IntelOwl

!intelowlp...

my-cool-demo-php-code

My Cool Demo PHP Code! This repository contains a known super bad thing. What is it I wonder? Can it be related to a known CVE ID?...

Log4Shell-demo

Log4Shell in action This project aims to demonstrate how the Log4Shell / CVE-2021-44228 vulnerability works. Requirements You only need to have Docker installed. Ideally you have two different virtual machines. One for the vulnerable server and one for the malicious server that will host the...

c2-cloud

About The Project The C2 Cloud is a robust web-based C2 framework, designed to simplify the life of penetration testers. It allows easy access to compromised backdoors, just like accessing an EC2 instance in the AWS cloud. It can manage several simultaneous backdoor sessions with a user-friendly...

CVE-2016-9079

CVE-2016-9079 A demo exploit of CVE-2016-9079 on Ubuntu x64...

dymerge

A simple, yet powerful tool - written purely in python - which takes given wordlists and merges them into one dynamic dictionary that can then be used as ammunition for a successful dictionary based or bruteforce attack. Compatible with Python 2.6 & 2.7. Author: Nikolaos Kamarinakis nikolaskama.m...

CVE-2019-9465

CVE-2019-9465 This is a demo Android application for CVE-2019-9465...

pentest_teamcity

Pentest TeamCity using Metasploit TL;DR: Obtain passwords fromJetBrains IDE like IntelliJ or PyCharm and use those credentials inside TeamCity Continuous Integration Server in order to get meterpreter session on server and build agents using metasploit by Kacper Szurek. JetBrains Comment This is ...

CVE-2026-13157

CVE-2026-13157 Theme Demo Import false during upload processing. An authenticated user possessing import capabilities—such as a default site administrator or a non-super-admin site administrator in a WordPress Multisite architecture—can bypass file restriction enforcement to upload arbitrary...

Discord-CVE-2026-24332-demo

Discord-CVE-2026-24332-demo...

reconmap

Reconmap AI-powered vulnerability scanning and reporting for teams running many engagements. Give it a target. Reconmap plans the scan, runs the tools, triages the findings and writes the report. Every engagement lives in one place, so your team spends its time on the work that needs a human. Wha...

invokeai-consumer

invokeai-consumer Demo consumer app pinned to invokeai==5.0.1 — used by Endor Labs to demonstrate vulnerability detection and exploit-chain analysis against the upstream invokeai library. v5.0.1 is the specific release named in the source CVE CVE-2024-10821...

ollama-consumer

ollama-consumer Demo consumer app pinned to github.com/ollama/ollama v0.5.0 — used by Endor Labs to demonstrate vulnerability detection and exploit-chain analysis against the upstream ollama library...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

CVE-2023-45857-Demo

Demo to verify the behavior of Axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev in the app container 3. Access http://app.localhost 4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false SameSite...

metabigor

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

java-vulnerable

Demo consumer for CVE-2016-0714 Tomcat session persistence RCE + CVE-2013-1814 Apache Rave UserApi info disclosure plus four filter-padding Java OSS vulns. context.xml enables PersistentManager → Tomcat chain HOT; applicationContext-security.xml gates /api/rpc/users/ to ROLEADMIN → Rave chain...

ubercookie

🍪 ubercookie An educational demonstration of how websites persistently identify you — and why "clear your cookies" is no longer enough. ubercookie plants a single random id into 12 different browser storage vectors at once. Every time you visit, it reads them all, takes a consensus, and re-writes...

http-server-node

http-server-node This repository is a synthetic demo target for Endor Labs EXPOSURE. The current state is deliberately vulnerable HOT. EXPOSURE will report a HOT verdict against it. Tracked CVE: CVE-2021-23797 no upstream fix; mitigated only via a compensating control. A demo PR opened by EXPOSUR...

cachet

Cachet, the open source self-hosted status page system. Cachet 3.x Announcement For more information on the Cachet rebuild and our plans for 3.x, you can read the announcement here. Requirements PHP 8.3 or later Composer A supported database: MariaDB, MySQL, PostgreSQL or SQLite Installation,...