DDWPasteRecon

DDWPasteRecon Pastesites are websites that allows users to share plain text through public posts called “pastes.” Once attackers compromise the external perimeter and gain access to the internal resources they release the part of data on the "paste" sites like pastebin or hastebin. As these hacke...

CloudMiner

CloudMiner Execute code within Azure Automation service without getting charged Description CloudMiner is a tool designed to get free computing power within Azure Automation service. The tool utilizes the upload module/package flow to execute code which is totally free to use. This tool is intend...

wahh_extras

wahhextras The Web Application Hacker's Handbook - Extra Content For all of you who have read "The web application hacker's handbook vol2", there are several references to extras, questions, source code that are not easy to found. I've collected all in this repository. TOC Web applications...

threatspec

threatspec - continuous threat modeling, through code Threatspec is an open source project that aims to close the gap between development and security by bringing the threat modelling process further into the development process. This is achieved by having developers and security engineers write...

caracal

Caracal Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts. Features Detectors to detect vulnerable Cairo code Printers to report information Taint analysis Data flow analysis framework Easy to run in Scarb projects Installation Precompiled binaries...

claude-code-guardrails

We have since built a dedicated product to help developers manage AI permissions better, which we intend to make open source. Check it out atstoplight.ai. Claude Code Guardrails settings.json works if: You're fine editing JSON and killing Claude Code sessions every time policy changes Your securi...

Spring4Shell-POC

Spring4Shell-POC Local reproduction process of Spring4Shell vulnerability Environment Preparation Environment: docker, docker-compose mvn package, generate ./target/ROOT.warshell mvn package Start the serviceshell docker-compose up -d Stop serviceshell docker-compose down Reproduction Process Run...

rosenbridge

project:rosenbridge : hardware backdoors in x86 CPUs github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax Overview project:rosenbridge reveals a hardware backdoor in some desktop, laptop, and embedded x86 processors. The backdoor allows ring 3 userland code to circumvent processor...

DNCI

DNCI - Dot Net Code Injector DNCI allows the injection of .Net code .exe or .dll remotely in unmanaged processes in windows. 1. Project Structure The project is structured in: DNCI.Injector.Library - Injection library. Contains all injection components and logic; DNCI.Injector.Runner - Command...

Code-Roulette

Code Roulette Terminal interface based, online multiplayer, Russian Roulette where the loser executes the winner's Python payload file. Code Roulette Overview How the Game Works Demo Video Usage As a Package With the UV Package Manager With Pip Payload Files Development Licensing The Main...

skf-flask

OLD and archived Security Knowledge Framework Please note that this is the archived version of SKF, we are busy building a brand new Security Knowledge Framework. For more updates please visit this github repo: https://github.com/Security-Knowledge-Framework/Platform...

ninjasworkout

Damn Vulnerable NodeJS Application Quick Start Download the Repo = run npm i Afer Installing all dependency just run the application node app.js or nodemon app.js ADDED BUGS Prototype Pollution ✅1 No SQL Injection ✅2 Cross site Scripting ✅3 Broken Access Control ✅4 Broken Session Management ✅5 We...

CVE-2020-1493

CVE-2020-1493 This vulnerability occurs in Outlook 2019 16.0.12624.20424 installed on Windows 10 1909 x64, Also This vulnerability is zero click vulnerability. TLDR; I found this bug usng winafl fuzzer. This bug occured when parsing ms-tnef file. that attachement of eml file. vulnerable method re...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

nray

nray Overview Nray is a free, platform and architecture independent port and application layer scanner. nray runs in a distributed manner to speed up scans and to perform scans from different vantage points. Event-based results allow to further process information during the scan, e.g. using tool...

jsecret

jsecret simple and fast tool to detect sensitive data in the source code such as javascript files or others install go install -v github.com/raoufmaklouf/jsecret@latest Usage cat jsfiles.txt | jsceret echo http://test.tld/main.js | jsecret Big thank to https://twitter.com/medmahmoudi619 for helpf...

CVE-2026-109883

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Elementor Elementor Website Builder elementor allows Code Injection.This issue affects Elementor Website Builder: from n/a through 4.3.5...

PolyDrop

BYOSI - Bring-Your-Own-Script-Interpreter - Leveraging the abuse of trusted applications, one is able to deliver a compatible script interpreter for a Windows, Mac, or Linux system as well as malicious source code in the form of the specific script interpreter of choice. Once both the malicious...

pwndrop

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...

RemoteTLSCallbackInjection

Maldev Academy - RemoteTLSCallbackInjection Quick Links Maldev Academy Home Maldev Academy Syllabus Related Maldev Academy Modules New Module 34: TLS Callbacks For Anti-Debugging New Module 35: Threadless Injection Overview This method utilizes TLS callbacks to execute a payload without spawning...