-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server

-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server This vulnerability could allow an attacker to take complete control of a vulnerable Confluence server. This could allow the attacker to steal data, modify data, or disrupt the availability of the server. Poc Create a JavaScript file and giv...

blue-pigeon

Blue Pigeon: Bluetooth-based Data Exfiltration and Proxy Tool for Red Teamers 1. The Motivation | Birth of the Bird ​ How does Blue Pigeon work? ​ The Pigeon's Key Requirements 2. The Components | Dissecting the Pidgey apart ​ 1. Blue Pigeon - The Mobile Applicaton ​ 2. Blue Beak - Custom...

nmap-spring4shell

Nmap-spring4shell Log4shell-nmap is an NSE script for detecting Spring4Shell RCE vulnerabilities CVE-2022-22965 in HTTP services. The script injects the correct payload into the application and then executes the following command on the specified endpoint. Vulnerability See here. Usage...

derailed

derailed CVE-2021-40875: Improper Access Control in Gurock TestRail versions give it the url of the target without the md5 path https://foo.com Run dirsearch or your preferred fuzzing tool against the list. You'll noticed that a lot of the files a fairly standard in size 0B/15B or 25B/31B/32MB --...

Telegrip

Hi there 👋 Telegrip is a GUI digital forensic tool that deals with Telegram-related cases. Telegrip provides several features: 1. Telegrip acquires sparse image from Android devices containing the device information and all Telegram-related data. 2. Parses and analyzes all types of messages,...

gOSINT

gOSINT Codacy Badge OSINT Swiss Army Knife in Go Take a look at the develop branch for more updates. Introduction gOSINT is a multiplatform OSINT Swiss army knife in Golang. If you want, feel free to contribute and/or leave a feedback! Like my project? Please consider donation : What gOSINT can d...

andriller

Andriller CE Community Edition Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices. It has features, such as powerful Lockscreen cracking for Pattern, PIN code, or Password...

bucket-stream

🚨 Bucket Stream is no longer maintained. If you need support or consultation for your red teaming endeavours, drop me an e-mail [email protected] 🚨 Bucket Stream Find interesting Amazon S3 Buckets by watching certificate transparency logs. This tool simply listens to various certificate...

DDWPasteRecon

DDWPasteRecon Pastesites are websites that allows users to share plain text through public posts called “pastes.” Once attackers compromise the external perimeter and gain access to the internal resources they release the part of data on the "paste" sites like pastebin or hastebin. As these hacke...

CVE-2023-28432

CVE-2023-28432 MiniO verify interface sensitive information disclosure vulnerability CVE-2023-28432 Chinese name: MinIO verify 接口敏感信息泄露漏洞（CVE-2023-28432） Description : MinIO is an open source object storage service that is compatible with the Amazon S3 API and can be used in private or public...

kodex

Kodex Community Edition - CE is an open-source toolkit for privacy and security engineering. It helps you to automate data security and data protection measures in your data engineering workflows. It offers the following functionality: Read data items from a variety of sources such as files,...

snapchat-map-scraper

Snapchat Story Downloader This program can search Snapchat's public Snap Map at multiple locations and download all stories for later investigation and categorization. A lot is unknown about how Snapchat decides which videos show up at which "point" on the map, so the scraper can also randomize t...

datasploit

Overview of the tool: Performs OSINT on a domain / email / username / phone and find out information from different sources. Correlate and collaborate the results, show them in a consolidated manner. Tries to find out credentials, api-keys, tokens, subdomains, domain history, legacy portals, etc...

CVE-2023-22515

Red Team Tool - Confluence Unauthorized Add Admin User CVE-2023-22515 Exploit Tool Vulnerability Scope root@kitploit: 8.0.0 = Confluence Data Center and Confluence Server = 8.0.4 8.1.0 = Confluence Data Center and Confluence Server = 8.1.4 8.2.0 = Confluence Data Center and Confluence Server =...

Phirautee

Phirautee A proof of concept crypto virus to spread user awareness about attacks and implications of ransomwares. Phirautee is written purely using PowerShell and does not require any third-party libraries. This tool steals the information, holds an organisation’s data to hostage for payments or...

monkey

Monkey documentation This folder contains the Monkey Documentation site. For more information see content/development/contribute-documentation.md...

Spring_cve-2022-22980

Springcve-2022-22980 spring data mongodb remote code execution | cve-2022-22980 poc Description A Spring Data MongoDB application is vulnerable to SpEL injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value...

opensnitch

Join the project community on our server! OpenSnitch is a GNU/Linux application firewall. •• Key Features • Download • Installation • Usage examples • In the press •• Key features Interactive outbound connections filtering. Block ads, trackers or malware domains system wide. Ability to configure...

procrustes

Procrustes A bash script that automates the exfiltration of data over dns in case we have a blind command execution on a server where all outbound connections except DNS are blocked. The script currently supports sh, bash and powershell and is compatible with exec style command execution e.g...

tko-subs

tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...