msmailprobe

msmailprobe Office 365 and Exchange Enumeration It is widely known that OWA Outlook Webapp is vulnerable to time-based user enumeration attacks. This tool leverages all known, and even some lesser-known services exposed by default Exchange installations to enumerate users. It also targets Office...

maskprocessor

maskprocessor High-Performance word generator with a per-position configurable charset Mask attack Try all combinations from a given keyspace just like in Brute-Force attack, but more specific. Advantage over Brute-Force The reason for doing this and not to stick to the traditional Brute-Force is...

arp-validator

arp-validator Herramienta de seguridad para detectar ataques de envenenamiento ARP Características Utiliza un enfoque más rápido en la detección de ataques de envenenamiento ARP en comparación con enfoques pasivos Detecta no solo la presencia de envenenamiento ARP sino también el mapeo IP-MAC...

arp-validator

arp-validator Security Tool to detect arp poisoning attacks Features Uses a faster approach in detection of arp poisoning attacks compared to passive approaches Detects not only presence of ARP Poisoning but also valid IP-MAC mapping when LAN hosts are using non-customized network stack Stores...

bincat

Introduction What is BinCAT? BinCAT is a static Binary Code Analysis Toolkit, designed to help reverse engineers, directly from IDA or using Python for automation. It features: value analysis registers and memory taint analysis type reconstruction and propagation backward and forward analysis...

CVE-2022-22965_PoC

Explotación de RCE en Spring Framework Notas rápidas de pentest Paso 1: Encuentra algún endpoint en tu objetivo donde se acepten métodos POST/PUT + codifica tu payload URL encode POST /path/upload HTTP/1.1 Host: Origin: Cookie: JSESSIONID=BE65B534335A5A2538624404C063B70C; Content-Type:...

xssless

xssless An automated XSS payload generator written in python. Usage 1. Record requests with Burp proxy 2. Select requests you want to generate, then right click and select "Save items" 3. Use xssless to generate your payload: ./xssless.py burpexportfile 4. Pwn! A more detailed tutorial can be fou...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version v12.1.1.3 Vulnerability Details CVEID:CVE-2026-59270 DESCRIPTION: Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all...

postshell

PostShell PostShell is a post-exploitation shell that includes both a bind and a back connect shell. It creates a fully interactive TTY which allows for job control. The stub size is around 14kb and can be compiled on any Unix like system. ScreenShots Banner and interaction with shell after a...

uac-a-mola

uac-a-mola Instalación Para instalar uac-a-mola debes realizar las siguientes acciones: 1. Descargar e instalar Python 2.7.x para Windows teniendo en cuenta tu infraestructura particular, puedes encontrar los binarios aquí: https://www.python.org/downloads/ 2. Añadir la ruta de Python a la variab...

CVE-2024-30851-jasmin-ransomware-path-traversal-poc

PoC de path traversal en el panel web del ransomware Jasmin EducationalPurposes https://github.com/codesiddhant/Jasmin-Ransomware Descubrí una vulnerabilidad de path traversal previo a la autenticación en el panel web del ransomware Jasmin CVE-2024-30851, que permite a un atacante desanonimizar a...

eyeballer

Eyeballer Give those screenshots of yours a quick eyeballing. Eyeballer is meant for large-scope network penetration tests where you need to find "interesting" targets from a huge set of web-based hosts. Go ahead and use your favorite screenshotting tool like normal EyeWitness or GoWitness and th...

snmp-shell

SNMP Shell Simulación de Shell sobre Net-SNMP con funcionalidad extend Aquí una vista previa : Descripción Si tu objetivo tiene una instancia de Net-SNMP con la funcionalidad "extend" , y tienes una cadena de comunidad SNMP que te otorga acceso de escritura , puedes usar esta herramienta para...

CVE-2026-106435

The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element without a trailing NUL byte. An actor who can supply BSON to the documented decode or decodeall API can cause the application proce...

mojarra-2.2.13-patched

Mojarra 2.2.13 – CVE-2020-6950 Backport This repository contains a reproducible backport of the fix for CVE-2020-6950 to Mojarra 2.2.13. It exists primarily for traceability and for maintaining legacy applications which, for compatibility reasons, cannot simply be upgraded to a newer JSF/Mojarra...

binja_dynamics

Binary Ninja Dynamic Analysis Tools Este proyecto añade una interfaz PyQt5 al plugin binjatron para Binary Ninja, que incluye funciones de resaltado orientadas a facilitar que los principiantes aprendan ingeniería inversa. Motivación La capacidad de aplicar ingeniería inversa a binarios x86 es un...

blackboxprotobuf

Blackbox Protobuf Blackbox Protobuf now has an official package on PyPi under the namebbpb. The blackboxprotobuf package is an older fork Description Blackbox Protobuf is a set of tools for working with encoded Protocol Buffers protobuf without the matching protobuf definition. Protobuf is a bina...

bpflock

bpflock - Lock Linux machines bpflock - eBPF driven security for locking and auditing Linux machines. Note: bpflock is currently in experimental stage , it may break, options and security semantics may change, some BPF programs will be updated to use Cilium ebpf library. Sections 1. Introduction...

binja_sensei

binjasensei Herramientas educativas para Binary Ninja Este plugin proporciona recursos para que principiantes aprendan ingeniería inversa usando Binary Ninja. Instala automáticamente varios otros plugins y ofrece ejemplos que muestran las funcionalidades de estos plugins. Orígenes Este proyecto e...

jackdaw

jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...