mcpshield

mcpshield A drop-in fix for the unpatched MCP STDIO command-injection flaw the CVE-2026-30623 family, disclosed by OX Security in April 2026 as "by design" -- no SDK patch is coming. Import one line, and every stdio MCP server your Python app launches gets its command/args/env validated before th...

log4shell-minecraft-demo

Log4Shell CVE-2021-44228 minecraft demo This demo is used at education fairs to give potential future students an idea of the cybersecurity department at HTL Villach and on how everyday applications can be exploited Note: This entire demo uses Minecraft 1.8.8 Attacker The attacker in this scenari...

FUSE

FUSE FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload UEFU vulnerabilities. The details of the testing strategy is in our paper, "FUSE: Finding File Upload Bugs via Penetration Testing", which appeared in NDSS 2020. To see how to configure and execute...

BigFinger

CVE-2023-46747 - Big-IP RCE Unauthenticated This is a Python3 script to exploit the unauthenticated remote code execution vulnerability CVE-2023-46747 in F5 BIG-IP appliances via the TMUI interface. Basically, if this vuln hits, you get a shell without credentials. Built with threading, file inpu...

Invoke-BSOD

Invoke-BSOD For when you want a computer to be done - without admin! BSOD method from here: https://github.com/Leurak/MEMZ/blob/master/WindowsTrojan/Source/Destructive/KillWindows.cL10-L18 Invoke-BSOD.ps1 A PowerShell script to induce a Blue Screen of Death BSOD without admin privileges. Also...

GAMBA

GAMBA GAMBA is a tool for the simplification of mixed Boolean-arithmetic expressions MBAs. GAMBA is short for General Advanced Mixed Boolean Arithmetic simplifier. It uses the linear algebraic simplifier SiMBA to iteratively simplify linear subexpressions of a potentially nonlinear input MBA...

CrossC2

CrossC2 framework README | 中文文档 | READMEFULL | 中文完整文档 CobaltStrike support Support CobaltStrike's security assessment of other platforms Linux/MacOS/..., and include the development support of Unix post-penetration module | CS3.14bug fixes| CS4.0| CS4.X 4.14.8 ---|---|---|--- Master branch| ✅| |...

netbox

The cornerstone of every automated network NetBox Community | NetBox Cloud | NetBox Enterprise NetBox exists to empower network engineers. Since its release in 2016, it has become the go-to solution for modeling and documenting network infrastructure for thousands of organizations worldwide. As a...

vsftpd-cve-2011-2523-detection-signature

Detection Engineering & Vulnerability Research - CVE-2011-2523 vsftpd 2.3.4 A CVE to Detection Signature Engineering Project: researching a disclosed vulnerability, building a fingerprint that identifies it externally, and validating detection quality against real lab targets. !Vulnerability...

CVE-2016-6366

CVE-2016-6366 Public repository for improvements to the EXTRABACON exploit, a remote code execution for Cisco ASA written by the Equation Group NSA and leaked by the Shadow Brokers. There is improved shellcode, a LINA offset finder script, a Metasploit module, and extrabacon-2.0. We are adding...

Logsensor

Logsensor A Powerful Sensor Tool to discover login panels, and POST Form SQLi Scanning Features login panel Scanning for multiple hosts Proxy compatibility http, https Login panel scanning are done in multiprocessing so the script is super fast at scanning many urls quick tutorial & screenshots a...

BARK

BARK BARK stands for BloodHound Attack Research Kit. It is a PowerShell script built to assist the BloodHound Enterprise team with researching and continuously validating abuse primitives. BARK currently focuses on Microsoft's Azure suite of products and services. BARK requires no third party...

Forbidden-Buster

Forbidden Buster is a tool designed to automate various techniques in order to bypass HTTP 401 and 403 response codes and gain access to unauthorized areas in the system. This code is made for security enthusiasts and professionals only. Use it at your own risk. Features Probes HTTP 401 and 403...

misp-dashboard

misp-dashboard A dashboard showing live data and statistics from the ZMQ feeds of one or more MISP instances. The dashboard can be used as a real-time situational awareness tool to gather threat intelligence information. The misp-dashboard includes a gamification tool to show the contributions of...

IIITA-IoT-Security-Research

IIIT Allahabad – IoT Security Research Internship Overview This repository showcases the work carried out during my Research Internship at the Indian Institute of Information Technology, Allahabad IIIT Allahabad under the Cryptography and Network Security CNS Lab. During this internship, I worked...

CVE-2019-14079

USB device fuzzing on Android CVE-2019-14079 This blog post is about a simple bug I found in my android deviceMI A2 - runs stock android using USB device fuzzing and was marked as high severity by google. The bug was in Qualcomm USB driver which was later patched and disclosed in March 2020 Andro...

CVE-2021-34527

CVE-2021-34527 - PrintNightmare LPE PowerShell Caleb Stewart | John Hammond | June 1, 2021 UPDATE June 2 2021 : Microsoft has released an advisory on CVE-2021-34527, correctly terming that specific identifier as the PrintNightmare vulnerability exploit. Previously, the community was assuming...

telegram-bot-dumper

telegram-bot-dumper Easy dumping of all Telegram bot stuff. Input : only bot token. Output : bot name & info, all chats text history & media, bot's users info & photos. This is a Python implementation. 🚀 Fast Golang version by ScBoln. Web viewer A Telegram-Web-like browser UI for a dump : chat...

CVE-2017-5487

PoC - CVE-2017-5487 - WordPress User Enumeration via REST Setup git clone https://github.com/ndr-repo/CVE-2017-5487.git powershell -noexit -ExecutionPolicy Bypass -File .ps1 Usage .\Enumerate-WordPressOrgMembersREST.ps1 Alternate Route 1 for WAF Bypass...

BEAR-C2

BEAR-C2 Adversary Simulation Framework BEAR-C2 is an adversary simulation and emulation framework built around real world TTPs inspired by Russian, Chinese, North Korean, and Iranian APT groups. It provides a flexible environment for diverse engagement scenarios and delivers a realistic foundatio...