ChromeAlone

ChromeAlone - A Browser C2 Framework What does this get me? ChromeAlone is a browser implant that can be used in place of conventional implants like Cobalt Strike or Meterpreter. This repo provides a simple build process that will generate a management console, deploy infrastructure, and create a...

DLLPasswordFilterImplant

DLLPasswordFilterImplant DLLPasswordFilterImplant is a custom password filter DLL that allows the capture of a user's credentials. Each password change event on a domain will trigger the registered DLL in order to exfiltrate the username and new password value prior successfully changing it in th...

CredSniper

CredSniper Overview Benefits Basic Usage Installation Screenshots Gmail Module Maintainer Contributing Overview Easily launch a new phishing site fully presented with SSL and capture credentials along with 2FA tokens using CredSniper. The API provides secure access to the currently captured...

ESP-RFID-Tool

ESP-RFID-Tool By Corey Harding Official website: www.rfid-tool.com April Brother is currently manufacturing this hardware and it can be purchased direct from China from their Official Store: https://blog.aprbrother.com/product/esp-rfid-tool AliExpress Store:...

Inveigh

Inveigh Inveigh is a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool for penetration testers. This repo contains the primary C version as well as the legacy PowerShell version. Overview Inveigh conducts spoofing attacks and hash/credential captures through both packet sniffing and protoc...

Koh

Koh Koh is a C and Beacon Object File BOF toolset that allows for the capture of user credential material via purposeful token/logon session leakage. Some code was inspired by Elad Shamir's Internal-Monologue project no license, as well as KB180548. For why this is possible and Koh's approeach, s...

hostapd-mana

hostapd-mana Overview A featureful rogue access point first presented at Defcon 22 by Dominic White @singe & Ian de Villiers @ sensepost [email protected] Documentation Check the wiki for information of getting and using hostapd-mana. Features KARMA/MANA Mode - respond to any device looking...

ARP-poisoning-packet-sniffer

ARP Poisoning - Packet Sniffer Two scripts written to perform ARP poisoning on target computers on the same network and to monitor network traffic. The arpspoofy.py script is used to perform ARP poisoning on a target computer on the same network. While the arpspoofy.py script performs ARP poisoni...

Responder

Responder Responder is a LLMNR, NBT-NS, and MDNS poisoner with built-in rogue authentication servers for HTTP, SMB, MSSQL, FTP, LDAP, Kerberos, DNS, and more. It supports NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP, and various authentication methods across 15+ protocols. Table of Contents...

fluxion

Fluxion is the future of MITM WPA attacks Fluxion is a remake of linset by vk496 with hopefully less bugs and more functionality. It's compatible with the latest release of Kali rolling. Latest builds stable and beta can be found here here...

CVE-2026-15911-Confluent_Kafka

CVE-2026-15911: Disabled TLS Certificate Verification for HashiCorp Vault KMS in confluent-kafka Severity: High, CVSS 3.1 7.4 Vector v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected: confluent-kafka = 2.8.0, = 2.14.2 Fixed in: 2.15.0 CWE: CWE-295 Improper Certificate Validation...

CVE-2026-93638

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...

EUVD-2026-108977

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...

CVE-2026-93638

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.17 are vulnerable to a pre-authentication reflected cross-site scripting (XSS) vulnerability. The flaw exists in the login page when processing the zrememberme parameter. An unauthenticated attacker can craft a relogin URL that trigge...

CVE-2026-93638 Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...

net-creds

Thoroughly sniff passwords and hashes from an interface or pcap file. Concatenates fragmented packets and does not rely on ports for service identification. Screenshots --- Sniffs URLs visited POST loads sent HTTP form logins/passwords HTTP basic auth logins/passwords HTTP searches FTP...

SSHintel

SSHintel — Lightweight SSH Honeypot SSHintel is a lightweight SSH honeypot built using Python and Paramiko. It simulates a fake Linux shell to log unauthorized access attempts, capture credentials, and analyze attacker behavior in a controlled environment. 🔧 Features Logs SSH login attempts with...

PT-2026-122117

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...

lab-SMB-responder-CVE-2024-21413

SMB Lab + Responder CVE-2024-21413 🎯 Objective This project aimed to study the CVE-2024-21413 MonikerLink vulnerability, exploring how the SMB/NTLM protocol can be abused for credential capture. Even after the official Microsoft patch, the lab shows that the concept remains valid in internal...

CVE-2026-94134

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...