mzap

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...

DFShell

██████╗ ███████╗███████╗██╗ ██╗███████╗██╗ ██╗ ██╔══██╗██╔════╝██╔════╝██║ ██║██╔════╝██║ ██║ ██║ ██║█████╗ ███████╗███████║█████╗ ██║ ██║ ██║ ██║██╔══╝ ╚════██║██╔══██║██╔══╝ ██║ ██║ ██████╔╝██║ ███████║██║ ██║███████╗███████╗███████╗ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝╚══════╝╚══════╝╚══════╝...

CVE-2025-52691-poc

CVE-2025-52691 POC Proof of Concept for CVE-2025-52691 - SmarterMail Unauthenticated Arbitrary File Upload RCE ⚠️ Disclaimer For authorized security testing and educational purposes only. Unauthorized access is illegal. Overview Critical vulnerability in SmarterMail allowing unauthenticated...

CVE-2026-27886-check

CVE-2026-27886 Vulnerability Assessment Tool Safely detect whether a Strapi instance is vulnerable to CVE-2026-27886 without performing the full account-takeover chain. See the full write-up on the Bishop Fox blog. Description CVE-2026-27886 is an unauthenticated parameter sanitization bypass in...

syntribos

======================== Team and repository tags .. image:: http://governance.openstack.org/badges/syntribos.svg :target: http://governance.openstack.org/reference/tags/index.html .. image:: http://img.shields.io/badge/docs-latest-brightgreen.svg?style=flat :target:...

IG-Detective

IG-Detective 🕵️‍♂️📸 Created by@shredzwho | 💖 Sponsor this project IG-Detective is a high-performance, Python-based Open Source Intelligence OSINT tool for Instagram. It offers a premium interactive shell to perform deep analysis on Instagram accounts, extract location history, mapping interactions,...

waf-fu

waf-fu AWS WAF v2 log browser and replayer with an interactive TUI. Pulls logs from CloudWatch, S3, and the WAF sampling API with SQLite caching, displays them in a split-pane terminal UI with auth detection and YAML-based filtering, and replays requests through Firefox, Chrome, or curl with full...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 nuclei template Joomla CVE-2023-23752 - a request parameter breaks through the Rest API Affected version ​ Joomla roughly has three routing entries, which are 1. index.php in the root directory users access articles 2. administrator/index.php in the root directory...

XSSFuzzer

XSS Fuzzer XSS Fuzzer is a simple application written in plain HTML/JavaScript/CSS which generates XSS payloads based on user-defined vectors using multiple placeholders which are replaced with fuzzing lists. It offers the possibility to just generate the payloads as plain-text or to execute them...

write-ups

write-ups RCE in Github Desktop v2.9.4 RCE via gh run download GitHub CLI Claude Code: unsandboxed code execution from prompt injection via .git worktree confusion — CVE-2026-55607...

XSS-Catcher

XSS Catcher A blind XSS detection and XSS data capture framework that runs on Flask, VueJS and PostgreSQL. XSS Catcher is an intuitive tool that automates blind Cross-Site Scripting XSS attacks and data gathering, including screenshots. It features a user-friendly payload generator for creating...

qyvora-anansi

; & ;; ;& ;;; ;;; ; ;;; ;;; ; ;;; ;;; ; ;; ;;; ;;; ;;;; ;;;; ;;; && ;;; ;;;; ;;;; ;;;; ;;;; ;;;;;;;;;; ;;;; ;;;; ;;;;;;;;; ;;;;;;;;;;;;;;;; ;;;;;;;;; &;;;;;;;;;;;;$x;;;;;;;;;;;; ;;;;;;;;;;&&&+++&&&;;;;;;;;;;; ;;;;;;;;; ;;;&&+&&&&&+&&;;; ;;;;;;;;;; ;;;& ;; ;;;&+&&&&&&&+&&;;; ;; &;;; ;;; ;;;;...

project_mantis

Project Mantis: Hacking Back the AI-Hacker Prompt Injection as a Defense Against LLM-driven Cyberattacks Install Mantis pip install -r requirements.txt Run Mantis with pre-made configurations Various pre-made configurations are available in the ./confs directory. Hack-back An example of a Mantis...

cupcake

Cupcake Make AI agents follow the rules. Policy enforcement layer for AI agents; yielding better performance and security without consuming model context. Deterministic rule-following for your agents. Interactive Examples Better performance by moving rules out of context and into policy-as-code...

Exploit for CVE-2023-54391

CVE-2023-54391 – Proxmox VE Authentication Bypass TFA Bypass...

CVE-2025-2945_PgAdmin_PoC

CVE-2025-2945PoC pgAdmin Proof of Concept pgAdmin Query Tool RCE CVE-2025-2945 – Python Proof of Concept ⚠️ Disclaimer This repository contains a proof-of-concept exploit for CVE-2025-2945, a critical remote code execution vulnerability in pgAdmin 4 versions prior to 9.2. Use this code only in...

CVE-2021-38699-Reflected-XSS

CVE-2021-38699 : Multiple Reflected XSS in TastyIgniter v3.0.7 Restaurtant CMS Authenticated reflected XSS exists in the TastyIgniter Admin dashboard in version 3.0.7. https://vulners.com/cve/CVE-2021-38699 POC: Admin dashboard start param: POST http://cvefarm.local/admin/dashboard HTTP/1.1...

gtfobins-cli

🚀 GTFOBins CLI Overview GTFOBins CLI is a command-line interface for GTFOBins, providing instant access to Unix binary exploitation techniques. This tool helps security professionals and system administrators identify and understand how legitimate Unix binaries can be misused to bypass security...

CVE-2024-9796

CVE-2024-9796 WordPress WP-Advanced-Search = 5.0.12 time-based blind IF - comment Payload: t=wpautosuggest&f=ifnow=sysdate,SLEEP9,0-- wXyW&l=5&type=0&e=utf-8&q=c&limit=5&timestamp=13672261755853'...

CVE-2026-4480-POC

CVE-2026-4480 - Samba Printing Subsystem Remote Code Execution Overview Proof-of-concept and research material related to CVE-2026-4480 , a critical Remote Code Execution RCE vulnerability affecting the Samba printing subsystem. The vulnerability is caused by improper handling of user-controlled...