mothership_c2

Mothership C2 $\textcolorred\textDISCLAIMER!$ $\textcolorred\textTHIS TOOL IS FOR ETHICAL USE ONLY!$ Description Mothership C2 is a command and control server written in python Features Supports end-to-end encryption for sending and receiving commands Uses HTTP for everything Currently supports...

windows-smb-vulnerability-framework-cve-2025-33073

Windows SMB Client Vulnerability Research Framework Author: cyberseallll Created: 2025 Overview I developed this research framework to analyze and understand CVE-2025-33073, a critical Windows SMB Client Elevation of Privilege vulnerability. This implementation provides comprehensive tools for...

FruityC2

FruityC2 This is the initial release for FruityC2 alpha version. Can be installed on any linux system, but the installation scripts are made for Debian based systems. There are a lot of functionalities that will be include in future releases, and probably a lot of code will be changed, but this...

c2detect

c2detect Fingerprint the C2 server behind the beacon. Point it at network telemetry and it names the command-and-control framework — Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel, and 11+ more — with a confidence score and the exact indicators that matched. -success Blue-team / defensive:...

s3tk

s3tk A security toolkit for Amazon S3 🍊 Battle-tested at Instacart Installation Run: pip install s3tk You can use the AWS CLI or AWS Vault to set up your AWS credentials: pip install awscli aws configure See IAM policies needed for each command. Commands Scan Scan your buckets for: ACL open to...

infected-drones

Infected Drones Drone-to-Ground Control Station attack vectors, vulnerabilities & exploits Drone fleets today are one operator flying dozens or hundreds of drones from a single ground station. This makes the ground control station a valuable target for adversaries. It is where the pilot is usuall...

ropr

ropr ropr is a blazing fast multithreaded ROP Gadget finder What is a ROP Gadget? ROP Return Oriented Programming Gadgets are small snippets of a few assembly instructions typically ending in a ret instruction which already exist as executable code within each binary or library. These gadgets may...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

CVE-2026-35414

CVE-2026-35414 CVE-2026-35414 Vuln block auth2-pubkeyfile.c vulnerable static int matchprincipalsoptionconst char principallist, struct sshkeycert cert char result; uint i; / XXX percentexpand sequences for authorizedprincipals? / for i = 0; i nprincipals; i++ if result = matchlistcert-principals...

cfgrip

cfgrip PE/ELF x86/x64 CFG extractor. Takes a binary in, disassembles it, resolves every jump and call GOT, jump tables, register tracing, and exports the full control flow graph as structured JSON. why You need to know exactly where every branch goes. Not for reading — for patching. Feed the JSON...

h2csmuggler

h2cSmuggler Description h2cSmuggler smuggles HTTP traffic past insecure edge-server proxypass configurations by establishing HTTP/2 cleartext h2c communications with h2c-compatible back-end servers, allowing a bypass of proxy rules and access controls. See my detailed write-up below for: Technica...

CVE-2023-1281

CVE-2023-1281 Use After Free vulnerability in Linux kernel traffic control index filter tcindex...

gitpwnd

GitPwnd GitPwnd is a tool to aid in network penetration tests. GitPwnd allows an attacker to send commands to compromised machines and receive the results back using a git repo as the command and control transport layer. By using git as the communication mechanism, the compromised machines don't...

CVE-2023-31594

CVE-2023-31594 IC Realtime ICIP-P2012T is vulnerable to Incorrect Access Control Unauthenticated Streaming Channel in IC Realtime IP PTZ Dome Camera ICIP-P2012 software version: 2.420 The live feed MJPEG can be streamed via an exposed HTTP channel using VLC network stream. This vulnerability...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

SpotifyC2

SpotifyC2 — Cloud-Based Command Channel Research Execute commands through a Spotify playlist and receive command output through Telegram. What is SpotifyC2? SpotifyC2 is a Windows-based cybersecurity research project that demonstrates how publicly accessible cloud services can be used as a...

c2

C2 The C2 repository seeks to provide a practical implementation of the ideas contained in the Red Team Infrastructure Wike at https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki. In particular, this repository provides two Go packages one for beaconers and another for downloaders. In...

CVE-2023-40362

CVE-2023-40362 CVE-2023-40362 vulnerabilitiy details and proof-of-concept. Overview An access control vulnerability in Click2Gov BP at the URI /Click2GovBP/mastercontractorlist.html leads to the ability for authenticated users to delete the contractors from the accounts of other users with the...

anti-anti-automation

Anti-Anti-Automation Framework A framework for techniques to bypass common anti-automation security controls. Common Anti-Automation Controls Email Verification CAPTCHA SMS/Phone Credit Card WASC-21: Insufficient Anti-automation...

capa

Website | Download | Web Interface capa detects capabilities in executable files. You run it against a PE, ELF, .NET module, shellcode file, or a sandbox report and it tells you what it thinks the program can do. For example, it might suggest that the file is a backdoor, is capable of installing...