pypykatz

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord pypykatz Mimikatz implementation in pure Python. At least a part of it : Runs on all OS...

getSPNless

getSPNless Python tool to obtain Kerberos service tickets using the SPN-less technique. Based on Exploiting RBCD Using a Normal User Account. This tool uses the impacket project. Installation These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the...

SharpNamedPipePTH

SharpNamedPipePTH This project is a C tool to use Pass-the-Hash for authentication on a local Named Pipe for user Impersonation. You need a local administrator or SEImpersonate rights to use this. There is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily...

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...

OpenCTI < 6.9.13 - Authentication Bypass via User Impersonation

OpenCTI 6.9.13 allows authentication bypass by supplying a Bearer token set to the admin user's internalid UUID instead of a valid JWT. The default admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f grants full admin access to the GraphQL API, effectively bypassing all authentication. id:...

WordPress Pie Register <= 3.7.1.4 - Authentication Bypass

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting socialsite=true and manipulating the useridsocialsite parameter,...

CVE-2024-45337

Exploit de prueba de concepto para CVE-2024-45337 Este repositorio contiene un exploit de prueba de concepto para CVE-2024-45337. Se puede utilizar para envolver ssh al interactuar con un servidor SSH implementado con golang.org/x/crypto = v0.30.0., mientras se almacenan en caché los permisos en ...

NamedPipePTH

NamedPipePTH This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotat...

WhoWasI

WhoWasI Esta aplicación es capaz de suplantar a cualquier usuario con sesión iniciada y ejecutar comandos en el contexto del usuario suplantado. Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado por: Chris Thomas, chris dot Thomas at nccgroup dot com...

aisecplus-week01-servicenow-ai-security-incident

AISec Plus Week01 - Mapa de la Amenaza Investigación de Incidentes de Seguridad en IA: Vulnerabilidad del Virtual Agent de ServiceNow CVE-2025-12420 ¿Qué Ocurrió? Se descubrió una vulnerabilidad crítica en la plataforma de IA de ServiceNow que permitía a un atacante no autenticado hacerse pasar p...

CVE-2026-63329

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

EUVD-2026-84060

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copyserverrequest in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username header before injectownheaders appends the authenticated username. Because the request builder preserves...

CVE-2017-11427-DEMO

CVE-2017-11427-DEMO Basic Environment root@kitploit: $ sudo apt-get install libxml2-dev libxslt1-dev $ sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl DEMO: root@kitploit: $ git clone https://github.com/CHYbeta/CVE-2017-11427-DEMO.git $ cd CVE-2017-11427-DEMO $ source...

CVE-2026-20896

CVE-2026-20896: PoC de omisión de autenticación en la imagen Docker de Gitea !WARNING Usa este PoC solo en un laboratorio local o contra un sistema que estés autorizado explícitamente a probar. https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b Resumen CVE-2026-20896 ...

CVE-2025-31161

CVE-2025-31161 is a critical severity vulnerability allowing attackers to control how user authentication is handled by CrushFTP managed file transfer MFT software. Affected versions: 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0 Exploit summary: Remote and unauthenticated HTTP requests to...

RISE-Ultimate_Project_Manager_e_CRM

CVE-2025-3855 - RISE Ultimate Project Manager - IDOR Vulnerabilidad de seguridad: IDOR Referencia Directa Insegura a Objetos Componente afectado: endpoint de carga de imagen de perfil, controlador teammembers Software: RISE - Ultimate Project Manager & CRM Vendor: codecanyon Versión: 3.8.2 CVE OR...

CVE-2023-52268

FreeScout End-User Portal Authentication Bypass Exploit CVE-2023-52268 Overview This exploit targets a vulnerability in the FreeScout End-User Portal Module versions below 1.0.65 that allows an attacker to bypass authentication through improper session token management. By generating and testing...

watchTowr-vs-progress-moveit_CVE-2024-5806

CVE-2024-5806 Exploit for Progress MOVEit Transfer CVE-2024-5806. See our blog post at TBD. PoC in Action See --help for, well, help. A typical run should look like this: root@kitploit: python CVE-2024-5806.py --target-ip 192.168.1.1 --target-user user2 --ppk id.ppk --pem id / | | |\ \ \ / / \ ...

CVE-2024-51996

⚠️ CVE-2024-51996 - Symfony RememberMe Auth Bypass Exploit Exploit for the critical vulnerability CVE-2024-51996 , which allows authentication bypass in Symfony applications that use the Remember Me mechanism. 🧠 Impact : Impersonation of privileged users such as admin without the need for valid...

CVE-2026-55040-Mass-Exploit

Exploit de Bypass de Token JWT para Microsoft SharePoint CVE-2026-55040, CVSS 9.1. Forja tokens de autenticación usando tres vectores de ataque: Algoritmo "none" omite la verificación de firma Secretos HS256 débiles con soporte de diccionario de fuerza bruta Sustitución de clave RS256 Suplanta a...