tlsenum

tlsenum tlsenum is a command-line TLS enumeration tool that attempts to enumerate what TLS cipher suites a server supports and list them in order of priority. It works by sending out sending out TLS ClientHello messages and parsing the ServerHello responses from the server. tlsenum assumes that t...

DoHC2

⚠️ NOTE: This tool is no longer under active maintenance. DoHC2 DoHC2 allows the ExternalC2 library from Ryan Hanson https://github.com/ryhanson/ExternalC2 to be leveraged for command and control C2 via DNS over HTTPS DoH. This is built for the popular Adversary Simulation and Red Team Operations...

maltrieve

root@kitploit: | | | || | | |/ | | \ / | | | | | | | | | \ | | / | Maltrieve Maltrieve originated as a fork of mwcrawler. It retrieves malware directly from the sources as listed at a number of sites. Currently we crawl the following: Malc0de Malware Domain List Malware URLs VX Vault URLquery...

DAMM

DAMM An open source memory analysis tool built on top of Volatility. It is meant as a proving ground for interesting new techniques to be made available to the community. These techniques are an attempt to speed up the investigation process through data reduction and codifying some expert...

blackpill

BlackPill BlackPill is a stealthy Linux rootkit made in Rust. Features The rootkit is composed of multiple modules talking about Rust modules, not kernel modules: defense evasion : hide files, processes, network connections, etc. hooking : hook syscalls and IDT hypervisor : create a virtual machi...

passera

Note: I no longer have the time to continue development of Passera, but pull requests are more than welcome! The number one requested item would be an updated Firefox extension, since the latest API change broke the current release. Passera A simple tool that allows users to have strong unique...

NINJA-PingU

NINJA PingU NINJA-PingU Is Not Just a Ping Utility is a free open-source high performance network scanner tool for large scale analyses. It has been designed with performance as its primary goal and developed as a framework to allow easy plugin creation. NINJA PingU comes out of the box with a se...

CVE-2025-9074-docker-escape

CVE-2025-9074-Docker Escape HTB MonitorsFour This code is for educational purposes only and controlled environments such as laboratories Hack The Box. Do not use on systems without authorization. This repository contains an exploit script for the Docker Remote API exposed without authentication...

Johnny-You-Are-Fired

Johnny-You-Are-Fired Artifacts for the USENIX publication | Full paper here Abstract OpenPGP and S/MIME are the two major standards to encrypt and digitally sign emails. Digital signatures are supposed to guarantee authenticity and integrity of messages. In this work we show practical forgery...

CVE-2021-3156-Sudo-Buffer-Overflow-Linux

CVE-2021-3156 – Sudo Buffer Overflow Linux Baron Samedit Privilege Escalation Exploit 📌 Overview This project demonstrates the exploitation of CVE-2021-3156 Baron Samedit , a critical heap-based buffer overflow vulnerability in the Linux sudo utility. The vulnerability allows a low-privileged use...

Exploiting-Samba-on-Metasploitable-2

Exploiting-Samba-on-Metasploitable-2 My goal here was to utilize metasploit from a Kali Linux machine to exploit a well-known samba vulnerability CVE-2007-2447. This is done in order to infiltrate a Metasploitable 2 machine with a reverse shell to access the root folder. Once this folder has been...

CVE-2026-85623

A flaw was found in goose. This vulnerability allows attackers to execute arbitrary commands by distributing malicious recipes that leverage insecure recipe standard input/output stdio extensions and retry checks. This bypasses the existing security scan, enabling the execution of shell commands...

ldap-swak

LDAP Swiss Army Knife Multi-function LDAP server utility. Quickly setup LDAP server for testing purposes, MitM proxies for intercepting plaintext or forwarding NTLM credentials or exploit various Java JNDI/LDAP Client vulnerabilities. Author: Moritz Bechler [email protected] Project...

ODH-BricksBuilder-CVE-2024-25600-THM

ODH-BricksBuilder-CVE-2024-25600-THM Overview This repository hosts a Python-based vulnerability scanner developed by Oblivion Development & Hosting OD&H to detect CVE-2024-25600 in the Bricks Builder plugin for WordPress. This tool is designed primarily for use within Try Hack Me THM exercises,...

CVE-2026-1729-PoC-AdForest-WordPress-Authentication-Bypass

CVE-2026-1729 - AdForest WordPress Authentication Bypass PoC Description Simple Proof of Concept for CVE-2026-1729 PoC - Authentication bypass vulnerability in AdForest WordPress Theme. Authored by f3ds cr3w est 2oo2 blog Features ✅ Direct admin access without credentials ✅ Works on production...

garak v0.17.0

garak, LLM vulnerability scanner Generative AI Red-teaming & Assessment Kit garak checks if an LLM can be made to fail in a way we don't want. garak probes for hallucination, data leakage, prompt injection, misinformation, toxicity generation, jailbreaks, and many other weaknesses. If you know nm...

NetRecon

NetRecon 2.5 Authorization-first network reconnaissance a...

zencart_auth_rce_poc

zencartauthrcepoc CVE-2021-3291 1- login as admin 2- get any modules edit page 3- inspect element any true radiobox 4- change true to true','MODULEORDERTOTALTOTALSTATUS'; echo id; // 5- click update 6- to trig command go again edit page CVE-2021-3291 https://vulners.com/cve/CVE-2021-3291 POC...

CVE-2022-22963

CVE-2022-22963 Spring Cloud Function SpEL Expression Injection Remote Code Execution Vulnerability Detection and Exploitation Tool. Vulnerability Overview CVE-2022-22963 is a high-severity RCE vulnerability CVSS 9.8 in the routing functionality of Spring Cloud Function. When the application enabl...

CVE-2026-25746_SqlInjectionVulnerabilityOpenEMR7.0.4

CVE-2026-25746 - SQL Injection Vulnerability in OpenEMR Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize ...