CVE-2026-11834

CVE-2026-11834 PoC TP-Link DHCP Option 66 Unauthenticated RCE CVE-2026-11834 Overview A command injection vulnerability CWE-78 in the DHCP Option 66 "TFTP Server Name" handling of TP-Link router firmware allows an unauthenticated attacker on the same network segment to execute arbitrary commands ...

habu

Habu Hacking Toolkit I'm developing Habu to teach and learn some concepts about Python and Network Hacking. Some techniques implemented in the current version are: ARP Poisoning and Sniffing DHCP Discover and Starvation Subdomains Identification Certificate Cloning TCP Analysis ISN, Flags Usernam...

pythem

pythem - Penetration Testing Framework pythem is a multi-purpose pentest framework written in Python. It has been developed to be used by security researchers and security professionals. The tool intended to be used only for acts within the law. I am not liable for any undue and unlawful act...

dhcpoptinj

Inyector de opciones DHCP ¿Alguna vez has querido interceptar peticiones DHCP e insertar algunas opciones DHCP adicionales, sin que el remitente lo sepa? Probablemente no. Sin embargo, si alguna vez surge la necesidad, dhcpoptinj con suerte te ayudará. Por qué Puede haber muchas razones para...

dhcpoptinj

DHCP option injector Have you ever wanted to intercept DHCP requests and squeeze in a few extra DHCP options, unbeknownst to the sender? Probably not. However, should the need ever come, dhcpoptinj will hopefully help you. Why There can be many a reason to mangle DHCP requests, although chances a...

c41n

c41n c41n is an automated Rogue Access Point setup tool. c41n provides automated setup of several types of Rogue Access Points, and Evil Twin attacks. c41n sets up an access point with user defined characteristics interface, name and channel for the access point, sets up DHCP server for the acces...

freeradius-server

El servidor FreeRADIUS Introducción El Proyecto del servidor FreeRADIUS es un servidor de políticas multiprotocolo de alto rendimiento y altamente configurable, que admite RADIUS, DHCPv4, DHCPv6, DNS, TACACS+ y VMPS. Está disponible bajo los términos de la GNU GPLv2. El uso de RADIUS permite...

DHCPig

DHCPig Validación de endurecimiento DHCP para whitehat: agota un pool, secuestra las concesiones de los vecinos, expulsa hosts de sus direcciones con ARP falsificado y reporta si la red te lo impidió. Requiere root y Python 3.11+. Ejecutar la interfaz web Debian / Kali: descarga el .deb más...

CVE-2020-7461

CVE-2020-7461 PoC for DHCP vulnerability NAME:WRECK in FreeBSD For educational purposes only Environment Host: macOS 11.2.1 Vagrant: 2.2.15 Victim: FreeBSD 12.1-STABLE r364849 Attacker: Ubuntu 20.04 Disclaimer This PoC will cause DoS instead of RCE to prevent abuse. PoC Turn off DHCP server in...

FEP3370-advanced-ethical-hacking

DynoRoot CVE-2018-1111 Final project for the course Advanced Ethical Hacking at KTH, Stockholm This project demonstrates a known vulnerability of Fedora and RedHat machines related to an unsafe client-side implementation of the Dynamic Host Configuration Protocol DHCP. A rogue DHCP server can cra...

wifi-monitor

wifi-monitor Muestra las IPs de tu red local que están enviando más paquetes ack = acuse de recibo o acuse de recibo de bloque de trama de control 802.11 req = solicitud de envío de trama de control 802.11 clear = listo para enviar de trama de control 802.11 data = QoSData o Data Opciones: -j:...

yersinia

Spanning Tree 1: DOS attack sending conf BPDUs root@kitploit: Let's send some conf BPDUs claiming be root!!! By sending continously conf BPDU with root pathcost 0, randomly generated bridge id and therefore the same root id, and some default values for other fields, we try to annoy the switches...

CVE-2026-9997-VPN-Split-Tunneling-Bypass-via-DHCP-Option-Injection

CVE-2026-9997 – Evasión del túnel dividido de VPN mediante inyección de opciones DHCP Código del programa servidor DHCP simulado en Python + cliente root@kitploit: !/usr/bin/env python3 roguedhcpserver.py - Injects a static route to bypass VPN split tunnel import socket, struct, threading def...

SharpSniper

SharpSniper Often a Red Team engagement is more than just achieving Domain Admin. Some clients will want to see if specific users in the domain can be compromised, for example the CEO. SharpSniper is a simple tool to find the IP address of these users so that you can target their box. It requires...

Vulnerability-DLink-CVE-2025-14659

CVE-2025-14659: D-Link DHCP Daemon Command Injection Analysis Recreate CVE Project | Offensive Security Author: Peter Lin Date: May 2026 Project Pitch: CVE-2025-14659 reported a command injection vulnerability targeting the DHCP daemon component present in the D-Link DIR-860LB1 wireless router...

shellshock

shellshock Scripts asociados con la vulnerabilidad de análisis de funciones EVN de bourne shell CVE-2014-6271 dhcpmon.py - Este script monitorea las tramas DHCP en busca de caracteres potencialmente maliciosos dentro de los campos de respuesta BOOTP y DHCP...

CVE-2019-0785

CVE-2019-0785 Microsoft Windows DHCP Para explotar. Por favor, espera, ¿quieres? ¡Ya voy!...

freebsd-dhclient-poc

CVE-2020-7461 Reproducer PoC Authors: Moshe Kol, Shlomi Oberman Reproducer PoC for FreeBSD dhclient heap-based buffer overflow vulnerability when parsing DHCP option 119 CVE-2020-7461. The problem resides in the function findsearchdomainnamelen in the file sbin/dhclient/options.c. This function i...

TP-Link-Archer-CR-700-XSS-Exploit

TP-Link-Archer-CR-700-XSS-Exploit Explotando el router TP-Link Archer CR-700. Divulgado responsablemente a TP-Link Paso 1 - En tu máquina Linux Kali o Ubuntu escribe el siguiente comando gedit /etc/dhcp/dhclient.conf Comenta la siguiente línea send host-name = gethostname; Cópiala en la línea...

USBCoercer

Supported Targets| ESP32-S3 ---|--- USBCoercer: Un Dispositivo de Coerción WPAD Basado en TinyUSB USBCoercer convierte una placa de desarrollo ESP32 con USB-OTG nativo en un gadget Ethernet-over-USB capaz de coaccionar la configuración de proxy mediante WPAD. Se basa en el ejemplo TinyUSB Network...