chamilo-lms-unauthenticated-rce-poc

Chamilo LMS Unauthenticated RCE PoC This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220. The system is vulnerable in versions preceding 1.11.24. Usage Clone the repository to your machine and install the dependenci...

vapi

vAPI vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises. Requirements PHP MySQL PostMan MITM Proxy Installation Docker docker-compose up -d Installation Manual Copying the Code cd git clone...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

binlex

| Binlex - A Binary Genetic Trait Lexer Framework If maldevs think their binary is FUD, they're about to have an existential crisis. ---|--- Binlex extracts instructions, basic blocks, and functions from binaries and emits searchable JSON traits for reverse engineering, hunting, and similarity...

CVE-2026-34038

CVE-2026-34038: Authenticated Remote Command Injection in Coolify This repository contains documentation and analysis for CVE-2026-34038 , a critical command injection vulnerability in Coolify. Summary An authenticated remote command injection vulnerability CWE-78 in Coolify allows users with...

preflight

Preflight.sh Preflight.sh is a command-line tool that scans your codebase for launch readiness. Identifies missing configuration, integration issues, security concerns, SEO metadata gaps, and other common mistakes before you deploy to production. Don't embarrass yourself in production. Just run t...

TerraformGoat

TerraformGoat English | 中文 TerraformGoat is HXSecurity research lab's "Vulnerable by Design" multi cloud deployment tool. Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure. 🎯 Scenarios ID| Cloud Servic...

ADLab

ADLab PowerShell Module Introduction The purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration testing. Credits to Joe Helle and his PowerShell for Pentesters course regarding the generation of the attack vectors. Instructions...

AutoSploit

Docker deployment instructions tl;dr Using docker-compose: git clone https://github.com/NullArray/AutoSploit.git cd Autosploit/Docker docker-compose run --rm autosploit Using just Docker: git clone https://github.com/NullArray/AutoSploit.git cd Autosploit/Docker If you wish to edit default postgr...

Ustealer

Ustealer Ubuntu stealer, steal ubuntu information in local pc nice with usb key Require G++ sudo apt-get install g++ libsqlite3 sudo apt-get install libsqlite3-dev Compilation Go in Ustealer/ folder and run makefile make Use ./ustealer...

CVE-2024-4577-Exploitation-AsyncRAT-Deployment-DFIR-Investigation

" CVE-2024-4577 AsyncRAT DFIR Investigation"...

shellnoob

ShellNoob Writing shellcodes has always been super fun, but some parts are extremely boring and error prone. Focus only on the fun part, and use ShellNoob! For a quick overview, check the slides for the Black Hat Arsenal talk: link Want to contribute? Feature request? Bug report? Swears? All...

arya

Arya - The Reverse YARA Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA because it does exactly the opposite - it creates files that matches your rules. You can read more about Arya and how it works in our blog. Intro...

rxerium-templates

A curated collection of 144+ Nuclei templates focusing on zero-day and actively exploited vulnerabilities in the wild with a few miscellaneous templates. Templates use passive detection techniques version/date matching and are organized by year for easy navigation. ⚠️ Note: Date matching may be...

ICS-TestBed-Framework

ICS TestBed Framework A scalable framework for automatically deploying locally or remotely a number of virtual machines that replicate a Supervisory Control And Data Acquisition SCADA network is proposed. This includes multiple virtual hosts emulating sensors and actuators, with a Human Machine...

lowkey

Self-Hosted AI Coding Agents on AWS — OpenClaw, Claude Code, Codex, Kiro, NemoClaw, Hermes ▶️ Watch the full walkthrough on YouTube 📝 Read the blog post: "I Gave My Agent Its Own AWS Account" TL;DR — deploy Lowkey: curl -sfL install.lowkey.run | bash Works in bash , zsh , and AWS CloudShell. The...

CVE-2022-22965

CVE-2022-22965 Spring4Shell Analysis Vulnerability Description Spring4Shell is the name of a CVE existing on Spring Core of the Spring Framework. With a CVSS 3.x score of 9.8, the vulnerability is classified as the highest risk level critical. This vulnerability allows an attacker to execute remo...

BlueCloud

Overview Cyber Range deployment of HELK and Velociraptor! Automated terraform deployment of one system running HELK + Velociraptor server with one registered Windows endpoint in Azure or AWS. A collection of Terraform and Ansible scripts that automatically and quickly deploys a small HELK +...

prowler

Prowler Prowler is a Network Vulnerability Scanner implemented on a Raspberry Pi Cluster, first developed during Singapore Infosec Community Hackathon - HackSmith v1.0. Capabilities Scan a network a particular subnet or a list of IP addresses for all IP addresses associated with active network...

CVE-2023-3897

CVE-2023-3897 Username enumeration is possible through Bypassing CAPTCHA in On-premise SureMDM Solution on Windows deployment allows attacker to enumerate local user information via error message. This issue affects SureMDM On-premise: 6.31 and below version...