CVE-2025-24893

Infos Questa PoC prima verifica la presenza della SSTI e, se funziona, entra in un ciclo e ti permette di eseguire comandi da remoto. I comandi exec e shell attualmente fanno la stessa cosa. Utilizzo Connessione root@kitploit: python3 poc.py Esempio Con debug impostato su False predefinito...

CVE-2021-44521

CVE-2021-44521 Automatisierter PoC für CVE-2021-44521 Danksagung an den ursprünglichen PoC: https://jfrog.com/blog/cve-2021-44521-exploiting-apache-cassandra-user-defined-functions-for-remote-code-execution/ Anforderungen Cassandra-Treiber root@kitploit: pip3 install cassandra-driver Verwendung...

CVE-2026-24061

CVE-2026-24061 CVE-2026-24061 Batch-Scan-Tool Verwendung root@kitploit: options: -h, --help show this help message and exit -t, --target TARGET Target IP/CIDR or comma-separated list repeatable -f, --file FILE File with targets IP/CIDR, one per line or comma-separated -p, --port PORT Target ports...

CVE-2026-21962

CVE-2026-21962 CVE-2026-21962 ESEMPIO Singolo target root@kitploit: python3 CVE-2026-21962.py http://target:7001 -c "whoami" Batch + whoami predefinito root@kitploit: python3 CVE-2026-21962.py -f url.txt Batch + comando personalizzato + modifica del numero di thread root@kitploit: python3...

CVE-2025-9074-Docker-Exploit

CVE-2025-9074 Инструмент для выполнения команд в контейнерах Docker Мощный инструмент для эксплуатации удаленного API Docker, предназначенный для исследования безопасности и тестирования уязвимости CVE-2025-9074. Ключевые преимущества ✅ Полностью автоматизированное управление жизненным циклом...

LongBow

Exploit di Esecuzione Comandi Remota Locale sul Router Archer TP-Link VR1600V CVE-2023-31756 Panoramica Questo script Python dimostra una vulnerabilità di esecuzione comandi remota locale nei router Archer TP-Link VR1600V V1/V2. L'exploit consente l'accesso al sistema operativo del router a livel...

CVE-2026-0709

Ferramenta Hikvision Wireless AP – RCE Autenticado CVE-2026-0709 Esta ferramenta é uma prova de conceito em Python para testar pontos de acesso sem fio Hikvision quanto à CVE-2026-0709 , uma vulnerabilidade de injeção de comandos autenticada que pode levar à execução remota de código em...

ip-finder-cli

IPFinder CLI Command Line Interface https://ipfinder.io/ Supports Single IP Address, asn, ranges, firewall as Input Supports Bulk Exports Results to Screen or to An Output File Supports IPv4 and IPv6 Supports ASN number , RANGES , Firewall Getting Started sign up for a free account at...

CVE-2026-16348

TP-Link Archer BE800 V1 — RCE autenticato tramite iniezione di chiave VPN CVE: CVE-2026-16348 CVSS: 8.5 Alto — CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L Autenticazione richiesta: Credenziali admin valide Posizione di rete: Rete remota se l'interfaccia di gestione è esposta...

cve-2023-1671

CVE-2023-1671 Wie funktioniert cve-2023-1671https://vulners.com/cve/CVE-2023-1671 ? /opt/ws/bin/ftsblistpack ist ein Perl-Skript, das /opt/ws/bin/sblistpack aufruft, ein weiteres Perl-Skript. Die Shell-Befehlsargumente darin sind in einfache Anführungszeichen eingeschlossen: root@kitploit: $rc +=...

CVE-2025-69600

CVE-2025-69600 autor: Rafael José Núñez Gulías empresa: Iberian Var Group Produtos afetados: RayVentory Scan Engine 12.6 Update 8 e versões anteriores Aviso da Raynet: RSEC200966 Injeção de comandos no rvia da Raynet permite que adversários executem comandos por meio das opções getconfig, upload,...

