Scythe

Scythe scythe: खाता एन्यूमरेटर root@kitploit: Account Enumerator को सुरक्षा परीक्षण के भाग के रूप में खाता एन्यूमरेशन करना सरल बनाने के लिए डिज़ाइन किया गया है। फ्रेमवर्क आसानी से नए मॉड्यूल XML फ़ाइलें बनाने और परीक्षण की प्रक्रिया को तेज़ करने की क्षमता प्रदान करता है। यह टूल मुख्य रूप से 2...

KNOXout

KNOXout Galaxy S6 रूटिंग पर आधारित एक PoC जो CVE-2016-6584 कमजोरी का उपयोग करता है यह dosomder/idler1984 द्वारा iovyroot का उपयोग करता है प्रारंभिक कर्नेल write-what-where कमजोरी के लिए।...

mapsdumper

root@kitploit: ▒█▀▄▀█ ░█▀▀█ ▒█▀▀█ ▒█▀▀▀█ ▒█▀▀▄ ▒█░▒█ ▒█▀▄▀█ ▒█▀▀█ ▒█▀▀▀ ▒█▀▀█ ▒█▒█▒█ ▒█▄▄█ ▒█▄▄█ ░▀▀▀▄▄ ▒█░▒█ ▒█░▒█ ▒█▒█▒█ ▒█▄▄█ ▒█▀▀▀ ▒█▄▄▀ ▒█░░▒█ ▒█░▒█ ▒█░░░ ▒█▄▄▄█ ▒█▄▄▀ ░▀▄▄▀ ▒█░░▒█ ▒█░░░ ▒█▄▄▄ ▒█░▒█ by: @Tegal1337 MAPSDUMPER डेमो • इंस्टॉलेशन • सुविधाएँ • क्रेडिट्स Google Maps से स्थान विवरण...

Identificador-CVE-2018-11759

Other language git - pt-BR Check if your instances are expose the CVE 2018-11759 The archive main are a script in bash for exploiting. The urls shall use the protocol and complete addres, example: https://test.site.com.br For more urls in one consult, can be used the here-document, example:...

RansomCoinPublic

RansomCoin रैनसमवेयर से मेटाडेटा और हार्डकोडेड इंडिकेटर्स ऑफ़ कॉम्प्रोमाइज़ IOC को स्केलेबल, कुशल तरीके से निकालना, जिसमें कक्कू एकीकरण हो। आदर्श रूप से, यह कक्कू गतिशील विश्लेषण के दौरान चलाया जाता है, लेकिन इसका उपयोग रैनसमवेयर के बड़े संग्रह पर स्थैतिक विश्लेषण के लिए भी किया जा सकता है। इसे...

mwebfp

LNHG - Massive Web Fingerprinter mwebfp Introduction The "LowNoiseHG LNHG Massive Web Fingerprinter " "mwebfp " from now on was conceived in July 2013 after realizing the usefulness of webserver screenshots to pentesters, during an engagement with large external or internal IP address ranges, as ...

CVE-2026-79777

rclone versions before v1.75.0 include full Go stack traces in RC API error responses when panics occur. An authenticated attacker (high privileges required) can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses. The CVSS 3.1 base score is 2.7 (LO...

iovyroot

iovyroot Инструмент для получения root-прав, основанный на уязвимости CVE-2015-1805 Поддерживает 32 и 64 бита, но требует абсолютных адресов ядра см. offsets.c poc был создан idler1984 https://github.com/idl3r/testcode...

CVE-2019-19781_IOCs

CVE-2019-19781IOCs CVE-2019-19781 の IOCs citrixhoneypotnslookup.txt には、ips.txt にリストされている IP アドレスの whois 結果が含まれています。 これらは、以下で説明されているハニーポットのログに最も頻繁に現れたアドレスです。 https://www.digitalshadows.com/blog-and-research/cve-2019-19781-analyzing-the-exploit/...

domain_analyzer

Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

fail2ban

root@kitploit: / | | | | / | | |/ /| ' / | ' \ || ,||/|./,|||| v1.1.0.dev1 20??/??/?? Fail2Ban: ban hosts that cause multiple authentication errors Fail2Ban scans log files like /var/log/auth.log and bans IP addresses conducting too many failed login attempts. It does this by updating system...

mcp-atlassian < 0.17.0 - Server-Side Request Forgery

MCP Atlassian 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint. id: CVE-2026-27826 info...

Mail Mint < 1.19.5 - Unauthenticated Email Disclosure

Mail Mint WordPress plugin 1.19.5 contains an information disclosure vulnerability caused by lack of authorization in a REST API endpoint, letting unauthenticated users retrieve email addresses of blog users, exploit requires no authentication. id: CVE-2026-2025 info: name: Mail Mint 1.19.5 -...

Mailpit < 1.28.3 - Server-Side Request Forgery

Mailpit = 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests. id: CVE-2026-21859 info: name: Mailpit 1.28.3 -...

vLLM 0.8.3 - 0.14.0 - Information Disclosure

vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images. id: CVE-2026-22778 info: name: vLLM 0.8....

Popup by Supsystic < 1.10.9 - Subscriber Email Addresses Disclosure

The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users id: CVE-2022-0424 info: name: Popup by Supsystic 1.10.9 - Subscriber Email...

Integrate Google Drive <= 1.5.3 - Information Disclosure

File Manager for Google Drive - Integrate Google Drive with WordPress plugin for WordPress = 1.5.3 contains sensitive information exposure caused by improper protection of the getlocalizedata function, letting unauthenticated attackers extract Google OAuth credentials and account email addresses,...

BMC FootPrints 'searchWeb' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/import/searchWeb endpoint. The 'url' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling acces...

CVE-2026-33626-Lab

CVE-2026-33626 — Laboratoire SSRF vision-langage LMDeploy Aperçu Ce dépôt reproduit CVE-2026-33626 , une vulnérabilité de type Server-Side Request Forgery SSRF dans le chemin de chargement d'images vision-langage de LMDeploy. Le comportement vulnérable se produit lorsque LMDeploy reçoit une URL...