malwinx

Malwinx A normal flask web app to learn win32api with code snippets and references. Prerequisite You need to download the following package before starting it pip install flask pip install pefile pip install requests Usage $ python flaskapp.py Live Demo https://www.youtube.com/watch?v=z7snPXRG3M...

njsscan

njsscan njsscan is a static application testing SAST tool that can find insecure code patterns in your node.js applications using simple pattern matcher from libsast and syntax-aware semantic code pattern search tool semgrep. Made with in India Support njsscan Donate via Paypal: Sponsor the...

recaptcha

Description This repository contains a technical analysis of Google's antibot reCAPTCHA focusing on: Payload Structure and Values Fingerprinting Techniques Obfuscation Techniques Anti-debugging/Tampering Techniques Virtual Machines Contact Discord: @grecaptcha Telegram: @lyxlobyx Obfuscation...

1earn

Everything is hard at the beginning, and then it stays hard... Introduction : The original intention of this project is to share knowledge resources, allowing more people to access and understand the fields of security and operations. However, due to my limited ability, there will inevitably be...

PHP-Fuzzer

PHP Fuzzer This library implements a fuzzer for PHP, which can be used to find bugs in libraries particularly parsing libraries by feeding them "random" inputs. Feedback from edge coverage instrumentation is used to guide the choice of "random" inputs, such that new code paths are visited...

CVE-2026-108807

A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysqlquery of the file source/adminregister.php of the component Registration Handler. Performing a manipulation results in sql injection. The attack may be...

joomla.3.7.0exploit

CVE-2017-8917 Joomla SQLi PoC This repository contains a simple, CTF-friendly proof of concept PoC for the Joomla comfields SQL injection vulnerability CVE-2017-8917. The goal is to keep the workflow lightweight while still showing the full exploitation flow: detection, enumeration, and data...

C2concealer

C2concealer C2concealer is a command line tool that generates randomized C2 malleable profiles for use in Cobalt Strike. Installation git clone https://github.com/RedSiege/C2concealer.git cd C2concealer python3 -m venv .venv source .venv/bin/activate pip3 install -e . Docker installation Refer to...

writehat

WriteHat is a reporting tool which removes Microsoft Word and many hours of suffering from the reporting process. Markdown -- HTML -- PDF. Created by penetration testers, for penetration testers - but can be used to generate any kind of report. Written in Django Python 3. Features: Effortlessly...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

decomp2dbg

decomp2dbg Reverse engineering involves both static decompiler and dynamic debugger analysis, yet we often use these analyses without sharing knowledge between the two. In the case of reversing static binaries, context switching between debugger assembly and the symbols you have reversed in...

Ninja

Quick Update to include Follina Exploitation 01/06/2022 - NinjaC2 will generate the document and serve the HTML payload . More information : https://www.linkedin.com/posts/ahmed-khlief-499321a7i-just-pushed-a-quick-update-to-ninjac2-to-activity-6937661951007170560-Tmps Ninja V2.2 Released...

EfiGuard

Overview EfiGuard is a portable x64 UEFI bootkit that patches the Windows boot manager, boot loader and kernel at boot time in order to disable PatchGuard and Driver Signature Enforcement DSE. If you're just looking to try EfiGuard, skip to Usage. Features Currently supports all EFI-compatible...

CVE-2026-108811

A vulnerability exists in WMCMS 4.446.1257 where an unknown function within the /index.php file is susceptible to information disclosure . This issue arises from the manipulation of the path/file argument , which can be triggered remotely. Public exploit code for this vulnerability has been made ...

CVE-2026-108811 WMCMS index.php information disclosure

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...

EUVD-2026-97284

A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...

Ghost-CMS-Code-Injection-Audit-CVE-2026-26980

Ghost CMS Code Injection Cleaner Removes injected code from every post and page on a Ghost CMS website via the Admin API. Use this to clean up a compromised Ghost site — for example, one affected by the code injection vulnerability CVE-2026-26980 — by stripping attacker-supplied tags and other...

CVE-2019-7238

CVE-2019-7238 Nexus Repository Manager RCE Nexus Repository Manager 3 Remote Code Execution without authentication nexus 关于命令回显： functionx, y, z, c, integer, defineClass c=1.class.forName'java.lang.Character'; integer=1.class; x='...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE Summary The functionality that inserts custom prompts into the chat window is vulnerable to DOM XSS when 'Insert Prompt as Rich Text' is enabled, since the prom...

replica

REPLICA TAME THE DRAGON ✨Features ⚡ Disassemble missed instructions - Define code that Ghidra's auto analysis missed ⚡ Detect and fix missed functions - Define functions that Ghidra's auto analysis missed ⚡ Fix 'undefinedN' datatypes - Enhance Disassembly and Decompilation by fixing 'undefinedN'...