getSPNless

getSPNless Python tool to obtain Kerberos service tickets using the SPN-less technique. Based on Exploiting RBCD Using a Normal User Account. This tool uses the impacket project. Installation These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the...

pypykatz

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord pypykatz Mimikatz implementation in pure Python. At least a part of it : Runs on all OS...

CVE-2026-20896

CVE-2026-20896：Gitea Docker 镜像认证绕过 PoC !WARNING 仅在本地实验室或针对您明确获得授权测试的系统上使用此 PoC。 https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b 概述 CVE-2026-20896 是受影响官方 Gitea Docker 镜像中的认证绕过漏洞。当启用反向代理认证时，镜像生成的 REVERSEPROXYTRUSTEDPROXIES = 设置允许能够访问 Gitea 后端的客户端通过 X-WEBAUTH-USER...

CVE-2026-55040-Mass-Exploit

JWT Token Bypass Exploit for Microsoft SharePoint CVE-2026-55040, CVSS 9.1. Forge authentication tokens using three attack vectors: Algorithm "none" skips signature verification Weak HS256 secrets with brute-force dictionary support RS256 key substitution Impersonate any user including...

NamedPipePTH

NamedPipePTH This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotat...

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...

WordPress Pie Register <= 3.7.1.4 - Authentication Bypass

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting socialsite=true and manipulating the useridsocialsite parameter,...

SharpNamedPipePTH

SharpNamedPipePTH Este proyecto es una herramienta en C para usar Pass-the-Hash en la autenticación de una tubería con nombre local para la suplantación de usuario. Necesitas ser administrador local o tener derechos SEImpersonate para usarlo. Hay una publicación en el blog con la explicación:...

watchTowr-vs-progress-moveit_CVE-2024-5806

CVE-2024-5806 Exploit for Progress MOVEit Transfer CVE-2024-5806. See our blog post at TBD. PoC in Action See --help for, well, help. A typical run should look like this: root@kitploit: python CVE-2024-5806.py --target-ip 192.168.1.1 --target-user user2 --ppk id.ppk --pem id / | | |\ \ \ / / \ ...

CVE-2024-45337

Proof of Concept exploit for CVE-2024-45337 This repository contains a proof of concept exploit for CVE-2024-45337. It can be used to wrap ssh when interacting with an SSH server which is implemented using golang.org/x/crypto = v0.30.0. while caching permissions in the...

CVE-2025-31161

CVE-2025-31161 是一个严重级别的漏洞，允许攻击者控制 CrushFTP 托管文件传输（MFT）软件处理用户认证的方式。 受影响版本：10.0.0 至 10.8.3 以及 11.0.0 至 11.3.0 漏洞利用摘要：攻击者可以使用已知用户名向 CrushFTP 发送远程且未经身份验证的 HTTP 请求，从而冒充用户并以该用户身份执行操作，包括管理操作和数据检索。 该漏洞已在 CrushFTP 11.3.1+ 和 10.8.4+ 版本中得到修复和缓解。 此 PoC 最初是为了在 HTB 的某台机器上实现 RCE...

CVE-2017-11427-DEMO

CVE-2017-11427-DEMO Basic Environment root@kitploit: $ sudo apt-get install libxml2-dev libxslt1-dev $ sudo apt-get install libxml2-dev libxmlsec1-dev libxmlsec1-openssl DEMO: root@kitploit: $ git clone https://github.com/CHYbeta/CVE-2017-11427-DEMO.git $ cd CVE-2017-11427-DEMO $ source...

aisecplus-week01-servicenow-ai-security-incident

AISec Plus Week01 - Map The Threat AI Security Incident Research: ServiceNow Virtual Agent Vulnerability CVE-2025-12420 What Happened? A critical vulnerability was discovered in the ServiceNow AI Platform that enabled an unauthenticated attacker to impersonate legitimate users and execute actions...

CVE-2026-75759

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759 Encrypted ID token or JARM response accepted without a nested signature in erlef oidcc

Improper Verification of Cryptographic Signature vulnerability in erlef oidcc allows an unauthenticated attacker to impersonate an arbitrary user via an encrypted ID token or JARM response carrying no nested signature. OpenID Connect Core 1.0 section 2 requires that an encrypted ID token be signe...

CVE-2026-75759

erlef oidcc is an Erlang OpenID Connect client library. In versions 3.2.0-beta.1 through before 3.9.0 , an improper verification of cryptographic signature flaw allows an unauthenticated attacker to impersonate an arbitrary user by submitting an encrypted ID token or JARM response that contains n...

PT-2026-83516

Name of the Vulnerable Software and Affected Versions oidcc versions 3.2.0-beta.1 through 3.8.9 Description Improper verification of cryptographic signatures allows an unauthenticated attacker to impersonate any user. The issue occurs when the software accepts a JSON Web Encryption JWE wrapping...

RISE-Ultimate_Project_Manager_e_CRM

CVE-2025-3855 - RISE Ultimate Project Manager - IDOR Sicherheitslücke: IDOR Insecure Direct Object Reference Betroffene Komponente: Profilbild-Upload-Endpunkt, teammembers-Controller Software: RISE - Ultimate Project Manager & CRM Anbieter: codecanyon Version: 3.8.2 CVE ORG :...

CVE-2023-52268

Exploração de Bypass de Autenticação do Portal do Usuário Final do FreeScout CVE-2023-52268 Visão Geral Este exploit visa uma vulnerabilidade no Módulo do Portal do Usuário Final do FreeScout versões anteriores a 1.0.65 que permite que um invasor contorne a autenticação através do gerenciamento...