gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

CVE-2025-5777-CitrixBleed

CVE-2025-5777-CitrixBleed CitrixBleed-2 CVE-2025-5777 – proof-of-concept exploit for NetScaler ADC/Gateway “memory bleed” CVE-2025-5777 is a critical unauthenticated out-of-bounds read in Citrix NetScaler ADC/Gateway Gateway or AAA vServer mode. A single crafted request can dump memory containing...

pict

PICT - Post-Infection Collection Toolkit This set of scripts is designed to collect a variety of data from an endpoint thought to be infected, to facilitate the incident response process. This data should not be considered to be a full forensic data collection, but does capture a lot of useful...

CVE-2025-68147-OSPOS-Stored-XSS

CVE-2025-68147: Stored Cross-Site Scripting XSS in OpenSourcePOS Metadata| Details ---|--- CVE ID| CVE-2025-68147 Severity| High CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N Vulnerability Type| Stored Cross-Site Scripting CWE-79 Affected Versions| OpenSourcePOS v3.4.0, v3.4.1 Patched Version|...

seccomp-tools

Seccomp Tools Powerful tools for seccomp analysis. This project is aimed primarily but not exclusively at analyzing seccomp sandboxes in CTF pwn challenges. Some features are CTF-specific, but they're just as useful for analyzing real-world seccomp filters. Features Dump - Automatically dumps...

CVE-2025-49619

CVE-2025-49619 PoC This script exploits CVE-2025-49619 in Skyvern to execute a reverse shell command. Author Name: Cristian Branet GitHub: cristibtz Usage 1. Start a listener nc -lvnp 2. Run the exploit python3 exploit.py -u "http://:" -k "" -i -p : Skyvern server IP : Skyvern server port : Your...

CVE-2017-8570

Usage: After downloading the script, modify attackip to the IP of Kali, LPORT to the port that msf will listen on, and DIR to any empty directory Give the script 777 permissions chmod 777 auto Then run the script ./auto Then find the Invoice.ppsx file in the DIR+Office8570 directory and send it t...

SUDO_KILLER

⭐ Star us on GitHub — to show your support! 💡 Best Viewed in Dark Mode : The project SUDOKILLER made it to the final for the SANS Difference Award 2023 in the category open-source tool. Contributing Stargazers over time Support Credits Disclaimer License Introduction SUDOKILLER is a tool geared...

pocsuite3

pocsuite3 Legal Disclaimer Usage of pocsuite3 for attacking targets without prior mutual consent is illegal. pocsuite3 is for security testing purposes only 法律免责声明 未经事先双方同意，使用 pocsuite3 攻击目标是非法的。 pocsuite3 仅用于安全测试目的 Overview pocsuite3 is an open-sourced remote vulnerability testing and...

nmap

nmap This library aims at providing idiomatic nmap bindings for go developers, in order to make it easier to write security audit tools using golang. What is nmap Nmap Network Mapper is a free and open-source network scanner created by Gordon Lyon. Nmap is used to discover hosts and services on a...

CVE-2023-50164-Apache-Struts-RCE

CVE-2023-50164: Apache Struts path traversal to RCE vulnerability A critical security vulnerability, identified as CVE-2023-50164 CVE: 9.8 was found in Apache Struts, allowing attackers to manipulate file upload parameters that can potentially lead to unauthorized path traversal and remote code...

kestrel-lang

.. image:: https://github.com/opencybersecurityalliance/kestrel-lang/raw/develop/logo/logowtext.png :width: 460 :alt: Kestrel Threat Hunting Language |readthedocs| |pypi| |downloads| |codecoverage| |black| | Hunt with Native Query/Script left or Kestrel right? An end-to-end cyber threat hunt...

CVE-2021-1675

CVE-2021-1675 - PrintNightmare LPE PowerShell Caleb Stewart | John Hammond | July 1, 2021 CVE-2021-1675 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare." Proof-of-concept exploits have been released Python, C++ for the remote code execution...

autodeauth

autodeauth A tool/service built to automatically deauth local networks Tested on Raspberry Pi OS and Kali Linux Setup $ chmod +x setup.sh $ sudo ./setup.sh This can be changed by editing /etc/systemd/system/autodeauth.service ? Enter your WiFi interface to use with the autodeauth service: wlan0...

paniclock

PanicLock is a macOS menu bar utility that instantly disables Touch ID and locks the screen with a single click or closing your laptop lid. PanicLock fills a gap macOS leaves open: there is no built-in way to instantly disable Touch ID when it matters. Biometrics are convenient day-to-day, and...

Angora

Angora Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution. Published Work Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018. Building Angora Build Requirements Linux-amd64...

CVE-2024-41958-PoC

CVE-2024-41958-PoC This is a small proof of concept for CVE-2024-41958. It is possible to bypass the TFA authentication on the admin panel. Affected versions: 2024-07 Prerequisites needed for the CVE to function: Password and username for an account without TFA. Password and username for an accou...

brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

agent-vault

HTTP credential proxy and vault An open-source credential broker by Infisical that sits between your agents and the APIs they call. Agents should not possess credentials. Agent Vault eliminates credential exfiltration risk with brokered access. New here? Thelaunch blog post has the full story...

url-regex-safe

url-regex-safe Regular expression matching for URL's. Maintained, safe, and browser-friendly version of url-regex. Resolves CVE-2020-7661cve for Node.js servers. Works in Node v14+ and browsers. Maintained for Spam Scannerspam-scanner and Forward Emailforward-email. Table of Contents Foreword...