CVE-2024-44000

ES GenCookieSessionHijack es una herramienta PoC diseñada para explotar registros de depuración expuestos de forma insegura en sitios WordPress y extraer cookies de sesión. Esto permite al atacante secuestrar sesiones activas de administrador y obtener acceso no autorizado al panel de...

Mass-CVE-2021-3129-Scanner

Escáner masivo para CVE-2021-3129 Laravel Debug RCE Uso root@kitploit: $ bash massCVE-2021-3129scan.sh list.txt...

Laravel-debug-Checker

Laravel-debug-Checker CVE-2021-3129 Checker por ./MrMad Referencia : https://pentest-tools.com/blog/exploit-rce-vulnerability-laravel-cve-2021-3129 instalar módulo root@kitploit: python -m pip install -r requirements.txt instalación en linux root@kitploit: git clone...

CVE-2025-57428

⚠️ This repository is maintained only as a reference for CVE-2025-57428. For other advisories and updates, please refer to: security-advisories. CVE-2025-57428 - Telnet debug interface enabled by default allows low-level flash/register access Affected Product Vendor/Brand: Each Italy Device:...

moneta

/ \ / | / \ / \ / \ / / \ \ / Y | \ /| | / | //| | / | / / / / / Moneta v1.0 | Forrest Orr | 2020 REQUIRED -m |region|referenced|ioc -p |PID OPTIONAL -v detail|debug|surface -d --option from-base|statistics --filter unsigned-module|clr-prvx|clr-heap|metadata-modules --address --region-size -m...

pico2-swd-riscv

pico2-swd-riscv SWD debug probe for RP2350 RISC-V Hazard3 cores. One Pico2 debugs another via two GPIO wires. 0. VIBE CODE WARNING WRITTEN BY HUMAN About 80% of the code is vibe coded; The readme is almost completely generated except the whole vibe-code-warning section. I spent many nights with...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation root@kitploit: pip install...

CVE-2024-10586

CVE-2024-10586 Debug Tool = 2.2 - Unauthenticated Arbitrary File Creation Description: The Debug Tool plugin for WordPress is vulnerable to arbitrary file creation due to a missing capability check on the dbtpullimage function and missing file type validation in all versions up to, and including,...

CVE-2022-3168-adb-unexpected-reverse-forwards

The reverse tunnel feature in Android Debug Bridge adb was vulnerable as it allowed malicious adb daemons to open connections to arbitrary host/ports and unix domain sockets on the host. Attacker window where the rogue daemon is running: root@kitploit: $ ./adbroguedaemon.py Victim window a GCE VM...

teamcity-exploit-cve-2023-42793

TeamCity Exploit Cve 2023 42793 A quick script to exploit the cve-2023-42793 bug. Some additional reading on the exploit can be found here: https://www.fortinet.com/blog/threat-research/teamcity-intrusion-saga-apt29-suspected-exploiting-cve-2023-42793​...

CVE-2024-9466

CVE-2024-9466 CVE-2024-9466 Proof of Concept PoC Description This script checks for the CVE-2024-9466 vulnerability by appending /home/userSpace/devices/debug.txt to a list of target URLs or IP addresses. It determines if the target is vulnerable based on the HTTP response status code and whether...

graphql-cop

GraphQL Cop - Security Audit Utility for GraphQL About GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL. GraphQL Cop allows you ...

The vulnerability of the Serial Wire Debug interface (SWD) in the highly integrated wireless system on chip (SoC) Realtek RTL8762C allows a hacker to circumvent existing security restrictions and expose sensitive information.

The vulnerability of the Serial Wire Debug SWD interface in the highly integrated wireless system on chip SoC Realtek RTL8762C is related to improper protection against voltage and clock failures. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and...

showstopper

ShowStopper - Herramienta de exploración de trucos Anti-Debug Contribuido por Check Point Software Technologies LTD. Programado por Yaraslau Harakhavik Resumen El proyecto ShowStopper es una herramienta para ayudar a los investigadores de malware a explorar y probar técnicas anti-debug o verifica...

laravel-exploits

laravel-exploits Exploit for CVE-2021-3129 Details: https://www.ambionics.io/blog/laravel-debug-rce Usage root@kitploit: $ php -d'phar.readonly=0' ./phpggc --phar phar -o /tmp/exploit.phar --fast-destruct monolog/rce1 system id $ ./laravel-ignition-rce.py http://localhost:8000/ /tmp/exploit.phar...

CVE-2021-3129

CVE-2021-3129 Depuración RCE de Laravel Instrucciones de uso Ejecuta docker-compse up -d para iniciar el entorno Accede al puerto 8888 y haz clic en generate key en la página de inicio para reproducirlo Algunas notas sobre el entorno docker: Copiar .env.example a .env sirve para activar el entorn...

CVE-2022-29806

CVE-2022-29806 ZoneMinder hasta 1.36.12 Escalada de privilegios de idioma y RCE Descripción Una vulnerabilidad de Path Traversal en el archivo de registro de depuración y la opción de idioma predeterminado en ZoneMinder versiones anteriores a 1.36.13 y 1.37.11 permite a los atacantes escribir y...

FuckJsonp-RCE-CVE-2022-26809-SQL-XSS-FuckJsonp

The tracing method of this honeypot targets red team members using mobile hotspots. The honeypot directly obtains the attacker's phone number for tracing. It catches them every time. Red team members, be careful. First, when you open the website, it monitors whether the F12 console is opened. If...

debugHunter

debugHunter Descubre endpoints de depuración ocultos y entornos de desarrollo La extensión esencial de Chrome para cazadores de bugs y testers de penetración Detecta pasivamente parámetros de depuración, cabeceras sensibles y rutas expuestas mientras navegas. ¿Por qué debugHunter? Encontrar...

CVE-2025-50422

Poppler antes de la versión 25.04.0 Cuando pdftocairo renderiza un PDF malicioso y llama a cairodebugresetstaticdata al finalizar, la memoria del heap que contiene los flujos de objetos del PDF no se limpia correctamente. Un atacante con acceso local puede volcar la memoria del proceso y recupera...