LinkedInDumper

LinkedInDumper Python 3 script to dump company employees from LinkedIn API 💬 Description LinkedInDumper is a Python 3 script that dumps employee data from the LinkedIn social networking platform. The results contain firstname, lastname, position title, location and a user's profile link. Only 2 A...

ios11-cookie-set-expire-issue

iOS 11 Cookie Set / Expire Issue There appears to be an intermittent issue with setting and expiring cookies in iOS 11 home screen web apps. Two erroneous behaviors can be observed: When a cookie is set and then the app is closed and re-opened, the cookie may no longer be present upon re-opening...

CVE-2025-28121

💥 CVE-2025-28121 - Reflected XSS in Online Exam Mastering System 1.0 📝 Description code-projects Online Exam Mastering System 1.0 is vulnerable to Reflected Cross-Site Scripting XSS in the feedback.php file via the q parameter. This issue allows remote attackers to inject malicious JavaScript int...

cve-2025-5755

CVE-2025-5777: The Ultimate PoC & Scanner 🚀 An advanced, powerful, and easy-to-use tool designed to detect and exploit CVE-2025-5777 CitrixBleed 2. This script not only identifies the vulnerability but also helps in demonstrating its impact by parsing human-readable information from the memory...

CVE-2022-45059-demo

CVE-2022-45059-demo Varnish Cache releases 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1 and 7.2.0 have a request smuggling vulnerability where an attacker can request that the content-length header is made hop-by-hop. This is a demo consisting of a Spring Boot web application running behind a...

CVE-2026-20896

CVE-2026-20896 Lab This repository provides a small, self-contained lab for exploring the CVE-2026-20896 issue in a controlled and authorized environment. Overview The lab includes: poc.py: my customized proof-of-concept script that demonstrates the issue and exports browser-ready cookie files...

BlackDex

BlackDex BlackDex is an Android unpack tool, it supports Android 5.012 and need not rely to any environment. BlackDex can run on any Android mobile phone or emulator, you can unpack APK File in several seconds. Declaration This project is not directed against any encryption, it does not deal with...

Node.js-CVE-2017-5941

NodeJS Insecure Deserialisation Vulnerability Demo Node.js is an open-source runtime environment used to implement server functionality in JavaScript. A specific software package within Node.js contains a vulnerable function dealing with deserialisation, that causes it to run unauthorised command...

CVE-2024-46278-teedy_1.11_account-takeover

【CVE-2024-46278】teedy1.11account-takeover 【Teedy 1.11】account takeover via XSS Detail There is a vulnerability that causes XSS when downloading files. XSS vulnerability could allow a Teedy administrator to rob an account with a few clicks. This vulnerability is marked as CVE-2024-46278:...

Cookie-Swapper

Cookie Swapper Burp Suite extension that auto-replaces cookies and headers in requests. Stop wasting time copy-pasting session tokens into every request. Why? You got a retest, a needs more info bug, or just expired sessions. You need to replay dozens of requests from HTTP History and Repeater bu...

CVE-2020-12629

Title: osTicket 1.14.1 - Persistent Authenticated Cross-Site Scripting Author: Mehmet Kelepce / Gais Cyber Security Date : 2020-03-24 Source Link: https://github.com/osticket/osticket/commit/fc4c8608fa122f38673b9dddcb8fef4a15a9c884 CVE: https://vulners.com/cve/CVE-2020-12629 Exploit-Db :...

cve-2026-100671-poc

CVE-2026-100671 — Grav Twig session-cookie disclosure Minimal, target-scoped attacker-side verifier for the Grav content-Twig/page-cache session takeover fixed in Grav 2.0.25. Advisories: CVE-2026-100671 GHSA-pp89-h475-7gj6 Grav 2.0.25 release Important: no administrator credential The attacker...

pwn-pulse

pwn-pulse.sh Exploit for Pulse Connect Secure SSL VPN arbitrary file read vulnerability CVE-2019-11510 Script authored by braindead @BishopFox. Based on research by Orange Tsai and Meh Chang. Thanks also to Alyssa Herrera and 0xDezzy for additional insights. Huge thanks to bl4ckh0l3z for fixing,...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...

CVE-2020-9484

Apache Tomcat Deserialization Vulnerability CVE-2020-9484 Vulnerable target setup Clone this repository Run docker-compose up -d That's it ! Exploit POC Run curl -v 'http://127.0.0.1:8080/index.jsp' -H 'Cookie: JSESSIONID=../../../../../usr/local/tomcat/cfx File named coldfx gets created in tmp...

cookie-monster

Cookie-Monster-BOF Steal browser cookies for edge, chrome and firefox through a BOF! Cookie Monster BOF will extract the WebKit Master Key and the App Bound Encryption Key for both Edge and Chrome, locate a browser process with a handle to the Cookies and Login Data files, copy the handles and th...

CVE-2020-25627

CVE-2020-25627 Stored XSS via moodlenetprofile parameter in user profile My PoC about this CVE User requirement: Student Or the site for registeration XSS in moodlenetprofile Step 1: Log in with an authenticated user Can register or through creating a new user without assigning roles Step 2: Quic...

Blacklist3r

Blacklist3r The goal of this project is to accumulate the secret keys / secret materials related to various web frameworks, that are publicly available and potentially used by developers. These secrets will be utilized by the Blacklist3r tools to audit the target application and verify the usage ...

redxor

Linux Malware C2 'RedXOR' - an example detection This package serves as a demonstration of how Zeek can be used to detect the Linux backdoor "redXOR" using state based methods. References: Corelight blog...

cve-2020-10977

CVE-2020-10977 GitLab 12.9.0 Arbitrary File Read Target : 12.9.0 and below Tested : GitLab 12.8.1 In a recent engagement I found a GitLab instance on the target, I found a PoC on Exploit-DB but it uses LDAP for authentication and it was disabled in this case, so I created this python script which...