CVE-2023-23752

CVE-2023-23752 About This exploit is Authentication Bypass leaking username password administrator and also leaking mysql config username , password , host and database Vulnerable Version only 4.00 = 4.28 Usage root@kitploit: usage: exploit.sh -h -u URL -t TARGETS CVE-2023-23752 - Authentication...

CentralizedFirewall

Firewall Manager API Project Installation Follow these steps to set up and run the API project: 1. Clone the Repository root@kitploit: git clone https://github.com/adriyansyah-mf/CentralizedFirewall cd CentralizedFirewall 2. Edit the .env File Update the environment variables in .env according to...

MikroRoot

MikroRoot Automated version of CVE-2018-14847. It will scrape shodan for vulnerable host and then try to exploit them. How to use Note that this script will NOT run with Python2.x. Use only Python 3+ MikroRoot: python3 MikroRoot.py -k SHODANKEY -p page count User: ncss Pass: ncss!@2018 IP: 1.2.3....

linkedin-profile-scraper

Due to endpoint issues, the Linkedin Profile Scraper Tool is currently unavailable. Please check the below link for alternative method. Huge shout-out to gosecure Team. https://www.gosecure.net/blog/2021/05/27/step-by-step-how-to-deanonymize-emails-on-linkedin/ Linkedin Profile scraper TOOL...

SMWYG-Show-Me-What-You-Got

SMWYG-Show-Me-What-You-Got This tool allows you to perform OSINT and reconnaissance on an organisation or an individual. It allows one to search 1.4 Billion clear text credentials which was dumped as part of BreachCompilation leak. This database makes finding passwords faster and easier than ever...

routersploit

RouterSploit - Exploitation Framework for Embedded Devices Community Join community on Embedded Exploitation Discord. Description The RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices. It consists of various modules that aid penetration testing...

Backdooring-ZMM100-FingerPrint-Devices

Hacking Embedded Devices : root@kitploit: Hardware platform ZMM100 : The fingerprint access control device Made by ZKSoftware. Default User/Password : root:solokey Protocol : Telnet 23. Scripts : pwnit.py : Automated tool for hacking devices. hell : second backdoor. leak-data.sh : third backdoor...

SuperMicro-Password-Scanner

Supermicro IPMI/BMC Cleartext Password Scanner v20140622 by 1N3 https://crowdshield.com Usage: sh supermicroscan.sh proxy ABOUT: Supermicro’s implementation of IPMI/BMC allows remote, unauthenticated attackers to request the file PSBlock via port 49152. This plain text password file contains IPMI...

NetworkAlarm

NetworkAlarm A command-line tool to monitor local network traffic for possible security vulnerabilities. Warns user against possible nmap scans, Nikto scans, credentials sent in-the-clear, credit card numbers sent in-the-clear, and shellshock attacks. Currently supports live monitoring and networ...

evilginx2

Evilginx 3.0 Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server...

HIKRAVEN

HIKRAVEN 🛡️ Advanced Hikvision Security Assessment Platform - Professional Edition Features • Quick Start • Installation • Usage • Documentation • Disclaimer ⚠️ IMPORTANT LEGAL NOTICE ! THIS TOOL IS FOR AUTHORIZED SECURITY TESTING ONLY ! Unauthorized access to computer systems is illegal and...

CVE-2025-70962

CVE-2025-70962 Use of Hard-coded Credentials in ZOSI C519M IP camera RTSP service Field| Value ---|--- CVE ID| CVE-2025-70962 Vendor| ZOSI Technology Product| ZOSI C519M smart IP camera also listed as model 1NC-519M Affected versions| Firmware V4.2.8.832C01450BA tested build; earlier versions not...

git-secrets-scan

Bitbucket Security: Secret Scanner Scans your files for hardcoded secrets, keys, and passwords. Creates a security Code Insights report if found. This Bitbucket Cloud supported Pipe leverages the gitleaks secret pattern registry to provide industry-leading Security Secrets Scanning capabilities t...

credential-attacks-toolkit

CredAttack — Credential Attacks Toolkit ⚠️ LEGAL NOTICE — Authorised security testing ONLY. Using this tool against systems you do not own or have explicit written permission to test is illegal under the Computer Fraud and Abuse Act US, Computer Misuse Act UK, and equivalent laws worldwide. See...

CVE-2018-18852

CERIO router Authenticated RCE backdoor vendor creds CVE-2018-18852 Python PoC hook-s3c github.com/hook-s3c, @hooks3c on twitter Working Python PoC for CVE-2018-18852, originally appearing on; https://github.com/hook-s3c/CVE-2018-18852 What's up CERIO Router models and variants of, DT300N, DT100G...

slurp-1

slurp Blackbox/whitebox S3 bucket enumerator Overview Credit to all the vendor packages that made this tool possible. This is a security tool; it's meant for pen-testers and security professionals to perform audits of s3 buckets. Features Scan via domains; you can target a single domain or a list...

ccs

Code Credential Scanner This script is intended to scan a large, diverse codebase for hard-coded credentials, or credentials present in configuration files. These represent a serious security issue, and can be extremely hard to detect and manage. The specific focus of this script is to create a...

Jiangnan Online Judge 0.8.0 - Local File Inclusion

Jiangnan Online Judge aka jnoj 0.8.0 is susceptible to local file inclusion via web/polygon/problem/viewfile?id=1&name=../. id: CVE-2019-17538 info: name: Jiangnan Online Judge 0.8.0 - Local File Inclusion author: pussycat0x severity: high description: | Jiangnan Online Judge aka jnoj 0.8.0 is...

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

Microweber Information Disclosure

Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. id: CVE-2022-0281 info: name: Microweber Information Disclosure author: pikpikcu severity: high description: Microweber contains a...