CVE-2023-35840

CVE-2023-35840 elFinder 2.1.62 - Path Traversal vulnerability in PHP LocalVolumeDriver connector Description Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system. Vulnerability exists in...

ZipExec

ZipExec ZipExec is a Proof-of-Concept POC tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected...

br0w

br0w Hack The Br0w | Play your browser and learn more, hack fun !! The Br0w is a simple web to learn about and about web security with a browser as a tool that sometimes people forget about more benefits. Maybe it's more like Capture The Flag CTF. One of the challenges is, disable css and base64...

CVE-2019-13292-WebERP_4.15

Blind SQL Injection Exploit for WebERP This is a Python3 script that demonstrates an exploit for a Blind SQL Injection vulnerability in WebERP version 4.15, initially discovered by Semen Alexandrovich Lyhin on June 10, 2019. The original exploit can be found here, and further details regarding th...

dns-rebinding-tool

Inspired by @tavisio This project is meant to be an All-in-one Toolkit to test further DNS rebinding attacks and my take on understanding these kind of attacks. It consists of a web server and pseudo DNS server that only responds to A queries. The root index of the web server allowes to configure...

crypter

Crypter This Crypter is written in python 3, which can be used to obfusticate, encrypt the python source code to bypass AntiVirus. Also Capable to Bypass VM such as VirtualBox, VMware, Sandboxie. Uses AES-256 bit Encryption & Base64 Encoding to Encrypt the Source Code for Twice. 3 Powerfull Metho...

reverse-shell-generator

reverse-shell-generator Hosted Reverse Shell generator with a ton of functionality -- great for CTFs Hosted Instance https://revshells.com Features Generate common listeners and reverse shells Save button to download Payloads from browser. Raw mode to cURL shells to your machine. Button to...

Invoke-Transfer

Invoke-Transfer PowerShell Clipboard Data Transfer Invoke-Transfer is a PowerShell tool that helps you to send files in highly restricted environments such as Citrix, RDP, VNC or Guacamole. You can send files in text format, in small Base64 encoded chunks or in plaintext. Additionally, you can...

pyc2

pyc2 simple c2 written in python2 to demonstrate security concepts. use icmp echo requests and replies to trade base64 encoded commands and replies. Video explaining some of the security concepts and implementation decisions: https://www.youtube.com/watch?v=DHrEn7oK9vQ requires scapy pip install...

PowerExfil

PowerExfil A collection of custom data exfiltration scripts for Red Team assessments. ExfilCards.ps1 - This script will exfil credit card numbers via base64 encoded strings to a custom DNS server. ExfilDataStreamDNS.ps1 - This script will exfil the entire contents of a file via base64 encoded...

Fudge

Fudge I had some success with on Phishing engagements by base64 encoding the contents of a file, putting it into a HTML file and having it decode and drop when the user opened the HTML file. Usage There are precompiled binaries available on the releases tab for both Windows 64-bit and Linux 64-bi...

PHP-REVERSE-SHELL

PHP Reverse Shell Powerful & Stealthy This is a powerful and stealthy PHP reverse shell designed for ethical hacking and penetration testing. It establishes a reliable and quiet connection back to your machine. ⚠️ Disclaimer This PHP reverse shell is developed strictly for educational and...

CVE-2025-55182-RCE-shell

CVE-2025-55182-RCE-shell Burp Suite/antsword - Interactive shell HTTP hijack + POST + AES-256-CBC/BASE64 Detection -dnslog DNSLog No-Output Detection Nuclei -poc Vulnerability Echo Detection Exploitation -exp Interactive shell base64 echo -exp2 Interactive shell HTTP hijack + POST + Base64 -exp3...

UI_CVE-2017-9248

UICVE-2017-9248 Base64-based encryption oracle exploit for CVE-2017-9248 Telerik UI for ASP.NET AJAX dialog handler...

CVE-2022-28986

CVE-2022-28986 A Insecure direct object references IDOR vulnerability in "Simple 2FA Plugin for Moodle" by LMS Doctor Vulnerability Details Risk : Critical Vendor: LMS Doctor - Simple 2 Factor Authentication Plugin For Moodle Disclosed by: Flaviu Popescu Description: Insecure direct object...

CVE-2021-3131

CVE-2021-3131 Suggested description The Web server in 1C:Enterprise 8 before 8.3.17.1851 sends base64 encoded credentials in the 'creds' URL parameter. VulnerabilityType Other CWE-522 Insufficiently Protected Credentials Vendor of Product 1C Company Affected Product Code Base 1C:Enterprise 8 -...

CVE-2018-19518

CVE-2018-19518 last rapport here : https://gitlab.com/ensimag-security/CVE-2018-19518/-/jobs/artifacts/master/raw/rapport.pdf?job=PDF Usage run app docker-compose up -d example normal usage for the web app. imap : webmail.grenoble-inp.org user : [email protected] password : xxx exploit using...

CVE-2014-6271

Hellshocker 0.1.1 Tool to exploit Shellshock vulnerability Tired of using weak shellshock exploits or just "/bin/bash & /dev/tcp/IP/port 0&1" your way into the server? Yes, you need to upload and execute something more complex to the server, and base64 encoding a huge file is impossible for your...

CVE-2026-23744-poc

CVE-2026-23744 — mcpJam Remote Code Execution RCE Exploit A Python 3 proof-of-concept exploit for CVE-2026-23744 , an arbitrary command execution vulnerability affecting mcpJam v1.4.2. This utility automates payload delivery by transparently Base64-encoding commands before transmission, helping...

MetabaseRCE_CVE-2023-38646

Metabase Pre-Auth RCE CVE-2023-38646 PoC A proof of concept of CVE-2023-38646, a Metabase exploit that allows user to do Remote Code Execution utilizing the setup token found in /api/session/properties to send a payload encoded in base64 Usage ./MetabaseRCECVE-2023-38646 -u target url -t target...