory Leak CVE-2014-0160 -t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r...

gattacker

A Node.js package for BLE Bluetooth Low Energy Man-in-the-Middle & more. Prerequisites see: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno Install root@kitploit: npm install gattacker Usage Configure Running both components Set up variables in config.env:...

gattacker

BLE（Bluetooth Low Energy）Man-in-the-Middle などのためのNode.jsパッケージ。 前提条件 参照： https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno インストール root@kitploit: npm install gattacker 使い方 設定 両方のコンポーネントを実行する場合、config.envで変数を設定します： NOBLEHCIDEVICEID : noble（"central", ws-slave）デバイス...

CVE-2026-91079

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...

EUVD-2026-77714

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...

CVE-2024-38472

Windows의 Apache HTTP Server에 있는 SSRF 취약점CVE-2024-38472을 위한 RCE원격 코드 실행 Metasploit 모듈을 만드는 것은 까다롭습니다. SSRF 자체가 직접적으로 RCE를 발생시키지 않기 때문입니다. 하지만 SSRF는 특히 내부 서비스와 상호 작용하거나 2차 취약점을 트리거하는 데 사용할 수 있는 경우, RCE를 달성하기 위한 한 단계가 될 수 있습니다. SSRF를 통한 RCE 전략 SSRF를 통해 RCE를 달성하려면 일반적으로 다음이 필요합니다: 1. SSRF를 통해 악용할 수 있...

domainhunter

Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: x86/EFI: The deferral of freeing boot services memory The efifreebootservices function frees the memory occupied by EFIBOOTSERVICESCODE and EFIBOOTSERVICESDATA using memblockfreelate. There are two issues with this approach:...

Astra Linux – Vulnerability in nss

During RSA key generation, bignum implementations used a variant of the Binary Extended Euclidean Algorithm, which involved significant input-dependent processes. This allowed attackers to perform electromagnetic-based side-channel attacks to capture traces that could lead to the recovery of secr...