domi-owned

Domi-Owned Summary Domi-Owned is a tool used for compromising IBM/Lotus Domino servers. Tested on IBM/Lotus Domino 8.5.2, 8.5.3, 9.0.0, and 9.0.1 running on Windows and Linux. Requirements Domi-Owned uses Python 3, which can be install through your distribution's package manager apt, yum, etc...

santa

Santa Santa is a binary and file access authorization system for macOS. It consists of a system extension that monitors for executions & file access, and makes decisions based on the contents of a local database, a GUI agent that notifies the user in case of a block decision, a background service...

vBulletin-CVE-2025-48828-Multi-target

💥 Сканер удалённого выполнения кода vBulletin replaceAdTemplate Этот Python-инструмент автоматизирует обнаружение уязвимостей неаутентифицированного RCE в vBulletin через эксплойт-вектор replaceAdTemplate. Основан на оригинальном доказательстве концепции от EgiX ; эта версия поддерживает пакетное...

Bifrost

Bifrost Commande et Contrôle Qu'est-ce que Bifrost ? Bifrost est un BOT Discord open-source qui fonctionne comme un Command and Control C2. Ce C2 utilise l'API Discord pour la communication entre les clients et le serveur...

monitor v0.44.0

BetterDB Monitor The monitoring layer that Valkey deserves. BetterDB persists what Valkey throws away - slowlogs, command patterns, client activity, anomaly signals - so you can debug what happened at 3am, not just what's happening now. Built for Valkey 8.x with native support for COMMANDLOG,...

TornadoRevC2

TornadoRevC2 A lightweight, modular post-exploitation framework for authorized security research, red-team operations, and penetration testing. TornadoRevC2 manages reverse shell sessions on Linux and Windows hosts through a unified operator console, extending core session handling with a...

goscan

GoScan is an interactive network scanner client, featuring auto-completion, which provides abstraction and automation over nmap. Although it started as a small side-project I developed in order to learn @golang, GoScan can now be used to perform host discovery, port scanning, and service...

rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

btlejack

BtleJack: a new Bluetooth Low Energy swiss-army knife Btlejack provides everything you need to sniff, jam and hijack Bluetooth Low Energy devices. It relies on one or more BBC Micro:Bit . devices running a dedicated firmware. You may also want to use anAdafruit's Bluefruit LE sniffer or a nRF5182...

pysqli

PySQLi - Python SQL injection framework 1. Overview PySQLi is a python framework designed to exploit complex SQL injection vulnerabilities. It provides dedicated bricks that can be used to build advanced exploits or easily extended/improved to fit the case. 2. Why another SQLi framework ? Simple...

Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2

The Pakistan-aligned threat group tracked as Transparent Tribe aka APT36 and Earth Karkaddan has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tool...

POC_CVE-2024-46256

POCCVE-2024-46256 CVE-2024-46256 и CVE-2024-46257 — это один и тот же POC, просто измените параметр provider. Примечание Иногда файл nc не может выполниться на сервере или не может выполнить команду! Установка зависимостей root@kitploit: pip install requests Запуск эксплойта root@kitploit: python...

CVE-2025-68937

CVE-2025-68937 - RCE через симлинк в шаблонах Gitea/Forgejo Автоматизированный proof-of-concept для CVE-2025-68937 : обход каталога через разыменование симлинков при обработке шаблонных репозиториев Gitea и Forgejo, приводящий к удалённому выполнению кода. Любой аутентифицированный пользователь б...

cve-2022-33891

CVE-2022-33891 Vulnérabilité d'injection de commande dans le shell Apache Spark Un POC Python pour exploiter la vulnérabilité d'injection de commande dans le shell Apache Spark. J'ai vu d'autres POC ailleurs, mais ils semblaient super louches. Celui-ci est propre et simple. Je n'ai pas découvert...

CVE-2025-14754 IBM Cloud Pak for Data is vulnerable to OS command injection

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

CVE-2025-14754 IBM Cloud Pak for Data is vulnerable to OS command injection

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input...

mimic

mimic mimic is a tool for covert execution on Linux x8664. What is "covert execution"? Covert execution is the art of hiding a process. In this case, mimic hides the process in plain sight. mimic can launch any program and make it look like any other program. Any user can use it. It does not...

cve-2020-5902-ioc-bigip-checker

Outil de détection d'IoC CVE-2020-5902 Ce script est destiné à être exécuté localement sur un F5 BIG-IP dans l'Advanced Shell bash par un utilisateur disposant des privilèges root ; il n'est pas destiné à être exécuté dans tout autre environnement. Remarque : le mode Appliance ne permet pas l'acc...

CVE-2021-40865

CVE-2021-40865 CVE-2021-40865 POC/exploit-poc root@kitploit: import org.apache.commons.io.IOUtils; import org.apache.storm.serialization.KryoValuesSerializer; import ysoserial.payloads.ObjectPayload; import ysoserial.payloads.URLDNS; import java.io.; import java.math.BigInteger; import java.net.;...

CVE-2026-93685

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...