SecLists

About SecLists SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to...

Sn1per

Products Attack Surface Management About Sn1per News Contact Demo Pricing Shop Sn1per — The Offensive-Security Platform for Modern Teams Recon, scanning, exploitation, and reporting in a single workspace — whether you're a solo pentester or a global SOC. Sn1per Professional 2026 is here The large...

java-stager

java-stager A PoC Java Stager which can download, compile, and execute a Java file in memory. This is for research purposes only, do not use this where you are unauthorised to do so. What is this? This is based on the work of James Williams from his talk "Next Gen AV vs My Shitty Code" available...

365-Stealer

365-Stealer Table of Contents About 365-Stealer About Illicit Consent Grant Attack Key Features of 365-Stealer Setup Attacking Environment Automated Azure App Registration Manual Azure App Registration Configuring the Application Creating Client Secrets Adding API Permissions Setting Up 365-Steal...

auth_analyzer

Auth Analyzer Table of Contents What is it? Why should I use Auth Analyzer? GUI Overview Parameter Extraction Auto Extract From To String Static Value Prompt for Input Parameter Replacement Replacement Location Parameter removement Sample Usage Auto extract session Cookie Session Header and CSRF...

Nettacker

OWASP Nettacker DISCLAIMER THIS SOFTWARE WAS CREATED FOR AUTOMATED PENETRATION TESTING AND INFORMATION GATHERING. YOU MUST USE THIS SOFTWARE IN A RESPONSIBLE AND ETHICAL MANNER. DO NOT TARGET SYSTEMS OR APPLICATIONS WITHOUT OBTAINING PERMISSIONS OR CONSENT FROM THE SYSTEM OWNERS OR ADMINISTRATORS...

CVE-2020-0022

CVE-2020-0022 vulnerability exploitation on Bouygues BBox Miami Android TV 8.0 - ARM32 Cortex A9 By Polo35 - 2020/08/24 "Usage: python poloexploit.py targetbtmac targetadbip, shellcommand, disablereboot, verbose" Based on scripts by Jan Ruge CVE-2020-0022 an Android 8.0-9.0 Bluetooth Zero-Click R...

jsdeob-workbench

jsdeob-workbench A visual workbench for deobfuscating JavaScript. Build transform chains, step through them, write your own plugins. YouTube Demo https://www.youtube.com/watch?v=7zuqKoJT2BM https://www.youtube.com/watch?v=bOVnPIfjoco What is this? This application reveals the Abstract Syntax Tree...

chimera

Chimera Sandbox untrusted code with safe access to the host. Chimera is a userspace sandbox for code you don't fully trust — a natural fit for coding agents that run arbitrary, generated commands on a machine they share with you. It confines what a process can do to the host while still letting i...

Blackash-CVE-2025-47812

🛡️ CVE-2025-47812 – Critical RCE in Wing FTP Server 🛡️ 🔎 Overview: CVE-2025-47812 is a critical remote code execution RCE vulnerability affecting Wing FTP Server versions prior to 7.4.4. It was discovered by a security researcher and has been confirmed to be actively exploited in the wild. 🧱 Root...

PS2EXE

AI free repository - artificial intelligence is killing creativity and our nature! PS2EXE Overworking of the great script of Ingo Karstein with GUI support. The GUI output and input is activated with one switch, real windows executables are generated. Compiles only Powershell 5.x compatible...

CVE-2025-3419

CVE-2025-3419 - WordPress Eventin = 4.0.26 - Arbitrary File Read 🔥 Vulnerability Summary The Eventin plugin = 4.0.26 for WordPress contains an unauthenticated arbitrary file read vulnerability in the proxyimage function. Attackers exploit insufficient input validation by manipulating the url...

chisel-ng

| | | | / | ' | / |/ \ || ' \ / | | | | | | \ \ / || | | | | | || |||/|| || ||, | |/ chisel-ng A Rust implementation of chisel for penetration testing and red team operations. Establishes reverse tunnels over SSH-over-WebSocket-over-TLS, allowing operators to pivot through compromised hosts...

SocialFish

SocialFish v3.0 Modern Dynamic Phishing Toolkit SocialFish v3.0 brings powerful new features for cloning modern login pages, capturing cookies, and intercepting 2FA codes with a live operator panel. 🆕 What's New in v3.0 Playwright Browser Automation — Clone modern JS-heavy login pages Full Cookie...

ShellGhost

ShellGhost A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation I wanted to share this shellcode self-injection POC to showcase some AV/EDR evasion concepts that may turn useful for Red Teaming. Just a few weeks ago I came up with a custom in-memo...

CVE-2023-51800

CVE-2023-51800 School Fees Management System v1.0 - Multiple cross-site scripting XSS vulnerabilities Description : Multiple cross-site scripting XSS vulnerabilities in School Fees Management System v1.0. Vulnerable Product Version : School Fees Management System v1.0 CVE Author : Geraldo Alcânta...

CVE-2018-8941

CVE-2018-8941: D-Link DSL-3782 Code execution Proof of Concept Adam Simuntis :: https://twitter.com/adamsimuntis Mindaugas Slusnys :: https://twitter.com/mislusnys The buffer overflow vulnerability was found in the "/userfs/bin/tcapi" binary which is used as a wrapper for the "Diagnostics"...

CVE-2024-24919

EN Is a Proof of Concept PoC script to check for vulnerability CVE-2024-24919. The script is designed to send HTTP POST requests to specified URLs and analyze the responses for possible security issues, like unauthorized access or sensitive data leaks. The script provides a simple yet powerful wa...

DSCourier_BOF

DSCourier BOF This is a BOF implementation of Dylan Davis and Matthew Schramm's DSCourier project. It uses WinGet's COM interface to execute arbitrary powershell code in a Microsoft signed and trusted process. Their full research blog can be found here. Unlike most projects I release, this is NOT...

venom

Venom C2 Venom C2 is a dependency‑free Python3 Command & Control framework for redteam persistence, built to run on systems without installing packages. It comprises a Flask team server, an Electron operator GUI, and a single‑file Python agent that communicates over HTTP/HTTPS using configurable...