VulnNodeApp

VulnNodeApp A vulnerable application made using node.js, express server and ejs template engine. This application is meant for educational purposes only. Setup Clone this repository root@kitploit: git clone https://github.com/4auvar/VulnNodeApp.git Application setup: Install the latest node.js...

ToolsFx

ToolsFx English|中文 Visitors :eyes: Function Encoding wiki base64 urlBase64 base16/32/36/45/58/62/85/91/92/100 base58check UrlEncode Unicode js hex\x61/js octal\140 binary/octal/decimal/hex custom base serial dict puny code quote printable uuEncode xxEncode escape/escapeAll auto decodecrack String...

WinFiHack

WinFiHack root@kitploit: \ \ / | | | | | | \ \ /\ / /| | ' | | | | || |/ |/ | |/ / \ V V / | | | | | | | | | | | | Tool: Provi...

PyStat

PyStat - Advanced Netstat For Windows Compatible with Python Version 2.7 Features Know remote address of process Know remote ports of process Know which user using process along with title & PID Changelogs: Auto Install python modules support added in install.py Installation Guide: Download the...

ghidrecomp

Ghidrecomp - Command Line Ghidra Decompiler About This Python command line tool decompiles all functions of a binary and writes them to a directory in separate C files: root@kitploit: flowchart LR afilename -- bghidrecomp a2Symbol Server -- b b -- eGhidra Project Files b -- output subgraph output...

htb-writeups

Hack The Box Writeups - The Ultimate HTB Resource The most comprehensive collection of Hack The Box writeups , walkthroughs , and cheatsheets on GitHub. 500+ machines, 400+ challenges, ProLabs, Sherlocks DFIR, CTF events, penetration testing methodology, and OSCP/CPTS certification prep - all in...

ProtectMyTooling

Don't Detect Tools - Detect Techniques Rationale behind releasing this software was outlined in an acompanying blog post: ProtectMyTooling - Don't detect tools, detect techniques Intro Script that wraps around multitude of packers, protectors, obfuscators, shellcode loaders, encoders, generators ...

CVE-2019-13292-WebERP_4.15

Blind SQL Injection Exploit for WebERP This is a Python3 script that demonstrates an exploit for a Blind SQL Injection vulnerability in WebERP version 4.15, initially discovered by Semen Alexandrovich Lyhin on June 10, 2019. The original exploit can be found here, and further details regarding th...

CVE-2025-9074

CVE-2025-9074 - Docker Remote API Lab PoC ⚠️ Disclaimer: This repository is for educational and research purposes only. Do not use this code outside of a controlled environment that you own. The author is not responsible for misuse. Overview This repository contains a proof-of-concept PoC for...

gcp_scanner

Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...

turbinia

Turbinia Summary Note: Turbinia will not develop new features anymore and is in maintenance mode. Users should have a look atOpenRelik. Turbinia is an open-source framework for deploying, managing, and running distributed forensic workloads. It is intended to automate running of common forensic...

sift-kg

sift-kg Turn any collection of documents into a knowledge graph. No code, no database, no infrastructure — just a CLI and your documents. Drop in PDFs, papers, articles, or records — get a browsable knowledge graph that shows how everything connects, in minutes. sift-kg extracts entities and...

BLAKE3

BLAKE3 BLAKE3 is a cryptographic hash function that is: Much faster than MD5, SHA-1, SHA-2, SHA-3, and BLAKE2. Secure , unlike MD5 and SHA-1. And secure against length extension, unlike SHA-2. Highly parallelizable across any number of threads and SIMD lanes, because it's a Merkle tree on the...

metabase-pre-auth-rce-poc

Metabase Pre-Auth RCE CVE-2023-38646 POC This is a script written in Python that allows the exploitation of the Metabase's software security flaw described in CVE-2023-38646. The system is vulnerable in versions preceding 0.46.6.1 , in the open-source edition, and preceding 1.46.6.1 , in the...

mongobleed-detector

MongoBleed Detector Offline MongoDB Analysis Tool for CVE-2025-14847 MongoBleed A standalone Linux command-line tool that analyzes MongoDB data to identify likely exploitation of CVE-2025-14847 using multiple detection modules. Table of Contents Overview Detection Modules Requirements Installatio...

pentestagent

PentestAgent AI Penetration Testing https://github.com/user-attachments/assets/a67db2b5-672a-43df-b709-149c8eaee975 Requirements Python 3.10+ API key for OpenAI, Anthropic, or other LiteLLM-supported provider Install root@kitploit: Clone git clone https://github.com/GH05TCREW/pentestagent.git cd...

RTI-Toolkit

RTI-Toolkit Remote Template Injection Toolkit Description RTI-Toolkit is an open-source PowerShell toolkit for Remote Template Injection attack. This toolkit includes a PowerShell script named PS-Templator.ps1 which can be used from both an attacking and defensive perspective. The following table...

Inline-Execute-PE

Inline-Execute-PE DISCLAIMER: This project is complex and failure to understand how it works and adequately test it can result in you crashing Beacons and losing access! I highly encourage you to read all of the documentation up until the "Design Considerations and Commentary" section! Introducti...

CVE-2021-40113

CVE-2021-40113 Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network PON Series Switches Optical Network Terminal ONT could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the...

RansomCoinPublic

RansomCoin Extracting metadata and hardcoded Indicators of Compromise from ransomware, in a scalable, efficient, way with cuckoo integrations. Ideally, is it run during cuckoo dynamic analysis, but can also be used for static analysis on large collections of ransomware. Designed to be fast, with...