pastego

pastego Scrape/Parse Pastebin using GO and grammar expression PEG. pastego.png Installation $ go get -u github.com/notdodo/pastego Usage Search keywords are case sensitive pastego -s "password,keygen,PASSWORD" You can use boolean operators to reduce false positive pastego -s "quake && earthquake,...

CVE-2024-4040-SSTI-LFI-PoC

CVE-2024-4040 SSTI & LFI PoC - Exploitation | CrushFTP This is a proof of concept for a Server Side Template Injection SSTI & Local File Inclusion LFI vulnerability in CrushFTP. Features Taking leverage of Critical Severity Vulnerabilities in CrushFTP servers through Server Side Template Injectio...

SigDigger

SigDigger - The free digital signal analyzer SigDigger is a free digital signal analyzer for GNU/Linux and macOS, designed to extract information of unknown radio signals. It supports a variety of SDR devices through SoapySDR, and allows adjustable demodulation of FSK, PSK and ASK signals, decode...

CVE-2025-6002

Exploit for CVE-2025-6002 This script exploits the authenticated arbitrary file upload vulnerability in VirtueMart 4.4.10 CVE-2025-6002, which is described in this blog post: https://blog.blacklanternsecurity.com/p/doomla-zero-days This script logs in to VirtueMart with the given credentials,...

cryptpad-cve-2025-51846-advisory

CVE-2025-51846 – Unbounded WebSocket Frame Flood Enables Remote Denial of Service Severity: High CVSS 7.5 CWE: 400 – Uncontrolled Resource Consumption Resource Exhaustion, CWE: CWE-770 – Allocation of Resources Without Limits or Throttling Status: Fixed Confirmed affected: CryptPad 2025.3.1...

Spring4Shell-POC

Spring4Shell PoC Application This is a dockerized application that is vulnerable to the Spring4Shell vulnerability CVE-2022-22965. Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat...

pydictor

pydictor README.md中文版 pydictor —— A powerful and useful hacker dictionary builder for a brute-force attack | | | | ' | | | |/ | |/ | / | '| | | | || | | | | | || | | | ./ , |,|||\/|| || |/ Email: [email protected] Preface： Q: Why I need to use pydictor ? A: 1.it always can help you You...

gef

GEF pronounced ʤɛf - "Jeff" is a set of commands for x86/64, ARM, MIPS, PowerPC and SPARC to assist exploit developers and reverse-engineers when using old school GDB. It provides additional features to GDB using the Python API to assist during the process of dynamic analysis and exploit...

Heartbleed

Heartbleed-POC This repository aims to serve as a valid proof-of-concept for the Heartbleed CVE, as well as contain instructions for setting up your own Heartbleed challenge without using a pre-built Dockerfile. How to build the lab 1. Navigate to the source/service directory using cd...

Powershell-RAT

Powershell-RAT Python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment. This RAT will help someone during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends the information to an attacker as an e-mail...

Katana

Katana-ds Katana-ds ds for dork scan is a simple python tool that automates Google Hacking/Dorking and supports Tor. It becomes a more powerful in combination with GHDB Note 25/09/2021 : This Repo is New but the script it self is old back when google dorking was something, i wrote this script bac...

CVE-2025-69215

CVE-2025-69215: OpenSTAManager has an SQL Injection in the Stampe Module Overview Field| Details ---|--- CVE ID| CVE-2025-69215 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products devcode-it/openstamanager versions: query'UPDATE zzprints SET predefined = 0 WHERE...

Registry-Recon

Registry-Recon Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon. Author: Jess Hires Description As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual...

SlackPirate

SlackPirate - Slack Enumeration and Extraction Tool This is a tool developed in Python which uses the native Slack APIs to extract 'interesting' information from a Slack workspace given an access token. As of May 2018, Slack has over 8 million customers and that number is rapidly rising - the...

httpstat

httpstat httpstat visualizes curl1 statistics in a way of beauty and clarity. It is a single file🌟 Python script that has no dependency👏 and is compatible with Python 3🍻. Features Beautiful terminal output — timing breakdown of DNS, TCP, TLS, server processing, and content transfer Structured JSO...

CVE-2025-29927-Nextjs-Analysis

CVE-2025-29927 Next.js Analysis This repository contains a self-hosted Next.js lab environment created for analyzing CVE-2025-29927 in Docker. Overview CVE-2025-29927 is a vulnerability related to authorization checks implemented in Next.js middleware. This project was built as a local lab to...

CVE-2025-7955

CVE-2025-7955 RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentraladminlogin2faverify Function 🚨 CVE-2025-7955 | RingCentral Communications WordPress Exploit 📝 Vulnerability Overview CVE: CVE-2025-7955 Affected Plugin: RingCentral...

android_hid

androidhid Use Android as Rubber Ducky against targeted Android device or PC HID attack using Android Using Android as Rubber Ducky against Android or Windows. This is not a new technique, just a demo how to perform HID attack using Android instead of rubber ducky. For targeted Android device it ...

CVE-2022-0185-POC

CVE-2022-0185 — Proof of Concept A proof-of-concept exploit for CVE-2022-0185 , a heap-based buffer overflow in the Linux kernel's legacyparseparam function fs/fscontext.c. This allows a local unprivileged user to escalate privileges to root. Original exploit by Crusaders of Rust. Full writeup:...

CVE-2025-6934

CVE-2025-6934 🛡️ CVE-2025-6934 - Unauthenticated Privilege Escalation in Opal Estate Pro 📝 Description The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Responsive WordPress Theme, is vulnerable to Privilege Escalation in all version...