kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

kiterunner

Kiterunner Einleitung Lange Zeit konzentrierte sich die Inhaltserkennung auf das Auffinden von Dateien und Ordnern. Obwohl dieser Ansatz für ältere Webserver effektiv ist, die statische Dateien hosten oder bei einem Teilpfad mit 3xx-Antworten reagieren, ist er für moderne Webanwendungen,...

CVE-2020-26217-XStream-RCE-POC

CVE-2020-26217-XStream-RCE-POC z. B. root@kitploit: package org.example; import com.thoughtworks.xstream.XStream; import java.io.IOException; public class CVE202026217 public static void mainString args throws IOException XStream xStream = new XStream; String payload = "\n" + " \n" + " \n" + " 0\...

backdoorme

backdoorme Build Status Werkzeuge wie Metasploit sind großartig, um Computer auszunutzen, aber was passiert, nachdem du Zugriff auf einen Computer erlangt hast? Backdoorme beantwortet diese Frage, indem es eine Vielzahl von Hintertüren Backdoors einsetzt, um über lange Zeiträume Persistenz zu...

dfirtriage

dfirtriage Digital forensic acquisition tool for Windows-based incident response. How to Use To run, drop dfirtriage.exe on the target or connected USB drive and execute with admin rights, -h for help. DFIRTriage v6.0 User's Manual Description This document outlines the functionality and proper u...

CVE-2003-0264

SLMail 5.5 POP3 PASS Parameter Buffer Overflow Versione del programma: SLMail 5.5 Vulnerabilità: overflow del buffer nel parametro PASS del servizio POP3 porta 110 di Seattle Lab Mail SLMail 5.5 Testato su: Windows 7 x86 Sfruttamento: overflow del buffer remoto Video PoC:...

P4wnP1_aloa

P4wnP1 A.L.O.A. P4wnP1 A.L.O.A. von MaMe82 ist ein Framework, das einen Rapsberry Pi Zero W in eine flexible, kostengünstige Plattform für Pentesting, Red Teaming und physische Einsätze verwandelt ... oder in "A Little Offensive Appliance". 0. Wie man installiert Das neueste Image kann unter dem...

SharpDPAPI

SharpDPAPI SharpDPAPI è un port in C di alcune funzionalità DPAPI dal progetto Mimikatz di @gentilkiwi. Non ho ideato questa logica, si tratta semplicemente di un port da Mimikatz per comprendere meglio il processo e renderlo operativo per adattarlo al nostro flusso di lavoro. Il sottoprogetto...

threatspec

threatspec – Kontinuierliches Threat Modeling durch Code Threatspec ist ein Open-Source-Projekt, das darauf abzielt, die Lücke zwischen Entwicklung und Sicherheit zu schließen, indem der Threat-Modeling-Prozess tiefer in den Entwicklungsprozess integriert wird. Dies wird erreicht, indem Entwickle...

threatspec

threatspec - continuous threat modeling, through code Threatspec is an open source project that aims to close the gap between development and security by bringing the threat modelling process further into the development process. This is achieved by having developers and security engineers write...

cosign

cosign Signing OCI containers and other artifacts using Sigstore! Cosign aims to make signatures invisible infrastructure. Cosign supports: "Keyless signing" with the Sigstore public good Fulcio certificate authority and Rekor transparency log default Hardware and KMS signing Signing with a cosig...

cosign

cosign Firmare container OCI e altri artefatti usando Sigstore! Cosign punta a rendere le firme un'infrastruttura invisibile. Cosign supporta: "Firma keyless" con l'autorità di certificazione Fulcio del bene pubblico Sigstore e il log di trasparenza Rekor predefinita Firma hardware e KMS Firma co...

Security Bulletin: Multiple vulnerabilities in IBM MQ Agent images

Summary Multiple vulnerabilities were addressed in IBM MQ Agent images Vulnerability Details CVEID:CVE-2026-62995 DESCRIPTION: joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. in versions 1.7.1 and prior, joserfc accepts JWT...

CVE-2018-15365

Reflektiertes XSS in Deep Discovery Inspector 3.8 Ich habe eine reflektierte XSS-Sicherheitslücke in der Management-Weboberfläche von Deep Discovery Inspector 3.8 Service Pack 5 Build: 3.85.1165 gefunden. Der anfällige Skriptpfad ist /php/detectiondetailfilter.php. Dieses Skript ist nur für einen...

text4shell-cve-2022-42889

Text4Shell CVE-2022-42889 Docker-Lab für CVE-2022-42889 Du kannst das Docker-Image entweder lokal erstellen oder das Image von Docker Hub pullen und den Container ausführen. Repository klonen root@kitploit: git clone https://github.com/devenes/text4shell-cve-2022-42889.git Das Docker-Image lokal...

nikto

nikto Nikto web server scanner - https://cirt.net/Nikto2 Full documentation - https://github.com/sullo/nikto/wiki Run normally: root@kitploit: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h http://www.example.co...

nikto

nikto Nikto web server scanner - https://cirt.net/Nikto2 Documentazione completa - https://github.com/sullo/nikto/wiki Esecuzione normale: root@kitploit: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h...

wave-share

wave-share A proof-of-concept for WebRTC signaling using sound. Works with all devices that have microphone + speakers. Runs in the browser. Nearby devices negotiate the WebRTC connection by exchanging the necessary Session Description Protocol SDP data via a sequence of audio tones. Upon...

thc-hydra

H Y D R A root@kitploit: c 2001-2023 by van Hauser / THC https://github.com/vanhauser-thc/thc-hydra Many modules were written by David dot Maciejak @ gmail dot com BFG code by Jan Dlabal Licensed under AGPLv3 see LICENSE file Please do not use in military or secret service organizations, or for...

​​​​​​What’s new in Microsoft Security: August 2026

As organizations incorporate AI agents into more processes across business and operations, security teams can benefit from greater visibility and new purpose-built tools that help manage, secure, and govern AI. This month’s updates provide new capabilities to help organizations gain insights into...