CVE-2026-8037-POC

CVE-2026-8037-POC Inclui detecção de comandos executáveis e obtenção de shell com um clique requer serviço no servidor pco.yaml pode ser usado com nuclei para detecção rápida Início Rápido Modo Interativo root@kitploit: python go.py Insira a URL alvo → selecione a função no menu. Detectar Alvo...

abyss-c2

ABYSS C2 — HiSilicon DVR एक्सप्लॉइट फ्रेमवर्क ⚠️ केवल शैक्षिक / प्रदर्शन प्रयोजनों के लिए यह सॉफ़्टवेयर विशेष रूप से शैक्षिक और अधिकृत सुरक्षा अनुसंधान प्रयोजनों के लिए प्रदान किया गया है। इसे नियंत्रित, अधिकृत वातावरण में सामान्य IoT भेद्यताओं और पोस्ट-एक्सप्लॉइटेशन तकनीकों को प्रदर्शित करने के...

PyRat

PyRat PyRat, progetto open source di controllo remoto basato su Python XmlRPC, include client e server chiamato anche pannello di controllo, successivamente indicato come server. Dichiarazione: il progetto è solo per scambio tecnico, non utilizzarlo per scopi commerciali o illegali. Qualsiasi...

c2

C2 Das C2-Repository soll eine praktische Umsetzung der Ideen bieten, die im Red Team Infrastructure Wike unter https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki enthalten sind. Insbesondere stellt dieses Repository zwei Go-Pakete bereit: eines für Beaconer und eines für Downloader...

SlackShell

SlackShell Descrizione e Changelog v1.0 Questo modulo PowerShell include varie funzioni che utilizzano l'API Slack per creare un canale di comando e controllo. La funzione principale, Start-Shell, si connette a un canale Slack specificato dall'utente e autentica utilizzando un token di...

insect

insect - Découverte de chemins web Version actuelle: v1.4 20222.09.03 Un outil avancé en ligne de commande conçu pour bruteforcer les répertoires et fichiers des serveurs web, également appelé scanner de chemins web. Idée par @maurosoria et @shelld3v Développement-2022 est activement développé pa...

retire.js

Retire.js What you require you must also retire There are a plethora of JavaScript libraries for use on the Web and in Node.JS apps out there. This greatly simplifies development, but we need to stay up-to-date on security fixes. "Using Components with Known Vulnerabilities" is now a part of the...

Invoke-ArgFuscator

░█░█▄░█░█▒█░▄▀▄░█▄▀▒██▀░▒░ ▄▀▄▒█▀▄░▄▀▒▒█▀░█▒█░▄▀▀░▄▀▀▒▄▀▄░▀█▀░▄▀▄▒█▀▄░ ░█░█▒▀█░▀▄▀░▀▄▀░█▒█░█▄▄░▀▀░█▀█░█▀▄░▀▄█░█▀░▀▄█▒▄██░▀▄▄░█▀█░▒█▒░▀▄▀░█▀▄░ Invoke-ArgFuscator Invoke-ArgFuscator ist ein quelloffenes, plattformübergreifendes PowerShell-Modul, das dabei hilft, verschleierte Befehlszeilen für...

nginx-ui-CVE-2026-42221-CVE-2026-42238-

nginx-ui CVE 验证环境 nginx-ui（Nginx 的 Web GUI 管理工具）报告的两个 CVE 在 Docker 环境中进行实际验证的仓库。 CVE-2026-42221 ：未认证情况下的管理员账户劫持 CVE-2026-42238 ：未认证备份恢复导致的命令执行 免责声明 本仓库的验证内容仅针对自己管理的隔离本地环境。 未经许可对第三方系统使用类似手法将违反不正访问禁止法。 详细文章 验证过程、考察及学习内容已总结在 Qiita 文章中。 实际尝试 nginx-ui 的 CVE：「漏洞」认为是设计问题 漏洞概要...