CVE-2018-14442

Foxit Reader CPDFParser::mpCryptoHandler Use After Free 1. Antecedentes del formato PDF 2. Diccionarios de cifrado 3. Detalles de la vulnerabilidad 4. Omisión de ASLR y DEP 5. Detalles del entorno 6. Disparador 7. Autor Antecedentes del formato PDF PDF es un formato de archivo utilizado para...

CVE-2025-2594

CVE-2025-2594 Registro de Usuario y Membresía = 4.1.2 - Bypass de Autenticación ¡Descargo de responsabilidad! La información presentada en este informe de CVE Common Vulnerabilities and Exposures es solo con fines educativos e informativos. Los detalles proporcionados se basan en recursos...

CVE-2019-1215

CVE-20190-1215 ws2ifsl.sys UAF exploit for Windows 10 19H1 x64 This exploit uses the recently patched use after free vulnerability CVE-2019-1215 in ws2ifsl.sys to achieve local privilege escalation. The exploit targets Windows 10 19H1 1901 x64 and demonstrates how to bypass kASLR, kCFG and SMEP...

CVE-2023-49547

CVE-2023-49547 Customer Support System 1.0 - SQL Injection Login Bypass Description : Customer Support System is vulnerable 1.0 to SQL Injection. A SQL injection vulnerability in Customer Support System 1.0 enables remote, unauthenticated attackers to bypass the authentication process by exploiti...

CVE-2023-4911

Proof of concept for CVE-2023-4911 Looney Tunables This vulnerability has been discovered by Qualys Threat Research Unit. Here you can read the advisory they published; it explains the vulnerability in depth. The exploit has been tested on Ubuntu 22.04.2 LTS with GLIBC 2.35-0ubuntu3.1. Testing th...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

Nextjs-middleware-vulnerable-appdemo-CVE-2025-29927

Vulnerable Next.js App for Pentesting Practice This is a Next.js application intentionally designed to be vulnerable to CVE-2025-29927: The Next.js Middleware Authorization Bypass Vulnerability. ⚠️ Disclaimer This application is for educational and ethical hacking purposes only. Do not deploy it t...

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset

CVE-2017-8295-WordPress-4.7.4---Unauthorized-Password-Reset Información sobre la vulnerabilidad Wordpress tiene una función de restablecimiento de contraseña que contiene una vulnerabilidad que en algunos casos podría permitir a los atacantes obtener el enlace de restablecimiento de contraseña si...

injectAmsiBypass

Cobalt Strike BOF - Inject AMSI Bypass Cobalt Strike Beacon Object File BOF that bypasses AMSI in a remote process with code injection. Running inject-amsiBypass BOF from CobaltStrike What does this do? 1. Use supplied PID argument to get a handle on the remote process root@kitploit: hProc =...

XORpass

XORpass is an encoder to bypass WAF filters using XOR operations. Installation & Usage root@kitploit: git clone https://github.com/devploit/XORpass cd XORpass $ python3 xorpass.py -h Example of bypass: Using clear PHP function: Using XOR bypass of that function: root@kitploit: $ python3 xorpass.p...

WhoamiAlternatives

Alternatives to whoami Some experiments to retrieve the current username without calling whoami.exe or similar binaries. Method 1: PRTLUSERPROCESSPARAMETERS Get the environment variables from the PEB structure and parse it to find the username. Function NtQueryInformationProcess returns a...

OSWE-Labs-Poc

OSWE - LABORATORIOS Laboratorios dockerizados para la certificación Web Expert OSWE. Preparación para la próxima formación AWAE ... Otro proyecto: análisis de malware y caza de amenazas cibernéticas https://github.com/svdwi/BlueBox Laboratorios disponibles para el OSWE 1. ATutor es un Sistema de...

XSS-Bypass-Filters

XSS-Bypass-Filters Redirección root@kitploit: document.location= document'location'= window.location= this"window""location"= document.location.href= location.href= location= window.location.assign window'location''href'= document.location.replace window.open"link", "blank"; Enlace root@kitploit:...

eaphammer

by Gabriel Ryan s0lst1c3 Current release: v1.14.1 Supports Python 3.9+. Overview EAPHammer is a toolkit for performing targeted evil twin attacks against WPA2-Enterprise networks. It is designed to be used in full scope wireless assessments and red team engagements. As such, focus is placed on...

SharpToken

SharpToken During red team lateral movement, we often need to steal the permissions of other users. Under the defense of modern EDR, it is difficult for us to use Mimikatz to obtain other user permissions, and if the target user has no process alive, we have no way to use "OpenProcessToken" to...

CVE-2024-0012

Comprobador de Vulnerabilidad Palo Alto PAN-OS CVE-2024-0012 Este script de Python verifica la presencia de una vulnerabilidad crítica de omisión de autenticación en la Interfaz Web de Administración de Palo Alto Networks PAN-OS, identificada como CVE-2024-0012. La vulnerabilidad permite que un...

CVE-2020-14882

CVE-2020–14882 Weblogic Unauthorized bypass RCE bypass patch with CVE-2020–14882 private static final String IllegalUrl = new String";", "%252E%252E", "%2E%2E", "..", "%3C", "%3E", ""; list root@kitploit: %252E%252E %2E%2E .. %3E %3C ; lower root@kitploit: "%252E%252E%252F".lower '%252e%252e%252f...

powerob

Powerob 一款即时Powershell脚本混淆工具，专为红队演练设计。因实际需求而生。 本工具仅混淆PowerShell脚本中的函数并移除注释。路线图包括混淆变量。欢迎提交拉取请求和协作。 关于 此工具源于最近一次演练中绕过端点安全的需求。在提权尝试期间，我无法下载PowerUp.ps1直到它被混淆。 技术上这是v2版本，已更新以移除注释。 安装 git clone https://github.com/cwolff411/powerob 用法 python3 powerob.py obfuscate originalfile.ps1 obfuscatedfile.ps1...

powerob

Powerob An on-the-fly Powershell script obfuscator meant for red team engagements. Built out of necessity. This only obfuscates functions and removes found in PowerShell scripts. Roadmap includes bfuscating variables. Pull requests and collaborative welcomed. About This was built out of the need ...

egressbuster

EgressBuster Copyright 2015 TrustedSec - EgressBuster Written by: David Kennedy ReL1K Company: TrustedSec DISCLAIMER: This is only for testing purposes and can only be used where strict consent has been given. Do not use this for illegal purposes period. Please read the LICENSE for the licensing ...