Steganography

Steganography Table of Contents Installation Byte Sequence Manipulation WavSteg LSBSteg StegDetect If you are unfamiliar with steganography techniques, I have also written a basic overview of the field in Steganography: Hiding Data Inside Data. Installation This project is on PyPI and can be...

DefenderCheck

DefenderCheck Quick tool to help make evasion work a little bit easier. Warning: As of the 1.337.157.0 Defender signature update, DefenderCheck is classified as VirTool:MSIL/BytzChk.C!MTB. As a workaround while I work to get around this, please disable Real-time Protection in Defender before...

CVE-2026-43284-DirtyFrag-PoC

CVE-2026-43284 — 4-byte XFRM/ESP Proof-of-concept local privilege escalation via XFRM/ESP page-cache corruption 4-byte write primitive · 48 iterations · 192-byte ELF overwrite · unprivileged user + netns Proof of concept Left: kernel preflight, setuid scan, and exploit chain · Right: root shell...

CVE-2019-11043

CVE-2019-11043 PHP-FPM Remote Code Execution Screencast: https://youtu.be/d6benC5FVZM Overview This zero-day exploit in common PHP-FPM configurations was discovered during the Realworld CTF competition in 2019. A regular expression is used to parse the requested URI, but newline characters %0a ar...

RecoverPy

RecoverPy Scan raw partitions and recover data by inspecting disk blocks directly. 🎬 Demo 🔎 Overview When a file is deleted, its metadata disappears first. The underlying disk blocks often remain intact until they are reused. RecoverPy scans raw partition data directly and searches for byte...

CVE-2025-47812

CVE-2025-47812 – Wing FTP Server RCE Exploit Exploit Title: Wing FTP Server 7.4.4 Remote Code Execution via Lua Injection CVE: CVE-2025-47812 Tested on: Wing FTP Server v7.3.x Windows/Linux Impact: Remote Code Execution RCE as SYSTEM/root Severity: Critical Description A vulnerability in Wing FTP...

CVE-2025-47812-Wing-FTP-Server-7.4.3-Unauthenticated-RCE-PoC

CVE-2025-47812 — Wing FTP Server Unauthenticated remote code execution vulnerability in Wing FTP Server whoami root References CVE-2025-47812 W...

NOP_Plugin

NOPPlugin Plugin for NOPing instructions in IDA. The creation of the plugin was inspired by Vidar Stealer I was trying to remove the junk bytes / instructions. Before: After: Instructions Paste the NOPPlugin.py file under "plugins" subdirectory of IDA. To NOP the instructions out just select the...

interactive-binary-structures

Interactive Binary Structures An interactive web-based toolkit designed to bridge the gap between theoretical documentation and practical analysis of binary formats and system memory layouts. Portable Executable PE Format Documentation This tool serves as an interactive visual map of a Windows PE...

frida-ios-hook

Frida iOS hook 📍 A tool that helps you can easy using frida. It support script for trace classes, functions, and modify the return values of methods on iOS platform. 👉 For Android platform: frida-android-hook 👉 For Intercept Api was encrypted on iOS application: frida-ios-intercept-api Env OS...

ThreatCheck

ThreatCheck Modified version of Matterpreter's DefenderCheck. Takes a binary as input either from a file on disk or a URL, splits it until it pinpoints that exact bytes that the target engine will flag on and prints them to the screen. This can be helpful when trying to identify the specific bad...

Absolutely-Positively-NOT-Hacking-Back-with-Pcap

Absolutely Positively NOT Hacking Back with Pcap Streaming Unexpected Network Byte Sequences with High Probability of Blue Screening or Otherwise Crashing Attacker Command-and-Control Nodes This was presented at TheSAS2019: https://www.youtube.com/watch?v=Z1-4-amGdaM...

CVE-2025-47812-poc

CVE-2025-47812 Wing FTP Server Remote Code Execution RCE Exploit CVE-2025-47812 📌 Credit : Vulnerability discovered by Julien @MrTuxracer. This PoC implementation is based on their original research. This repository hosts a Python exploit for the Wing FTP Server Remote Code Execution RCE...

CVE-2025-47812-poC

CVE-2025-47812-poC Simple exploit for Wing FTP Server RCE CVE-2025-47812 to run commands and get a reverse shell. For educational use only. Vulnerability Details This security vulnerability was publicly disclosed and detailed by RCESecurity...

st2-046-poc

Struts2 Content-Disposition filename null-byte variant of CVE-2017-5638 Struts2 Security Bulletin S2-046 A null byte \x00 in a request¡¯s Content-Disposition header filename field can trigger a InvalidFileNameException with the same client controlled filename string in the exception message that ...

ExploiteameEsta

ExploiteameEsta CVE-2021-30937 vulnerability checking app What is this? This project is an application for iOS devices dedicated to iOS 15.0-15.1.1. You will be able to test whether the vulnerability mentioned above is compatible with your device or not. You will be shown several alerts and pop-u...

Fnord

Fnord Fnord is a pattern extractor for obfuscated code Description Fnord has two main functions: 1. Extract byte sequences and create some statistics 2. Use these statistics, combine length, number of occurrences, similarity and keywords to create a YARA rule 1. Statistics Fnord processes the fil...

byvalver

byvalver ·𐑚𐑲𐑝𐑨𐑤𐑝𐑼 THE SHELLCODE BAD-BYTE BANISHER Overview • Quick Start • Interactive TUI • Targeted Bad-Byte Elimination • Bad-Byte Profiles • Features • Architecture • System Requirements • Dependencies • Building • Installation • Usage • Obfuscation Strategies • Denullification Strategies • M...

InflativeLoading

InflativeLoading Article: https://winslow1984.com/books/malware/page/reflectiveloading-and-inflativeloading Major Update History In this section, major updates are provided. Major updates do include added supports or features. 4/11/2024 Added PE Signature Obfuscation Only a few bytes in the PE...

AMSI-ETW-Patch

AMSI-ETW-Patch this repo contains information to patch AMSI and ETW using a single byte patch for both. The idea was to limit detection of the patch itself since it's a single byte. AMSI patch-amsi-x64.c The idea is that AMSI perform a lot of validation check before hitting the critical AMSI...