toastfix-demo

ToastFix デモ このプロジェクトは、説得力のあるWindowsトースト通知がソーシャルエンジニアリング攻撃、特にClickFixスタイルのルアーで悪用される方法を示しています。 ライブデモはこちらで利用可能です（より現実的な攻撃）： 👉 https://h4lpy.github.io/ このテクニックの詳細な解説は私のMedium記事にあります： 👉 https://0xh4lpy.medium.com/toastfix-chaining-a-clickfix-attack-with-toast-notifications-72082694fef9 何が起こるか？ 1...

fb-phisher-python

Facebook Phishing Original Author : Arslan Mughal BY : arjunindia original repository : https://github.com/arslanmughal5566/facebookphishing About Script : With this script you can perform Facebook login credentials stealing with some social engineering skills. requirements : 1 : Python3.x 2 :...

SPF

SPF SpeedPhish Framework is a python tool designed to allow for quick recon and deployment of simple social engineering phishing exercises. Requirements: dnspython twisted PhantomJS Installation root@kitploit: apt-get update apt-get upgrade -y apt-get install git build-essential python-dev...

sack

sack 识别用于社会工程攻击的会话连接。 ========== 这是第一个通过社交支持实时攻击来跟踪受害者的框架。 root@kitploit: 使用示例：python sack.py 必须以root模式运行。 支持简单模块的开发 不能忘记的一件事 stats.html 这里你可以看到受害者跟踪的统计信息。 root@kitploit: Modules go codename value 这个工具的创作灵感来自爱，尽管过程很混乱。我在哥伦比亚的DragonJAR安全会议2016和墨西哥的DurivaCON上提到过它。 你喜欢监视你的受害者吗？用sack可以...

CVE-2010-1240

CVE-2010-1240 - 在 PDF 中嵌入后门 ⚠️ 仅供教育和授权的安全研究使用 描述 Windows 和 Mac OS X 上的 Adobe Reader 和 Acrobat 9.x（低于 9.3.3）及 8.x（低于 8.2.3）未限制“启动文件”警告对话框中一个文本字段的内容，这使得远程攻击者更容易诱骗用户执行 PDF 文档中指定的任意本地程序，例如，某文本字段声称“打开”按钮将允许用户阅读加密消息。 演示 操作指南 1. 首先，运行 msfconsole root@kitploit: msfconsole 2. 然后，设置用于嵌入 PDF 的载荷...

fluxion

Fluxion 是 MITM WPA 攻击的未来 Fluxion 是 vk496 的 linset 的重制版，希望拥有更少的 bug 和更多的功能。它与最新的 Kali（滚动版）兼容。最新构建（稳定版）和（测试版）可在此处找到 此处 https://sourceforge.net/projects/wififluxion/files/?source=navbar。如果你是新手，或者对项目不太了解，请查看 wiki https://github.com/deltaxflux/fluxion/wiki/Tutorial。攻击大多是手动的，但实验版本会自动处理稳定版本的大多数功能。...

CVE-2026-87581

A flaw was found in Google Chrome's Payments component. A remote attacker, leveraging social engineering, could exploit a use-after-free vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially lead to the execution of arbitrary code outside the browser's...

social-engineer-toolkit

Social-Engineer Toolkit SET Social-Engineer Toolkitは、許可されたソーシャルエンジニアリング評価のためのオープンソースのペネトレーションテストフレームワークです。SETは、ユーザーの意識をテストし、コントロールを検証し、同意に基づくレッドチーム演習を実施する必要があるセキュリティチーム向けに、ガイド付きの攻撃ベクトルを提供します。 SETは、David Kennedy ReL1K / @HackingDave によって書かれたTrustedSecプロジェクトです。 責任ある使用...

camjacking

Camjacking CamJacking is an enterprise-grade security awareness training framework designed to simulate realistic phishing attacks targeting camera permissions and user awareness 🎯 What is CamJacking? CamJacking is an enterprise-grade security awareness training framework designed to simulate...

CVE-2026-87569

A flaw was found in Google Chrome. Missing authorization in the Views component allows a remote attacker, leveraging social engineering, to bypass system access restrictions. This can be achieved by enticing a user to open a specially crafted HTML page...

CVE-2026-87526

A flaw was found in Chromium. A remote attacker leveraging social engineering could exploit a use-after-free vulnerability in the Passwords component. This could potentially allow the attacker to execute arbitrary code outside the sandbox via user interface interaction...

CVE-2026-87504

A flaw was found in Google Chrome. This use-after-free vulnerability allows a remote attacker to execute arbitrary code outside the browser's security sandbox. This exploitation occurs when a user is persuaded through social engineering to install a specially crafted Chrome extension...

AtlasReaper

AtlasReaper AtlasReaper is a command-line tool developed for offensive security purposes, primarily focused on reconnaissance of Confluence and Jira. It also provides various features that can be helpful for tasks such as credential farming and social engineering. The tool is written in C. Blog...

CVE-2026-87447

A flaw was found in the Network component of Google Chrome. This vulnerability, stemming from incorrect authorization, could allow a remote attacker to bypass the web origin policy. By leveraging social engineering and a specially crafted Chrome extension, an attacker could potentially gain...

CVE-2026-87436

A flaw was found in Chromium. A remote attacker, leveraging social engineering, could exploit an incomplete cleanup vulnerability in the browser. This could allow the attacker to bypass the web origin policy through a specially crafted extension, potentially leading to unauthorized access to...

SMSOTPBOT

ghost-OTPBOT ghost-OTPBOT is the most advanced and versatile OTP & SMS capture bot that is capable of getting OTP & SMS codes from victims by impersonating a company or bank. You can use this to get OTP for logins, banks, credit cards, apple pay, and more. Join...

cuddlephish

CuddlePhish ペネトレーションテスター向けの、多ユーザー対応ブラウザ・イン・ザ・ミドル（BitM）攻撃ツールです。この攻撃は、多くの高価値ウェブアプリケーションで多要素認証をバイパスするために使用できます。セッショントークンを使用しないアプリケーションでも機能するため、従来のトークン窃取攻撃では悪用できなかったアプリケーションにも対応します。これはソーシャルエンジニアリングツールであり、ターゲットサービスの技術的な欠陥を悪用するものではありません。 QuickStart（クイックスタート） このツールは専用のウェブサーバーです。Debian...

CVE-2026-84353

A flaw was found in Google Chrome on Android. This vulnerability, located in the Shared Tab Groups component, is a 'use after free' issue, which means the software attempts to use memory after it has been freed, potentially leading to corruption. A remote attacker could exploit this by leveraging...

CVE-2026-84325

A flaw was found in chromium-browser. This improper input validation vulnerability in the DataTransfer component allows a remote attacker, through social engineering, to bypass system access restrictions by leveraging a co-installed application. This could lead to unauthorized access to sensitive...

CVE-2026-84354

A flaw was found in Google Chrome's FileSystem component. A remote attacker could exploit this vulnerability by leveraging social engineering techniques to trick a user into opening a specially crafted HTML page. This could lead to the execution of arbitrary code outside of the browser's security...