YZMCMSxss

YZMCMSxss CVE-2018-8078 YZMCMS v3.7最新版xss漏洞 YZMCMS V3.7 Stored XSS 这个xss存在于v3.7新增的广告管理模块，如图所示: This xss exists in v3.7 new advertising management module, as shown in the figure: 我们可以在YzmCMS-V3.7\application\advertisement\controller\adver.class.php第55-70行中找到广告管理编辑功能的具体代码，如图所示： We can find the...

CacheData_decrypt

CacheDatadecrypt Un simple kit de herramientas para hacer fuerza bruta y descifrar el CacheData de Windows EntraId. root@kitploit: usage: decryptcachedata.py -h pin,password ... CacheData bruteforcer. On a live windows host, to copy the folders with all subfolders and files: xcopy /H /E /G /C as...

DLHell

DLHell DLHell realiza proxying de DLL de Windows local y remoto mediante DCOM. Instalación Se requieren los siguientes paquetes puede depender de tu distribución; el siguiente ejemplo es para Debian 12: root@kitploit: sudo apt install -y g++-mingw-w64-x86-64-win32 binutils-mingw-w64-x86-64 Instal...

Invoke-PSObfuscation

Invoke-PSObfuscation 传统的混淆技术倾向于添加层来封装现有代码，例如 base64 或压缩。这些载荷仍然有一定程度的成功，但它们已经变得很容易提取预期的载荷，并且一些启动器经常被检测到，这本质上引入了瓶颈。 本工具引入的方法是一种方法论，你可以针对脚本的各个组件进行混淆，使用随机变化来实现相同的预期逻辑，而无需将整个载荷封装在单层中。由于混淆逻辑的复杂性，生成的载荷将很难被签名化，并且会绕过那些未编程为模拟继承逻辑的启发式引擎。...

C2Bridge

Los C2Bridges permiten a los desarrolladores crear nuevos protocolos de comunicación personalizados y utilizarlos rápidamente dentro de Covenant. C2Bridges Los C2Bridges se utilizan para desarrollar un protocolo de comando y control saliente sin editar ningún código de Covenant. Para los...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

zscan

Zscan a scan blasting tool set 📄English document 更新内容见日志log 结果输出格式 -输出的部分结果截图，分两个阶段，第一阶段是扫描过程中的输出，从主机存活探测结束开始，第二个阶段是将所有扫描的结果做整理，从输出port result list开始 简介🎉 ​...

CVE-2026-54253

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connectport, host and returns the resulting error.message through...

Exploit for CVE-2026-1961

Foreman WebSocket Proxy Command Injection CVE-2026-1961 — Po...

get_Team_Pass

getTeamPass 从局域网中的远程计算机获取TeamViewer的ID和密码 该程序从局域网中的远程计算机获取TeamViewer的ID和密码。 对后渗透测试或系统管理员最为有用。 已在Windows 7和Windows 10 x86及x64上测试。 从releases文件夹下载二进制文件 https://github.com/kr1shn4murt1/getTeamPass/releases/latest 前提条件 你必须在远程计算机上拥有有效的凭据 目标机器上的445端口必须可访问...

dotnetpaddingoracle

dotnetpaddingoracle Pequeño script para comprobar si la aplicación web .NET es vulnerable a padding Oracle Este script verifica realmente si el oráculo está presente y es explotable, no solo si el parche ha sido instalado. uso root@kitploit: dotnetpaddingoracle.py -h -t -b -d -s -p PARAMETER Burp...

c-jwt-cracker

JWT cracker A multi-threaded JWT brute-force cracker written in C. If you are very lucky or have a huge computing power, this program should find the secret key of a JWT token, allowing you to forge valid tokens. This is for testing purposes only, do not put yourself in trouble : I used the Apple...

XXEinjector

XXEinjector XXEinjector 自动化使用直接和带外方法检索文件。目录列表仅适用于 Java 应用程序。其他应用程序需要使用暴力破解方法。 Options: root@kitploit: --host Mandatory - our IP address for reverse connections. --host=192.168.0.2 --file Mandatory - file containing valid HTTP request with xml. You can also mark with "XXEINJECT" a point where DTD...

SPIPScan

SPIPScan SPIP CMS Scanner for penetration testing purpose written in Python, and released under MIT License. This tool has been designed to perform detection of SPIP installs during penetration testing. Currently, the tool detects the version of the SPIP install and tries to detect if the platfor...

Koh

Koh Koh 是一个 C 和 Beacon 对象文件 BOF 工具集，通过有意泄露令牌/登录会话来捕获用户凭据材料。 部分代码灵感来源于 Elad Shamir 的 Internal-Monologue 项目（无许可证）以及 KB180548。关于为何可以实现以及 Koh 的方法，请参阅本文档的技术背景部分。 关于 Koh 背后的动机及其方法的更详细解释，请参阅 Koh: The Token Stealer 文章。 @harmj0y 是该代码库的主要作者。@tifkin 协助了方法、BOF 实现以及部分令牌机制。 Koh 根据 BSD 3-Clause 许可证授权。 目录 Koh 目录...

CVE-2026-54253

TS3 Manager , a web interface for maintaining TeamSpeak 3 servers, is vulnerable to a reflected XSS in the /api/download handler prior to version 2.2.6 . The attacker-controlled port query parameter is passed to socket.connect(port, host), and the resulting error.message is returned as text/html ...

CVE-2026-54253 TS3 Manager: Reflected XSS via /api/download port parameter steals operator session

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connectport, host and returns the resulting error.message through...

CVE-2026-54253 TS3 Manager: Reflected XSS via /api/download port parameter steals operator session

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connectport, host and returns the resulting error.message through...

EUVD-2026-82393

TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connectport, host and returns the resulting error.message through...

nishang

Nishang Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security, penetration testing and red teaming. Nishang is useful during all phases of penetration testing. By Nikhil Mittal Founder of Altered Security - Hands-on red team and...