exphub

Notice In the end, I still felt that having separate scripts for each vulnerability was very inconvenient, so I integrated all poc and exp scripts into one, enabling one-click scanning + exploitation. Since I've been working on integration recently, Exphub has not been updated for a long time. Th...

ESLockDecryptor

ESLockDecryptor ESLockDecryptor is a command-line tool designed to recover and decrypt files encrypted by ES File Explorer files with the .eslock extension. It demonstrates the real-world impact of CWE-327 Use of a Broken or Risky Cryptographic Algorithm present in the ES File Explorer applicatio...

CVE-2025-9215

StoreEngine Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More = 1.4.0 - Authenticated Subscriber+ Arbitrary File Download The StoreEngine plugin contains a vulnerability in its CSV Import/Export feature that allows any authenticated user subscriber, author,...

CVE-2022-26923

CVE-2022-26923 – Certifried Exploit AD CS Abuse Automated exploitation of CVE-2022-26923 Certifried , enabling privilege escalation through abuse of Active Directory Certificate Services AD CS, with an automatic fallback to Resource-Based Constrained Delegation RBCD, ultimately dumping the NTLM...

CVE-2021-34730

Cisco RV110W UPnP 0day Analysis Preface UPnP has been a hot topic recently. I happened to have a Cisco RV110W device on hand. In August 2021, Cisco officially disclosed a 0day regarding UPnP in the RV series, but the specific details were not published. So I wanted to debug and exploit this...

omnibus

OSINT Omnibus Developed & maintained by InQuest Table of Contents OSINT Omnibus Omnibus Documentation Vocabulary Running Omnibus API Keys Interactive Console Artifacts Overview Creating & Managing Artifacts Sessions Modules Machines Reporting Monitoring Modules OSINT Omnibus Developed & maintaine...

ADRecon

Download from https://github.com/adrecon/ADRecon ADRecon: Active Directory Recon ADRecon is a tool which extracts and combines various artefacts as highlighted below out of an AD environment. The information can be presented in a specially formatted Microsoft Excel report that includes summary...

CVE-2022-0847

CVE-2022-0847 Dirty Pipe Linux Kernel Privilege Escalation Analysis toc This article was first published on Huawei Security's official account, this is the blog version more complete First published link: https://mp.weixin.qq.com/s/6VhWBOzJ7uu80nzFxe5jpg Vulnerability Introduction Vulnerability I...

CVE-2022-41852

Remote Code Execution in JXPath Library CVE-2022-41852 Proof of Concept CVE-2022-41852 allows attackers to execute code on the application server. You can read more about this vulnerability here: https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/ Note: I am not ...

foremost

FOREMOST Foremost is a Linux program to recover files based on their headers and footers. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers are specified by a configuration file, so you can pick and choose which...

RedPersist

RedPersist RedPersist is a Windows Persistence tool written in C Compiling Project Below 3rd party libraries are used in this project. TaskScheduler https://github.com/dahall/TaskScheduler Fody https://github.com/Fody/Fody Load the Visual Studio project up and go to "Tools" "NuGet Package Manager...

Pachine

Pachine Python implementation for CVE-2021-42278 Active Directory Privilege Escalation. Installation $ pip3 install impacket Usage Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation usage: pachine.py -h -scan -spn SPN -impersonate IMPERSONATE -domain-netbios NETBIOSNAME -computer-name...

rpcfirewall

I Need More Information Check out our RPC Firewall blog post or our BlackHat talk to gain better understanding of RPC, RPC attacks, and the solution: RPC Firewall. Join our |Zero| Labs Slack Community workspace for any questions, issues, or simply to shout out. We would love to hear from you also...

whoami-project

Whoami - Enhanced Privacy and Anonymity for Debian and Arch-based Linux Distributions Feature Request | Report a Bug About the Project Whoami is a user-friendly privacy and anonymity tool designed for Debian and Arch-based Linux distributions. With its simple interface and ease of use, it...

galah

TL;DR: Galah /ɡəˈlɑː/ - pronounced ‘guh-laa’ is an LLM-powered web honeypot designed to mimic various applications and dynamically respond to arbitrary HTTP requests. Galah supports major LLM providers, including OpenAI, GoogleAI, GCP's Vertex AI, Anthropic, Cohere, and Ollama. Unlike traditional...

Conveigh

Conveigh Conveigh is a Windows PowerShell LLMNR/NBNS spoofer detection tool. Function Invoke-Conveigh The main Conveigh LLMNR/NBNS spoofer detection function. Privilege Requirements: Elevated Administrator shell Features: Generates and sends IPv4 LLMNR/NBNS requests with random or set hostnames...

git-scanner

Git Scanner Framework This tool can scan websites with open .git repositories for Bug Hunting/ Pentesting Purposes and can dump the content of the .git repositories from webservers that found from the scanning method. This tool works with the provided Single target or Mass Target from a file list...

capture-the-flag

Capture The Flag! Remaster Linux Live CD images for the purpose of creating ready to use security wargames with pre-installed vulnerabilities to exploit. Requirements You will need the following in order to build the Live CD using the scripts in this project: Linux, with root access using sudo gi...

CVE-2022-0337-PoC-Google-Chrome-Microsoft-Edge-Opera

🤝 Show your support - give a ⭐️ if you liked the content | SHARE on Twitter | Follow me on CVE-2022-0337 System environment variables leak on Google Chrome, Microsoft Edge and Opera 📝 Description Successful exploitation of this vulnerability can lead to the leak of user's secrets stored inside a...

GhostLock-for-OnePlus15T

GhostLock — OnePlus 15T Kernel exploit targeting locked-bootloader OnePlus 15T devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Modified from the originalGhostLock-for-OnePlus...