toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

WordPress Advanced Custom Fields: Extended plugin <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability

Missing Authorization to Unauthenticated Arbitrary Attachment Deletion vulnerability discovered by normaandersonfrank in WordPress Plugin ACF Extended versions = 0.9.2.6...

CustomC2ChannelTemplate

IAT Hooking for custom C2 channels This is a simple PoC and template for developing custom C2 channels for Cobalt Strike using IAT hooks applied by a reflective loader. Blog post: https://codex-7.gitbook.io/codexs-terminal-window/red-team/cobalt-strike/building-custom-c2-channels-by-hooking-winin...

CVE-2024-1071-Docker

CVE-2024-1071 with Docker 🎯 Want to practice with the new WordPress CVE ? Follow the instructions Build the lab 1. Install Docker : https://docs.docker.com/get-docker/ 2. Clone the project : git clone https://github.com/Trackflaw/CVE-2024-1071-Docker.git. 3. Go to the project : cd...

msf-auxiliarys

msf-auxiliarys my collection of metasploit auxiliary post-modules Description this working directory contains diferent metasploit auxiliary modules writen by me to be of assistence in post-exploitation common tasks. Download/Install 1º - Download module from github 2º - edit module to read the...

CVE-2023-30777

CVE-2023-30777 Proof of Concept PoC URL generator for a reflected XSS vulnerability in the Advanced Custom Fields WordPress plugin. PoC Generate by : Alucard0x1 Credit of Exploit : https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites/...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

hades

About Hades is a proof of concept loader that combines several evasion technques with the aim of bypassing the defensive mechanisms commonly used by modern AV/EDRs. Usage The easiest way, is probably building the project on Linux using make. git clone https://github.com/f1zm0/hades && cd hades ma...

CVE-2019-2215

CVE-2019-2215 Bad Binder PoC for CVE-2019-2215 on Android 10 x8664 AVD. Based on elbiazo/CVE-2019-2215, kernel from cloudfuzz workshop. For research only in an isolated environment emulator. Build: BUILD.md source ./setup-env.sh ./scripts/start-emulator.sh ./scripts/run-exploit.sh Before running,...

Freeko

How to install: needed 1. Computer 2. SD card 3. Miko 3 1. Download the apks from here 2. copy them to the sd card 3. Startup miko and hit the three dots 4. Go to settings and then Privacy policy 5. Hold on the text in the policy until you see a menu with the option "Share" 6. Tap share and then...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...

Netbox-CVE-2023-37625

Netbox-CVE-2023-37625 Description A stored cross-site scripting XSS vulnerability in Netbox alert1' 3. Add a new model, in this example add a 'manufacturer' model. 4. Open the newly created model as any authenticated user, and observer that the alert box has executed...

CVE-2025-39601

🚨 CVE-2025-39601 - CSRF to RCE in WordPress Custom CSS, JS & PHP plugin WordPress Custom CSS, JS & PHP plugin CSRF PoC - WordPress Custom CSS, JS & PHP plugin By : Nxploited | Khaled Alenazi input typ...

android_hid

androidhid Use Android as Rubber Ducky against targeted Android device or PC HID attack using Android Using Android as Rubber Ducky against Android or Windows. This is not a new technique, just a demo how to perform HID attack using Android instead of rubber ducky. For targeted Android device it ...

CVE-2026-6433

CVE-2026-6433 — Proof of Concept FlipperCode — Custom CSS, JS & PHP · Unauthenticated SQL injection → RCE via eval Affected: FlipperCode Custom CSS, JS & PHP ≤ 2.0.7 · WordPress plugin surface via admin-ajax.php At a glance Item| Detail ---|--- Vector| Unauthenticated SQLi tunneled through plugin...

ARTist

ARTist - The Android Runtime instrumentation and security toolkit ARTist is a flexible open source instrumentation framework for Android's apps and Java middleware. It is based on the Android Runtime’s ART compiler and modifies code during on-device compilation. In contrast to existing...

CVE-2026-33017

CVE-2026-33017 — Langflow Unauthenticated Remote Code Execution Author: dynamo2k1 Severity: Critical CVSSv3: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Overview CVE-2026-33017 is a critical unauthenticated Remote Code Execution vulnerability in Langflow, an open-source platform for visually building...

ngrev

ngrev Graphical tool for reverse engineering of Angular projects. It allows you to navigate in the structure of your application and observe the relationship between the different modules, providers, and directives. The tool performs static code analysis which means that you don't have to run you...

Metabase_CVE-2021-41277

MetabaseCVE-2021-41277 Description Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs...