WTSRM

WTSRM - Writing Tiny Small Reliable Malware demo repository for my corresponding talk. Unhooks all Windows Dlls with \KnownDlls\ No CRT dependencies Small size Low entropy Random string encryption key thus no plaintext strings API hashing Hook detection Walks around hooks for initial unhooking on...

sub.sh

🎯🕸📘 MultiprocessingParallelSubdomain Detect Script ✨ 🔺Sub.sh but without API key 🔻 https://github.com/cihanmehmet/sub.sh ‼️ jq , httprobe and parallel required 📌 📘 ✅ Used Services + https://crt.sh + http://web.archive.org + https://dns.bufferover.run + https://www.threatcrowd.org +...

PyHook

PyHook PyHook is the python implementation of my SharpHook project, It uses various API hooks in order to give us the desired credentials. PyHook Uses frida to inject it's dependencies into the target process Supported Processes Process| API Call| Description| Progress ---|---|---|--- mstsc|...

CVE-2026-33017-Langflow-RCE

CVE-2026-33017 - Langflow RCE Vulnerability xpl0ited by infrar3d This proof‑of‑concept exploit targets a critical Remote Code Execution RCE vulnerability in Langflow versions prior to 1.9.0. The vulnerability allows unauthenticated attackers to execute arbitrary system commands by injecting...

Detect-CVE-2024-0762

CVE-2024-0762 Detection and Malware Analysis Script Overview This script is designed to detect UEFI firmware versions and assess them for vulnerabilities related to CVE-2024-0762. Additionally, it integrates with the VirusTotal API to analyze files for malware, providing comprehensive security...

AutoNessus

AutoNessus This script communicates with the Nessus API in an attempt to help with automating scans. Depending on the flag issued with the script, you can list all scans, list all policies, start, stop, pause, and resume a scan. It may be helpful to create a cron job/scheduled task for automating...

CVE-2026-113354

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

EntraTrace

EntraTrace EntraTrace is a defensive security research tool for documenting and identifying the observable behavior of offensive tooling targeting Microsoft Entra ID. The project builds a automatic knowledge base around tools such as AzureHound, AADInternals, O365Enum, PingCastle , and others, wi...

freevulnsearch

freevulnsearch This NMAP NSE script is part of the Free OCSAF project - https://freecybersecurity.org. In conjunction with the version scan "-sV" in NMAP, the corresponding vulnerabilities are automatically assigned using CVE Common Vulnerabilities and Exposures and the severity of the...

HellRaiser

HellRaiser Vulnerability Scanner Install HellRaiser depends on cve-search API. Have a cve-search API running and add the address in config/config.yml on cvesearchapidomain field. Install ruby 2.7.2, bundler 1.17.3 and rails. https://gorails.com/setup/ubuntu/20.04 Install redis-server and nmap. su...

IBM-Langflow-CVE-2026-48519-poc

IBM Langflow Pre-auth RCE in Shareable Playgrounds . running on version/s -c ""...

CVE-2023-50780

CVE-2023-50780: Dangerous MBeans Accessible via Jolokia API in Apache ActiveMQ Artemis By listing and inspecting the MBeans exposed by the Jolokia API at http://127.0.0.1:8161/console/jolokia the following attack vectors have been identified: Arbitrary File Write using Log4J indirectly resulting ...

CVE-2021-42559

CVE-2021-42559: Command Injection via Configurations in MITRE Caldera Caldera versions =2.8.1 contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the Rest API, an authenticated user can insert arbitrary commands that...

snapchat-map-scraper

Snapchat Story Downloader This program can search Snapchat's public Snap Map at multiple locations and download all stories for later investigation and categorization. A lot is unknown about how Snapchat decides which videos show up at which "point" on the map, so the scraper can also randomize t...

karma_v2

⡷⠂𝚔𝚊𝚛𝚖𝚊 𝚟𝟸⠐⢾ 𝚔𝚊𝚛𝚖𝚊 𝚟𝟸 is a Passive Open Source Intelligence OSINT Automated Reconnaissance framework 𝚔𝚊𝚛𝚖𝚊 𝚟𝟸 can be used by Infosec Researchers, Penetration Testers, Bug Hunters to find deep information, more assets, WAF/CDN bypassed IPs, Internal/External Infra, Publicly exposed leaks and many...

CVE-2026-20180

Cisco ISE RCE: Advanced Exploitation and Remediation Analysis 📋 Table of Contents 1. Executive Summary 2. Attack Surface Analysis 3. Exploitation Vectors 4. Advanced Evasion Techniques 5. Systemic Impact on Zero Trust Architectures 6. Remediation Strategy 7. Forensic Investigation 8. References 🎯...

CVE-2023-35078

CVE-2023-35078 shodan dorks You can use the following shodan dorks to find public targets. http.favicon.hash:362091310 http.favicon.hash:545827989 path=/mifs You can use the following to transform data from shodan API to format suitable for the checking script: jq -cr 'select.http.favicon.hash ==...

CVE-2026-113354

Versions of Dockhand prior to 1.0.46 are vulnerable to an arbitrary file read vulnerability via the /api/system/files/content endpoint. This issue stems from incorrect authorization (CWE-863), allowing non-admin users possessing stacks:edit permissions to access files by supplying absolute paths....

EUVD-2026-104925

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...