CVE-2026-21012-Rust-serde-Deserialization-of-Untrusted-Enum-Variant-Injection-

CVE-2026-21012 – Rust serde Deserialization of Untrusted Enum Variant Injection Program Code Rust root@kitploit: // serdevuln.rs - Deserializes an enum from user JSON without validation use serde::Deserialize, Serialize; use serdejson; deriveDeserialize, Debug enum AdminAction ReadLogs,...

Flask-Unsign

Flask Unsign Command line tool to fetch, decode, brute-force and craft session cookies of a Flask application by guessing secret keys. For the standalone wordlist component, please visit the flask-unsign-wordlist repository. Requirements Python 3.6+ Installation To install the application, simply...

invoker

Invoker Utilidad de pruebas de penetración y herramienta de evaluación antivirus. Construido con Visual Studio Community 2022 v17.5.4 64 bits y probado en Windows 10 Enterprise OS 64 bits. Hecho con fines educativos. ¡Espero que sea de ayuda! Este repositorio comenzó a tener firmas conocidas y no...

invoker

Invoker Penetration testing utility and antivirus assessment tool. Built with Visual Studio Community 2022 v17.5.4 64-bit and tested on Windows 10 Enterprise OS 64-bit. Made for educational purposes. I hope it will help! This repository started to have known signatures and I don't have time to...

lnkbomb

Lnkbomb Lnkbomb is used for uploading malicious shortcut files to insecure file shares. The vulnerability exists due to Windows looking for an icon file to associate with the shortcut file. This icon file can be directed to a penetration tester's machine running Responder or smbserver to gather...

FDsploit

A File Inclusion & Directory Traversal fuzzing, enumeration & exploitation tool. FDsploit menu: root@kitploit: $ python fdsploit.py -h | | \ | ||| | | | | | -| . | | . | | | || |/|| ||||| ||...ver. 1.2 Author: Christoforos Petrou game0ver ! usage: fdsploit.py -u | -f -h -p -d -e 0,1,2 -t -b -x -c...

reFlutter

This framework helps with Flutter apps reverse engineering using the patched version of the Flutter library which is already compiled and ready for app repacking. This library has snapshot deserialization process modified to allow you perform dynamic analysis in a convenient way. Key features:...

sqlmate

sqlmate There are some features that we think SQLMap should have. Like finding admin panel of the target, better hash cracking etc. If you think the same, SQLMate is for you. What it does? Feed it a SQL injection dork via --dork option and it will find vulnerable sites for you. After that, it wil...

jeopardize

Introduction Jeopardize tool is developed to provide basic threat intelligence&response capabilities against phishing domains at the minimum cost as possible. It detects registered phishing domain candidates typosquatting, homograph etc., analyzes them and assigns a risk score to them. After then...

wwwgrep

WWWGrep OWASP Foundation Web Respository Author: Mark Deen & Aditi Mohan Introduction WWWGrep is a rapid search “grepping” mechanism that examines HTML elements by type and permits focused single, multiple file based URLs and recursive with respect to root domain or not searches to be performed...

CVE-2026-21006-Zigbee-Light-Link-Factory-Reset-Exploit

CVE-2026-21006 – Zigbee Light Link Factory Reset Exploit Program Code Python Zigbee simulation root@kitploit: zigbeefactoryreset.py - Simulated Zigbee coordinator sending factory reset command import time class ZigbeeDevice: def initself: self.networkkey = b'secret' def receivecommandself, cmdid:...

gokart

GoKart - Go Security Static Analysis GoKart is a static analysis tool for Go that finds vulnerabilities using the SSA single static assignment form of Go source code. It is capable of tracing the source of variables and function arguments to determine whether input sources are safe, which reduces...

santa

Santa !NOTE As of 2025, Santa is no longer maintained by Google. We encourage existing users to migrate to an actively maintained fork of Santa, such as https://github.com/northpolesec/santa. Santa is a binary and file access authorization system for macOS. It consists of a system extension that...

findom-xss

FinDOM-XSS FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner. Installation root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencies: LinkFinder Usage To run the tool on a targe...

Http-Asynchronous-Reverse-Shell

HTTP/S Asynchronous Reverse Shell ✨ Introduction In an age where advanced detection systems such as IDS, IPS, EDR, AV, and firewalls dominate corporate networks, evading them during offensive security assessments is a challenge. Most reverse shells leverage TCP tunnels L4, which are now routinely...

dr_robot

root@kitploit: . . . . . . . : \ : \ : \ : . \ : / : . \ \ :| | | || || || : | || | \ | : | | | :| | . | || : \ | : \ | : || | | : | | | |. / | || |\ . / |/ . / | | :/ || || :/ :/ || : : : Copyright 2019 National Technology & Engineering Solutions of Sandia, LLC NTESS. Under the terms of...

AlertResponder

AlertResponder NOTE: This repository is obsoleted. New repository is here: https://github.com/m-mizutani/deepalert AlertResponder is a serverless framework for automatic response of security alert. Overview AlertResponder receives an alert that is event of interest from security view point and...

nebulousAD

⚠️ A Note to NebulousAD Users As of April 14th, NuID will no longer be hosting the NebulousAD API that this code communicates with. As a small team of developers, we've found it isn't feasible to actively support, monitor, and develop both the NebulousAD portal as well as our Authentication...

Sourcetrail

Sourcetrail Important Note: This project was archived by the original autors and maintainers of Sourcetrail by the end of 2021. If you want to know more about this decision, read more on our blog. Sourcetrail is a free and open-source cross-platform source explorer that helps you get productive o...

goop

goop Google Search Scraper Note: It no longer works. Google team told me it's not a legitimate issue when I reported it to them but now they just silently fixed it. Contents Introduction How it works? Usage Installation Example Legal Introduction goop can perform google searches without being...