jwt-reauth

JWT Re-auth Burp plugin to cache authentication tokens from an "auth" URL, and then add them as headers on all requests going to a certain scope. Features The plugin allows settings to be sent to it via context menus from various menus. This includes using an entire captured request to acquire ne...

remote-control

Remote Control for Laravel Grant remote access to user account without sharing credentials. Installation Configuration Usages Routing Creating Remote Access Using Generated Access Token Installation Remote Control can be installed via composer: composer require "katsana/remote-control"...

CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

CVE-2026-1529 Keycloak Exploit Tool Keycloak: Unauthorized organization registration via improper invitation token validation Disclaimer This tool is for educational and security testing purposes only. Use only on systems you have explicit permission to test. Unauthorized access to computer syste...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

CVE-2026-105034

The EnergizeLab Eilik NestJS auth service is vulnerable to unauthenticated device-token issuance. Due to missing and improper authentication (CWE-306, CWE-287), a remote attacker can obtain a valid device token for any arbitrary robot serial number. This allows the attacker to impersonate any dev...

RottenPotatoNG

RottenPotatoNG New version of RottenPotato as a C++ DLL and standalone C++ binary - no need for meterpreter or other tools. RottenPotatoDLL This project generates a DLL and EXE file. The DLL contains all the code necessary to perform the RottenPotato attack and get a handle to a privileged token...

gh-hijack-runner

gh-hijack-runner A python script to create a fake GitHub runner and hijack pipeline jobs to leak CI/CD secrets. Discover more details in the following blogpost: https://www.synacktiv.com/publications/hijacking-github-runners-to-compromise-the-organization Exploitation If you can obtain a...

vcenter-log4j

VMware vCenter log4j workaround Script to workaround VMware vCenter log4j vulnerability CVE-2021-44228, as per the VMware KB article. 2021-12-13 02:09 UTC - Added Secure Token & Identity Management services 2021-12-13 12:46 UTC - Added PSC Client for 6.5 - see below VMware have released a python...

KEDA: Privilege escalation from namespace admin to cluster admin via KEDA TriggerAuthentication

Summary A namespace admin who creates a TriggerAuthentication and a ScaledObject in their own namespace can make the KEDA operator send its own ServiceAccount token to a tenant-controlled URL. That token holds ""/"" get cluster-wide, so it reads every Secret in every namespace, plus batch/jobs an...

EUVD-2026-97864

Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable...

TATS

TATS — Token Analysis and Tracking System Track OAuth 2.0, OIDC, and Microsoft Entra ID tokens across captured network traffic. Ingests Burp Suite XML exports, mitmproxy flow files, or live Chrome DevTools Protocol streams into a single SQLite database, then serves an interactive web dashboard fo...

CVE-2025-58434

CVE-2025-58434 - Flowise unauthenticated account takeover, chained to CustomMCP RCE Two Flowise 3.0.5 issues, chained: 1. CVE-2025-58434 - password-reset token disclosure. POST /api/v1/account/forgot-password returns the target user's tempToken directly in the JSON response. Feed it to POST...

DefinitelyNotPhishing

⚠️ Disclaimer This repository is intended solely for educational and testing purposes. All tools, configurations, and resources included here such as phishing templates, red team utilities, or offensive security scripts are provided strictly for use in authorized environments , such as labs, demos...

CVE-2026-73309

CVE-2026-73309: Empty OAuth2 credentials bypass XenForo before 2.3.13 can skip OAuth2 client-secret and PKCE verification when an empty string reaches the token endpoint. What happens The endpoint checks whether clientsecret and codeverifier keys exist, then performs the comparisons only when the...

CVE-2026-82329-JFrog-Artifactory-Auth-Bypass

artifactory.py ╔══════════════════════════════════════════════════════════╗ ║ artifactory · CVE-2026-82329 unauth admin takeover ║ ║ mitsec · https://x.com/ynsmroztas ║ ╚══════════════════════════════════════════════════════════╝ CVE-2026-82329 — JFrog Artifactory self-hosted unauthenticated...

CVE-2026-55040-Mass-Exploit

JWT Token Bypass Exploit for Microsoft SharePoint CVE-2026-55040, CVSS 9.1. Forge authentication tokens using three attack vectors: Algorithm "none" skips signature verification Weak HS256 secrets with brute-force dictionary support RS256 key substitution Impersonate any user including...

CVE-2026-48060

CVE-2026-48060 - Litestar HTML Injection Through CSRF Token This repo contains the proof of concept exploit and vulnerable application to demonstrate the HTML injection vulnerability present in version 2.21.0 of Litestar. How to Run git clone https://github.com/Blinky-Keys/CVE-2026-48060 cd...

cPanel-CVE-2026-41940-Scanner

cPanel-CVE-2026-41940-Scanner This high-performance security tool is designed to identify and exploit CVE-2026-41940 , a critical CRLF injection vulnerability in cPanel & WHM. It automates the entire process from Shodan discovery to administrative token creation. Key Features Automated Shodan...

CVE-2026-41940

CVE-2026-41940 Auto Exploit Overview CVE-2026-41940 is a proof-of-concept PoC exploit targeting cPanel/WHM. This exploit demonstrates an unauthenticated authentication bypass using CRLF injection to leak security tokens and gain root-level access to the WHM interface, allowing for actions such as...

CVE-2026-29000

CVE-2026-29000 CVE-2026-29000: Critical Authentication Bypass in pac4j-jwt - Using Only a Public Key CVSS 10 pac4j-jwt Authentication Bypass Exploit CVE-2026-29000 Vulnerability Summary CVE-2026-29000 is a critical authentication bypass in the pac4j-jwt library versions 6.0.3 and below. When the...