LR-WebPKI

LR+ WebPKI Evaluation Artifact This package contains the finalized LR+ reference implementation, production reconstruction wrappers, tests, and generated evaluation outputs for context-closed post-quantum authentication over WebPKI CA context. The package is intentionally written as a submission...

ghost-route

👻 Ghost Route A Python script to check Next.js sites for corrupt middleware vulnerability CVE-2025-29927. The corrupt middleware vulnerability allows an attacker to bypass authentication and access protected routes by send a custom header x-middleware-subrequest. Next JS versions affected: 11.1.4...

certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

CVE-2022-1388

CVE-2022-1388 F5 BIG-IP iControl REST Authentication Bypass Vulnerability Optional Arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" Usage python3 CVE-2022-1388.py -u http://127.0.0.1 python3...

Polkit-exploit

Polkit-exploit - CVE-2021-3560 Privilege escalation with polkit - CVE-2021-3560 Summary CVE-2021-3560 is an authentication bypass on polkit, which allows unprivileged user to call privileged methods using DBus, in this exploit we will call 2 privileged methods provided by accountsservice CreateUs...

jsql-injection

Description jSQL Injection is a lightweight application used to find database information from a server. It's free , open source and cross-platform for Windows, Linux and Mac, and it works with Java from version 21 to 25. jSQL Injection is also part of the official penetration testing distributio...

CVE-2025-31161

CVE-2025-31161 Authentication bypass vulnerability in versions of the CrushFTP server...

phishery

phishery Phishery is a Simple SSL Enabled HTTP server with the primary purpose of phishing credentials via Basic Authentication. Phishery also provides the ability easily to inject the URL into a .docx Word document. The power of phishery is best demonstrated by setting a Word document's template...

CVE-2026-2699

CVE-2026-2699 — Progress ShareFile Storage Zones Controller Authentication Bypass Critical Authentication Bypass CVSS 9.8 in customer-managed Progress ShareFile Storage Zones Controller SZC ≤ 5.12.3. 📋 Overview CVE-2026-2699 is a severe authentication bypass vulnerability affecting the web...

hashes

Magic hashes – PHP hash "collisions" Register with password 1 and then sign in with password 2. If you're in then the storage uses specified algorithm to hash the password and PHP uses == to compare them for MD5, SHA-1, and plaintext. MD5, SHA-1, SHA-224, SHA-256 and others For MD5 , SHA-1 and...

exploit-CVE-2016-6515

OpenSSH remote DOS Before 7.3 OpenSSH does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service crypt CPU consumption via a long string. This bug resides in auth-passwd.c in authpassword function. Attackers can exploit this issue to...

MSSQL-Analysis-Coerce

MSSQL Analysis Services - Coerced Authentication A technique to coerce a Windows SQL Server to authenticate on an arbitrary machine. This proof of concept is co-authored by : Podalirius: Worty: Proof of concept In order to trigger the authentification as the local machine account, we need to...

bigip-scanner

BIG-IP Scanner Determine the running software version of a remote F5 BIG-IP management interface. Developed with ❤️ by the Bishop Fox Cosmos team. Description CVE-2022-1388, a critical vulnerability in the F5 BIG-IP management interface, allows an attacker to bypass authentication and remotely...

CVE-2020-14883

CVE-2020-14883 Weblogic Authentication Bypass Vulnerability Batch Detection Script Usage: Python CVE-2020-14883-Multiple.py ip.txt port Vulnerable addresses will be output to Vul.txt...

cve-2022-33891-fix

EP3 - MAC0352 Redes deComputadores e Sistemas Distribuidos 2023 Tópico: CVE-2022-33891 Execução de comandos shell arbitrários em aplicação spark que utiliza autenticação via ACL Alunos Elinilson Vital Leoarndo Bozzetto CVE-2022-33891 Patch Instructions for Ubuntu 22.04 Prerequisites Ubuntu 22.04...

pax

pax Exploit padding oracles for fun and profit! Pax PAdding oracle eXploiter is a tool for exploiting padding oracles in order to: 1. Obtain plaintext for a given piece of CBC encrypted data. 2. Obtain encrypted bytes for a given piece of plaintext, using the unknown encryption algorithm used by...

CVE-2023-6329

CVE-2023-6329 — Control iD iDSecure Authentication Bypass A Python proof-of-concept exploit for CVE-2023-6329 , an improper access control vulnerability in Control iD iDSecure versions 4.7.43.0 and below. The flaw allows an unauthenticated remote attacker to reconstruct valid login credentials by...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-34102...

CVE-2024-57366

CVE-2024-57366 Exploit A robust exploit for CVE-2024-57366 that allows remote code execution on vulnerable routers through MAC address validation bypass and command injection. This is a post-authorization exploit that requires the router "Remote Control" feature to be on, and the administrative...

CVE-2021-33044

CVE-2021-33044 Dahua IPC/VTH/VTO devices auth bypass exploit About: The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. use - python3 dahuaexploit.py...