domain-to-webapp

domain-to-webapp A simple bash script for finding web application hosted within a domain Requirements curl Subfinder docker image Usage root@kitploit: $./webAppChecker businesssolutions.com ./ouputdir ./scope.txt | \ | | \ \ / /| | / \ | | | |/ | ' \ / | | ' \ | / \ \ \ /\ / / \ ' \ / \ | ' | ' ...

cve_2024_0044

CVE 2024 0044 CVE-2024-0044, identificada en la función createSessionInternal del archivo PackageInstallerService.java, es una vulnerabilidad de alta gravedad que afecta a Android versiones 12 y 13. Esta vulnerabilidad permite a un atacante realizar un ataque "run-as any app", lo que conduce a un...

SnatchBox

SnatchBox SnatchBox CVE-2020-27935 is a sandbox escape vulnerability affecting macOS up to version 10.15, as well as early beta versions of macOS 11.0. The most significant impact of SnatchBox is that it allows a malicious publisher to escape the non-optional macOS App Store sandbox and obtain...

kanha

Kanha - A web-app pentesting suite written in rust 🦀 Installation ⦾ Subcommands ⦾ Contribute Kanha is a tool that can help you perform, a variety of attacks based on the target domain . With just kanha you can do, Fuzzing, Reverse dns lookup, common http response, subdomain takeover detection and...

aurora

Aurora This is a proof-of-concept web app built on top of Frida. To get started: root@kitploit: npm install grunt server Then point your web browser at http://127.0.0.1:8010/...

NXLoader

NXLoader My first Android app: Launch Fusée Gelée payloads from stock Android Heavily based on Fusée Gelée and ShofEL2. fusee.bin is bundled as a default payload Note: Any proprietary payloads are neither tested nor supported by this software. Does it work on your device? Report here Get the APK...

LeakValue

Android 13 introduces many enhancements in order to harden Parcel serialization mechanism Here's presentation from Android Security and Privacy team on enhancements made That is great, definitely eliminates or makes unexploitable many vulnerabilities. Also they describe breaking my previous...

TwitterSearch2Gephi

TwitterSearch2Gephi TwitterSearch2Gephi is a windows CLI app that lets you collect data from social media and convert it into a CSV data set that can be used with Gephi. Currently it supports Twitter Reddit Youtube WWW domains / URLs More social media platforms and more features for the platforms...

rainmap-lite

rainmap-lite Rainmap Lite - Aplicación web receptiva que permite a los usuarios lanzar escaneos de Nmap desde sus móviles/tablets/navegadores web. A diferencia de su predecesor 1, Rainmap-lite no requiere servicios especiales RabbitMQ, PostgreSQL, Celery, supervisor, etc para facilitar su...

vuln-bank-mobile

💳 Vulnerable Bank Mobile App Vulnerable Bank is an intentionally insecure mobile application built for security engineers, penetration testers, and mobile app security learners to practice and demonstrate real-world exploitation of insecure coding practices. This mobile app acts as a frontend for...

bootmodechecker

bootmodechecker This app checks if your Nexus 6/6P is still vulnerable to CVE-2016-8467 and/or if your bootmode property has been tampered with. Also available under Google Play: https://play.google.com/store/apps/details?id=roeeh.bootmodechecker...

spring4shell_victim

spring4shellvictim Intentionally vulnerable Spring app to test CVE-2022-22965 For more information: https://www.fracturelabs.com/posts/effective-spring4shell-scanning-exploitation/ Usage Build The following code will quickly build a vulnerable Docker image using the following components: JDK...

packages_apps_Settings_AOSP10_r33_CVE-2020-0416

This repository does not have a README...

cve-2025-55182-lab

CVE-2025-55182 RSC lab intentionally vulnerable Local Docker lab for authorized security research: React Server Components / Next.js App Router with a stack in the CVE-2025-55182 React2Shell affected range. Use only on your own machine. Do not expose this container to the internet. References Rea...

CVE-2018-19518

CVE-2018-19518 last rapport here : https://gitlab.com/ensimag-security/CVE-2018-19518/-/jobs/artifacts/master/raw/rapport.pdf?job=PDF Usage run app root@kitploit: docker-compose up -d example normal usage for the web app. imap : webmail.grenoble-inp.org user : [email protected] password : xx...

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — Stored XSS via Tile HTML Field PoC This repository documents a proof-of-concept PoC for a stored cross-site scripting XSS vulnerability affecting the iOS mobile application of URVE Smart Office. Due to insufficiently implemented input validation, attacker-controlled...

FTC-Skystone-Dark-Angels-Romania-2020

NOTICE This repository contains the public FTC SDK for the SKYSTONE 2019-2020 competition season. Formerly this software project was hosted here. Teams who are competing in the SKYSTONE Challenge should use this new SKYSTONE repository instead of the older and no longer updated ftcapp repository...

CVE-2024-47167-Environment-Setup

Components: 1. gradiocontainer: hosts internal HTTP server on port 5678 2. targetinternalserver: launches a python app using vulnerable version of gradio 4.40.0...

com.cutestudio.colordialer

This repository does not have a README...

Mythic-Macro-Generator

Mythic-Macro-Generator Python3 script to generate MS Office macros for launching Mythic JXA payloads. This script generates an Office macro which uses osascript to download and execute the Mythic JXA .js payload. Steps: 1. Set up Mythic C2 server and generate an "apfell" jxa payload note: this...