MrRAT

MrRAT This is a cross-platform Python 2.x Remote Access Trojan RAT, MrRAT was created to maintain a clean design full-featured Python RAT. Currently a work in progress and still being actively hacked on. Disclaimer: This RAT is for research purposes only, and should only be used on authorized...

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses langchain-text-splitters 0.3.9, flask 3.1.0, coreutils 8.32-39.el9 and libxml2 2.9.13-14.el98.1 which are vulnerable to PSIRT-GHSA-fv5p-p927-qmxr, CVE-2025-47278, CVE-2026-27205, CVE-2025-5278 and CVE-2025-6170. This bulletin contains information regarding the...

Domain-Controller-DC-Exploitation-with-Metasploit-Impacket

Domain-Controller-DC-Exploitation-with-Metasploit-Impacket End-to-end Domain Controller exploitation using Metasploit and Impacket: discovered DC10, exploited Zerologon CVE-2020-1472, extracted NTLM hashes, gained SYSTEM shell, and established a Meterpreter session. Executive Summary This exercis...

vaas-cve-2014-0160

漏洞即服务 - CVE 2014-0160 一个基于 Debian Wheezy Linux 的系统，包含易受攻击版本的 libssl 和 openssl，以及一个用于展示 CVE-2014-0160（即 Heartbleed）的 Web 服务器。 概述 此 Docker 容器基于 Debian Jessie，并已修改以使用易受攻击版本的 libssl 和 openssl。 一个简单的静态网页通过 Apache 2 提供服务。 用法 使用 docker pull hmlio/vaas-cve-2014-0160 安装容器 使用端口映射运行容器：docker run -d -p...

vaas-cve-2014-0160

Vulnerability as a Service - CVE 2014-0160 A Debian Wheezy Linux system with a vulnerable version of libssl and openssl and a web server to showcase CVS-2014-0160, a.k.a. Heartbleed. Overview This docker container is based on Debian Jessie and has been modified to use a vulernable version of libs...

CVE-2025-2825

CVE-2025-2825 - CrushFTP WebInterface Authentication bypass CVE-2025-2825 PoC This script exploits the CrushFTP authentication bypass vulnerability in versions: 10.0.0 10.8.3 11.0.0 11.3.0 How It Works CrushFTP's AWS S3-style authentication can be bypassed using: A fake but valid-looking...

CVE-2025-23266

CVE-2025-23266 Author: Mark Mallia Target platform: Ubuntu 22.04, FastAPI v2.4.3 → patched to v2.5.1 on 2025‑10‑02 1 – In a nutshell: what does this attack involve FastAPI’s parserequest routine copies HTTP request headers into a small buffer that lives on the caller’s stack. If an attacker sends...

NodeSecurityShield

Node Security Shield Node Security Shield NSS is an Open source Runtime Application Self-Protection RASP tool which aims at bridging the gap for comprehensive NodeJS security by enabling Developer and Security Engineer to declare what resources an application can access. Inspired by the Log4Shell...

html-poc

Proof of concept code for client-side vulnerabilities Basic HTML proof of concepts for issues such as: Clickjacking insecure CORS settings CSRF Tabnapping XSSI postMessage issues Most of these are pretty basic, but having them all in one place avoids writing the same things over and over again. T...

Log4j_dos_CVE-2021-45105

Log4j2 DOS CVE-2021-45105 Poc root@kitploit: $$::-$::-$$::-$ Versiones afectadas: todas las versiones desde 2.0-beta9 hasta 2.16.0 Esta aplicación está basada en una aplicación web Spring Boot vulnerable a CVE-2021-45105 Utiliza Log4j 2.16.0 Ejecutar la aplicación Ejecútala: root@kitploit: Import...

CVE-2023-28252-Compiled-exe

CVE-2023-28252-Compiled-exe A modification of Fortra's excellent CVE-2023-2852 Privesc Exploit. Works on Windows 11 21H2 clfs.sys version 10.0.22000.1574 - also works on Windows 10 21H2, Windows 10 22H2, Windows 11 22H2 and Windows server 2022. This version retains the original functionality, but...

nextcloud_android

Nextcloud Android app Codacy Badge The Android client forNextcloud. Easily work with your data on your Nextcloud. How to contribute If you want to contribute to Nextcloud, you are very welcome: on our IRC channels and on freenode our forum at https://help.nextcloud.com for translations of the app...

kit-policy

kit-policy A flexible, composable authorization framework for Kit, inspired by Ruby's Action Policy. TOC Files File| Description ---|--- .editorconfig| Editor formatting configuration .gitignore| Git ignore rules for build artifacts and dependencies .tool-versions| asdf tool versions Zig, Kit...

xsscrapy

xsscrapy Fast, thorough, XSS/SQLi spider. Give it a URL and it'll test every link it finds for cross-site scripting and some SQL injection vulnerabilities. See FAQ for more details about SQLi detection. From within the main folder run: root@kitploit: ./xsscrapy.py -u http://example.com If you wis...

espoofer

espoofer espoofer is an open-source testing tool to bypass SPF, DKIM, and DMARC authentication in email systems. It helps mail server administrators and penetration testers to check whether the target email server and client are vulnerable to email spoofing attacks or can be abused to send spoofi...

libunwind_CVE-2015-3239_After

-- mode: Outline - - This is version 1.0 of the unwind library. This library supports several architecture/operating-system combinations: Linux/x86-64: Works well. Linux/x86: Works well. Linux/ARM: Works well. Linux/IA-64: Fully tested and supported. Linux/PARISC: Works well, but C library missin...

udpack

UDPack UDPack is an extensible generic UDP packet obfuscator. The purpose of this application is to sit in the path of a UDP data stream, and obfuscate, deobfuscate or otherwise modify the packets. Python 3.4 or above is required, since this script uses the asyncio library. Using the latest Pytho...

copy-fail-mcp

Copy Fail MCP 📖 Installation Guide — quick start, manual setup, and troubleshooting CVE-2026-31431 — The worst Linux vulnerability ever discovered. Now controllable via MCP. 732 bytes of Python. No compilation. No race condition. No per-distro offsets. One shot, universal root on every Linux kern...

ODIN

ODIN Observe, Detect, and Investigate Networks Current version: v2.0.0 "Huginn" ODIN is Python tool for automating intelligence gathering, asset discovery, and reporting. Remember, check the dev branch for the bleeding edge, and feedback is welcome! See the GitHub wiki for details and installatio...

wig

wig - WebApp Information Gatherer wig is a web application information gathering tool, which can identify numerous Content Management Systems and other administrative applications. The application fingerprinting is based on checksums and string matching of known files for different versions of...