goblob

Goblob 🫐 Goblob es una herramienta de enumeración ligera y rápida diseñada para ayudar en el descubrimiento de información sensible expuesta públicamente en blobs de Azure, lo cual puede ser útil para diversos fines de investigación como evaluaciones de vulnerabilidades, pruebas de penetración y...

CVE-2026-27771

CVE-2026-27771 — Gitea Container Registry Auth Bypass CVSS: N/A unpublished Affects: Gitea Disclaimer: This proof-of-concept is provided for educational and authorized security research purposes only. Unauthorized access to computer systems is illegal. The authors are not responsible for any misu...

CVE-2026-3891

CVE-2026-3891 Pix for WooCommerce = 1.5.0 - Unauthenticated Arbitrary File Upload 💣 Pix for WooCommerce = 1.5.0 – Unauthenticated Arbitrary File Upload CVE-2026-3891 👤 Nxploited 🧩 Description The Pix for WooCommerce plugin for WordPress is vulnerable to unauthenticated arbitrary file upload due t...

tplmap

Tplmap This project is no longer maintained. I'm happy to merge new PRs as long they don't break the test suite. Tplmap assists the exploitation of Code Injection and Server-Side Template Injection vulnerabilities with a number of sandbox escape techniques to get access to the underlying operatin...

CVE-2025-55182

CVE-2025-55182 – React Server Components Remote Code Execution Create By : Virendra Kumar Company : Cyber Leelawat Website :...

ssh-audit

ssh-audit ssh-audit is a tool for ssh server auditing. Features SSH1 and SSH2 protocol server support; grab banner, recognize device or software and operating system, detect compression; gather key-exchange, host-key, encryption and message authentication code algorithms; output algorithm...

launchd-portrep

launchd-portrep launchd-portrep es un exploit para una vulnerabilidad de reemplazo de puertos en launchd, el proceso inicial del espacio de usuario y el demonio de gestión de servicios en macOS. Al enviar un mensaje Mach manipulado al puerto de bootstrap, se puede forzar a launchd a desasignar su...

log4j-poc

log4j-poc An LDAP RCE exploit for CVE-2021-44228 Log4Shell Description The demo Tomcat 8 server on port 8080 has a vulnerable app log4shell deployed on it and the server also vulnerable via user-agent attacks. The remote exploit app in this demo is based on that found at...

ida-pro-mcp

IDA Pro MCP IDA Proでvibeリバースエンジニアリングを可能にするシンプルな MCPサーバー です。 https://github.com/user-attachments/assets/6ebeaa92-a9db-43fa-b756-eececce2aca0 動画で使用したバイナリとプロンプトは、mcp-reversing-dataset リポジトリで入手できます。 前提条件 Python（3.11以上 ） idapyswitch を使用して最新のPythonバージョンに切り替えます IDA Pro（8.3以上、9を推奨）。IDA Freeはサポートされていません...

WP2Shell

WP2Shell - CVE-2026-63030 / CVE-2026-60137 WordPress REST API Batch SQL Injection to RCE Full discovery and exploitation tool for WordPress REST API Batch endpoint vulnerability. This tool exploits a critical SQL injection vulnerability in the WordPress REST API /wp-json/batch/v1 endpoint, allowi...

betwixt

Betwixt te ayudará a analizar el tráfico web fuera del navegador utilizando la interfaz familiar de Chrome DevTools. Instalación Descarga la última versión para tu sistema operativo, crea tu propio paquete o ejecuta Betwixt desde el código fuente. Configuración Para capturar tráfico, tendrás que...

betwixt

Betwixt will help you analyze web traffic outside the browser using familiar Chrome DevTools interface. Installing Download the latest release for your operating system, build your own bundle or run Betwixt from the source code. Setting up In order to capture traffic, you'll have to direct it to...

Vulnerability-Assessment-and-OSINT-CVE-2012-1823

Evaluación de Vulnerabilidades y OSINT: CVE-2012-1823 Mi repositorio documenta el proceso de identificación, análisis y recopilación de Inteligencia de Fuentes Abiertas OSINT sobre una vulnerabilidad de seguridad específica detectada durante un escaneo de red objetivo. Resumen del Proceso El fluj...

GhostTrace

GhostTrace Find what software left behind on Windows, before it finds its way back. GhostTrace is a local Windows forensic trace hunter for incident responders, system administrators, and security-minded power users. It maps persistence, execution, activity, and leftover artifacts into a reviewab...

AgentGuard

AgentGuard Zero-trust sandbox for autonomous AI agents. AgentGuard wraps any AI agent LangChain, CrewAI, AutoGen, custom scripts with safety rails. One command change: root@kitploit: Before dangerous — agent has full system access python myagent.py After sandboxed agentguard run -- python...

onelinepy

onelinepy Ofuscador de Python para código Python FUD. Descarga y ejecución root@kitploit: git clone https://github.com/spicesouls/onelinepy cd onelinepy chmod +x setup.sh ./setup.sh onelinepy Guía de uso root@kitploit: | || | . | | -| | | | -| . | | |Python |||||||||| | |Obfuscator || || usage:...

onelinepy

onelinepy Python Obfuscator for FUD Python Code. Download & Run root@kitploit: git clone https://github.com/spicesouls/onelinepy cd onelinepy chmod +x setup.sh ./setup.sh onelinepy Usage Guide root@kitploit: | || | . | | -| | | | -| . | | |Python |||||||||| | |Obfuscator || || usage: oneline.py -...

sdnpwn

What is sdnpwn? sdnpwn is a toolkit and framework for testing the security of Software-Defined Networks SDNs. For more information check out this article: https://sdnpwn.net/2017/08/22/what-is-sdnpwn/ Installation First download sdnpwn using git root@kitploit: git clone...

Argus-SAF

Argus-SAF: Argus static analysis framework This is official reporitory for the Argus-SAF. For test and play with Argus-SAF, you can fork from our Argus-SAF-playground project, which have the basic setup for a Argus-SAF enhanced project with demo codes of how to perform different kind of analysis...

wp2shell

wp2shell Pre-authentication remote code execution for WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Chains CVE-2026-63030 batch route confusion SQLi with CVE-2026-60137 customizer changeset re-entry to achieve unauthenticated administrator creation and OS command execution. No password cracking required...