pythem

pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...

CVE-2020-5844

CVE-2020-5844 Authenticated RCE in PandoraFMS 7.0-NG 742 Admin privileged attackers can upload malicious PHP documents. By decoding the base64 file location users can gain a shell as apache user. Discovered by TheCyberGeek PoC python script Usage: python3 CVE-2020-5844.py URL USER PASS...

CVE-2025-54322

CVE-2025-54322 - XSpeeder SXZOS Pre-Auth RCE Scanner A multi-threaded vulnerability scanner for CVE-2025-54322, an unauthenticated remote code execution vulnerability in XSpeeder SXZOS firmware affecting 70,000+ hosts globally. 📋 Table of Contents About the Vulnerability Features Installation Usa...

yaralyzer

THE YARALYZER Visually inspect all of the regex matches and their sexier, more cloak and dagger cousins, the YARA matches found in binary data and/or text. See what happens when you force various character encodings upon those matched bytes. With colors. Quick Start pipx install yaralyzer Scan...

xssor2

XSS'OR XSS'OR - JavaScriptでハック。 オンライン 試してみてください： https://xssor.io および http://xssor.io/ 主要なモジュールは3つあります：Encode/Decode、Codz、Probe。 インストール Python 3（Django 3.0.）またはPython 2（Django 1.11. ） git clone https://github.com/evilcos/xssor2 または直接ダウンロード cd xssor2 xssor/payload/probe.js を編集 xssor.cmdurl =...

CVE-2022-3602

CVE−2022-3602 What is this? This document and repository is a write-up of CVE−2022-3602, a punycode buffer overflow issue in OpenSSL. It's an "anti-POC" the issue does not appear to exploitable intended for folks who maintain their own OpenSSL builds and for compiler maintainers. There is a...

jwt-hack

JSON Web Token Hack Toolkit A high-performance toolkit for testing, analyzing and attacking JSON Web Tokens. Installation Cargo cargo install jwt-hack Homebrew brew install jwt-hack Snapcraft Ubuntu sudo snap install jwt-hack From source git clone https://github.com/hahwul/jwt-hack cd jwt-hack...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

the-book-of-secret-knowledge

"El conocimiento es poderoso, ¡ten cuidado cómo lo usas! " Una colección de listas inspiradoras, manuales, chuletas, blogs, trucos, one-liners, herramientas CLI/web y más. 📔 ¿Qué es? Este repositorio es una colección de diversos materiales y herramientas que uso a diario en mi trabajo. Contiene...

CVE-2026-28956-jxl-messages-surface

JPEG XL auto-decodes in the iOS Messages preview path A delivery-surface finding for CVE-2026-28956 AppleJPEGXL, plus the patch-diff attribution and a reliability reality-check on the public PoC. TL;DR — Conventional wisdom and our own prior measurement with EXR is that iOS Messages renders...

flask-session-cookie-manager

Flask Session Cookie Decoder/Encoder Original author : Wilson Sumanang Fixes and improvements author : Alexandre ZANNI Imported from saruberoz.github.io Depencencies Python 2 or Python 3 itsdangerous Flask Installation Package BlackArch Linux pacman -S flask-session-cookie-manager3,2 Git ArchLinu...

CVE-2026-76070

CVE-2026-76070: Unauthenticated Pre-Auth Stack Buffer Overflow via Base64-Decoded Password in Netis NC63 login.cgi Leading to RCE Researcher: Özcan Ersan @ozcanpng Disclosure status CVE: CVE-2026-76070 Vendor: Netis Systems Co., Ltd. Product: Netis NC63 Wireless AC1200 Router Tested firmware:...

xz-cve-2024-3094

root@ubuntu:/xz/ apt update root@ubuntu: /xz/ apt install -y gcc g++ vim net-tools make cmake build-essential libncurses-dev flex bison libssl-dev libelf-dev bc liblz4-tool liblz4-dev liblzma-dev ... ... root@ubuntu:/xz/ bash ./decode.sh root@ubuntu: /xz/ tar xf xz-5.6.1.tar.xz && cd xz-5.6.1...

decode-spam-headers

decode-spam-headers.py 日々の管理業務で特定のメールが SPAM/迷惑メールに振り分けられた理由を理解したい場合でも、Red-Team のフィッシングシミュレーションの目的であっても、このスクリプトは役立ちます! このアイデアは、MS Defender for Office365 を備えた商用 MS Office365 E5 環境を対象に、商用フィッシングシミュレーション演習を実施した際に生まれました。想像がつくと思いますが、フィッシングシミュレーションの観点から見ると、かなり強固なセキュリティスタックです。 手作業でこれらすべての Office365 SMTP...

CVE-2024-38077-MadLicense-exploit

CVE-2024-38077 MadLicense - Complete Exploitation Framework 📚 Technical Documentation for Presentation This document explains each component of the framework, why it exists , and how the heap buffer overflow exploitation works in modern Windows. 🎯 What Is CVE-2024-38077? The Vulnerability Windows...

CVE-2026-102731 Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

volatility

This project is archived. See Volatility 3 for modern investigations: https://github.com/volatilityfoundation/volatility3 ============================================================================ Volatility Framework - Volatile memory extraction utility framework The Volatility Framework is a...

CVE-2026-103001

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

binviz

binviz Binary visualiser & triage tool: linked interactive views entropy, histograms, image/dot-plot surfaces, control-flow graphs over a single shared address-space model. pipx install binviz && binviz serve What it does Open a file and every view is looking at the same address space. Select a...

CVE-2025-57926

Sink: According to the mechanism of WordPress Core, XSS is prevented in post content, but with this plugin, the content is encoded and then decoded when rendered, unintentionally creating an XSS vulnerability." PoC: The base64 encoded payload is PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==...