twittor

Twittor A stealthy Python based backdoor that uses Twitter Direct Messages as a command and control server This project has been inspired by Gcat which does the same but using a Gmail account. Setup For this to work you need: A Twitter account Use a dedicated account! Do not use your personal one...

Mr.SIP

SIP Security, Attack and Audit Framework Mr.SIP is...

thirdeye

Third Eye Usermode WDAMONITOR/WDAEXCLUDEFROMCAPTURE bypasser using undocumented Windows functions with C bindings. Starring: PEB walking Halo's Gate Custom PE sections Undocumented Windows functions Quick and dirty EDR/AV evasion 2/72 on VirusTotal Direct syscalls Getting Started Install the...

CVE-2026-89063

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversationid' parameter due to missing validation on a user controlled key. This makes it possible for...

Google-Tensor-Chips

Google Tensor Chips — DarWINN NPU Access Direct-access tooling for the Google Tensor NPU DarWINN, reverse-engineered across two generations: Tensor G2 Pixel 7, codename Janeiro and Tensor G3 Pixel 8, codename Rio. Why this exists I was trying to get LLM inference running on the phone and wanted t...

SysWhispers2

SysWhispers2 SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported and example generated files available in the example-output/ folder. Difference Between SysWhispers 1 and 2 The usage is almost identical to...

HellHall

HellsHall - Another Way To Fetch Clean Syscalls HellsHall is a combination of HellsGate and indirect syscalls. How it works First, HellsHall checks whether the syscall address is hooked and tries to retrieve the syscall number by checking the presence of the following bytes: 0x4C, 0x8B, 0xD1, 0xB...

SysWhispers3

SysWhispers3 SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. Official Discord Channel Come hang out on Discord! Why on earth didn't I create a PR to SysWhispers2? The reason for SysWhispers3 to be a standalone version are many, but the...

Nimcrypt2

Nimcrypt2 Nimcrypt2 is yet another PE packer/loader designed to bypass AV/EDR. It is an improvement on my original Nimcrypt project, with the main improvements being the use of direct syscalls and the ability to load regular PE files as well as raw shellcode. Before going any further, I must...

Chrome-App-Bound-Encryption-Decryption

ChromElevator Chrome App-Bound Encryption Decryption 🚀 Overview A post-exploitation tool demonstrating a complete, in-memory bypass of Chromium's App-Bound Encryption ABE. This project utilizes Direct Syscall-based Reflective Process Hollowing to launch a legitimate browser process in a suspended...

SysWhispers

SysWhispers SysWhispers helps with evasion by generating header/ASM files implants can use to make direct system calls. All core syscalls are supported from Windows XP to Windows 10 19042 20H2. Example generated files available in the example-output/ folder. Introduction Various security products...

nimcrypt

nimcrypt Nimcrypt is a .NET PE Crypter written in Nim, based entirely on the work of @byt3bl33d3r's OffensiveNim project: https://github.com/byt3bl33d3r/OffensiveNim This tool was inspired by @S3cur3Th1sSh1t's blog post a few months ago, as it's essentially just a full PoC of what he presented:...

CVE-2025-50286

Grav CMS v1.7.48 / Admin Plugin v1.10.48 - RCE autenticado a través de la subida de plugins CVE-2025-50286 Grav CMS v1.7.48 con Admin Plugin v1.10.48 es vulnerable a Ejecución Remota de Código RCE a través de la función de subida de plugins "Instalación Directa", permitiendo a administradores...

getaltname

GSAN - Obtener Nombres Alternativos del Sujeto GSAN es una herramienta que puede extraer Nombres Alternativos del Sujeto SAN encontrados en Certificados SSL directamente desde servidores https, lo que puede proporcionarte nombres DNS subdominios o servidores virtuales. No depende de los registros...

CVE-2026-68530 Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

mssqlproxy

mssqlproxy mssqlproxy is a toolkit aimed to perform lateral movement in restricted environments through a compromised Microsoft SQL Server via socket reuse. The client requires impacket and sysadmin privileges on the SQL server. Please read this article carefully before continuing. It consists of...

XXEinjector

XXEinjector XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. Bruteforcing method needs to be used for other applications. Options: root@kitploit: --host Mandatory - our IP address for reverse connections...

vc5

VC5 This README is currently being updated to reflect recent changes - some information may not reflect the current codebase. This iteration of code is not yet battle ready - use a v0.2 release for production A horizontally scalable Direct Server Return DSR layer 4 load balancer L4LB for Linux...

CVE-2026-54050

Sakai is a Collaboration and Learning Environment CLE. From 23.0 until 23.5 and 25.3, the DELETE /api/users/userId/profile/image endpoint allows an authenticated user to delete another user's profile image because ProfileController.removeProfileImage passes the attacker-controlled userId to...

laZzzy

laZzzy laZzzy is a shellcode loader that demonstrates different execution techniques commonly employed by malware. laZzzy was developed using different open-source header-only libraries. Features Direct syscalls and native Nt functions not all functions but most Import Address Table IAT evasion...