dcipher

dcipher Decipher hashes using online rainbow & lookup table attack services. Install root@kitploit: ❯❯❯ npm install dcipher Usage root@kitploit: const dcipher = require'dcipher'; dcipher'21232f297a57a5a743894a0e4a801fc3'.thenplaintext = console.logplaintext; //= 'admin' ;...

CVE-2026-36670

CVE-2026-36670 A time-based blind SQL injection exploit for the OpenSIPS Control Panel. This exploit abuses an authenticated sql injection vulnerability within the aliasmanagement.php module of opensips. The table GET parameter is improperly sanitized, allowing an attacker to inject a crafted...

bn-uefi-helper

bn-uefi-helper ATTENTION: This plugin has been deprecated. See EFI Resolver Description Helper plugin for analyzing UEFI firmware. This plugin contains the following features: Apply the correct prototype to the entry point function Fix segments so all segments are RWX and have the correct semanti...

CVE-2020-11890

Made by HK CVE-2020-11890: Improper input validations in the usergroup table class could lead to a broken ACL configuration to RCE Link https://developer.joomla.org/security-centre/810-20200402-core-missing-checks-for-the-root-usergroup-in-usergroup-table.html PoC Affected version: Joomla core...

KVM-Januscape

KVM-XJ Hot Patch dumptool.py automatically finds offsets; how to use it? Just read the code. Vulnerability Overview CVE-2026-53359 Januscape is a use-after-free UAF vulnerability in the Linux kernel KVM shadow MMU. Lurking time : 16 years August 2010 to July 2026 Affected range : All Intel/AMD x8...

CVE-2026-82722

ash-project ash_admin (an Elixir/BEAM library) is vulnerable to node-level denial of service via its LiveView event handlers. Two handlers interned atoms from unvalidated client input: AshAdmin.PageLive's set_actor used Module.concat/1 on the resource/domain payload, and AshAdmin.Components.Resou...

rainbowcrackalack

Rainbow Crackalack Author: Joe Testa @therealjoetesta About This project produces open-source code to generate rainbow tables as well as use them to look up password hashes. While the current release only supports NTLM, future releases may support MD5, SHA-1, SHA-256, and possibly more. Both Linu...

lst2x64dbg

lst2x64dbg This command extracts all the labels found in the LST file that is given as the single argument. An x64dbg database is created in the current directory based on the extracted labels. The LST file can be generated in IDA from the File menu: Produce file - Create LST file... Example...

HookDump

HookDump EDR function hook dumping Please refer to the Zeroperil blog post for more information https://zeroperil.co.uk/hookdump/ Building source In order to build this you will need Visual Studio 2019 community edition is fine and CMake. The batch file Configure.bat will create two build...

hashcobra

hashcobra hashcobra Hash Cracking tool. Description This tool uses a new method to crack hashes. With the help of rainbow tables concept this tool generates rainbow tables from wordlists to heavily optimize the cracking process. Usage root@kitploit: $ ./hashcobra -H --== hashcobra by sepehrdad ==...

dcipher-cli

dcipher-cli Crack hashes using online rainbow & lookup table attack services, right from your terminal. Install root@kitploit: ❯❯❯ npm install -g dcipher-cli Usage root@kitploit: ❯❯❯ dcipher --help Crack hashes using online rainbow & lookup table attack services, right from your terminal. Usage ❯...

ProcessInjection

ProcessInjection The program is designed to perform process injection. Currently the tool supports 5 process injection techniques. root@kitploit: 1 Vanilla Process Injection 2 DLL Injection 3 Process Hollowing 4 APC Queue 5 KernelCallbackTable Injection The tool accepts shellcode in 4 formats...

Dagon

Dagon - Advanced Hash Manipulation Named after the prince of Hell, Dagon day-gone is an advanced hash cracking and manipulation system, capable of bruteforcing multiple hash types, creating bruteforce dictionaries, automatic hashing algorithm verification, random salt generation from Unicode to...

solarflare

solarflare Credential Dumping Tool for SolarWinds Orion Blog post: https://malicious.link/post/2020/solarflare-release-password-dumper-for-solarwinds-orion/ Credit to @asolino, @gentilkiwi, and @skelsec for helping me figuring out DPAPI. root@kitploit: ============================================...

unlicense

Unlicense Инструмент на Python 3 для динамической распаковки исполняемых файлов, защищённых с помощью Themida/WinLicense 2.x и 3.x. Предупреждение: этот инструмент запускает целевой исполняемый файл. Если вы не уверены в том, что делает целевой исполняемый файл, обязательно используйте этот...

hashcatch

hashcatch Hashcatch deauthenticates clients connected to all nearby WiFi networks and tries to capture the handshakes. It can be used in any linux device including Raspberry Pi and Nethunter devices so that you can capture handshakes while walking your dog Written by @SivaneshAshok PoC of hashcat...

ExportDumper

ExportDumper A small tool I made to dump the export table of PE files. The primary use case was intended for use within DLL proxying. Usage root@kitploit: .\ExportDump dllpath e.g. root@kitploit: .\ExportDump C:\Windows\System32\version.dll Dumping all 17 exported functions from...

avml

AVML Acquire Volatile Memory for Linux Summary A portable volatile memory acquisition tool for Linux. AVML is an X8664 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distributi...

mtk-su-reverse-cve-2020-0069

mtk-su just some of my notes String table get decompressed string table by using binwalk -Xe stringtabledump dump from address in idb 0x1F098 compressed size: 1260 if you want the idb open an issue with your email and i'll send it. it's a good starting point if you want to re-write the exploit...

WordPress ARPrice <3.6.1 - SQL Injection

WordPress ARPrice plugin prior to 3.6.1 contains a SQL injection vulnerability. It fails to properly sanitize and escape user supplied POST data before being inserted in an SQL statement and executed via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or...