clusterd

clusterd clusterd is an open source application server attack toolkit. Born out of frustration with current fingerprinting and exploitation methods, clusterd automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack. See the wiki for more information...

proxyshell

ProxyShell Microsoft Exchange CVE-2021-34473、CVE-2021-34523、CVE-2021-31207 の概念実証エクスプロイト 詳細 背景情報とコンテキストについては、Horizon3 による調査の詳細を記したブログ記事をお読みください： https://www.horizon3.ai/news/blog/proxyshell 特長 メールアドレスを指定する必要はありません Active Directory からメールアドレスを列挙しようとします Active Directory から LegacyDN を列挙しようとします 組み込みメール...

wifiphisher

About Wifiphisher is a rogue Access Point framework for conducting red team engagements or Wi-Fi security testing. Using Wifiphisher, penetration testers can easily achieve a man-in-the-middle position against wireless clients by performing targeted Wi-Fi association attacks. Wifiphisher can be...

SkyArk

SkyArk是一个云安全项目，包含两个主要扫描模块： 1. AzureStealth - 扫描Azure环境 2. AWStealth - 扫描AWS环境 这两个扫描模块将发现目标AWS和Azure中权限最高的实体。 主要目标 - 发现权限最高的云用户 SkyArk目前专注于缓解云影子管理员这一新威胁，并帮助组织发现、评估和保护云中的特权实体。 隐形和潜伏的云管理员可能存在于每个公有云平台中，SkyArk有助于降低AWS和Azure中的风险。 在防御/渗透测试/风险评估流程中 - 请确保应对这一威胁，并验证这些特权实体确实得到了良好的保护。 背景：...

Jboss_JMXInvokerServlet_Deserialization_RCE

JbossJMXInvokerServletDeserializationRCE 使用Burp Suite利用Java反序列化漏洞 0x01 搭建Jboss JMXInvokerServlet 反序列化漏洞 测试环境： JBoss JMXInvokerServlet 反序列化漏洞 漏洞原理：JBoss在/invoker/JMXInvokerServlet请求中读取了用户传入的对象，然后我们利用Apache Commons Collections中的Gadget执行任意代码。 root@kitploit:...

CVE-2026-82835

A vulnerability in caoqianming django-vue-admin 1.0 allows improper access control through manipulation of the file_id argument at the /api/file/ endpoint. The attack is executable remotely with low privileges and no user interaction . Exploit code has been made public and is rated as proof-of-co...

CVE-2026-82835 caoqianming django-vue-admin file access control

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument fileid can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the...

EUVD-2026-68745

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument fileid can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the...

Claude-ExternalPentest

External Penetration Test agents for Claude Code A Claude C...

collection-document

Project Description Collection of quality safety articlesTo be rebuilt Some are inconvenient to release. Some forget update,can see me star. collection-document awesome 以前的链接中大多不是优质的 渗透测试部分不再更新 因精力有限，缓慢更新 Author: tom0li Blog: https://tom0li.github.io root@kitploit: - Project Description -...

Airachnid-Burp-Extension

Web Cache Deception Burp Extension A Burp extension to test applications for vulnerability to the Web Cache Deception attack. Once the extension has been loaded, it can be accessed in the Target - Sitemap tab and right click on the resource that should be tested. A context sensitive menu item...

wacker

Overview A set of scripts to help perform an online dictionary attack against a WPA3 access point. Wacker leverages the wpasupplicant control interface to control the operations of the supplicant daemon and to get status information and event notifications ultimately helping speedup connection...

pocsuite3

pocsuite3 法律免責事項 pocsuite3を事前の相互同意なしに標的に攻撃するために使用することは違法です。 pocsuite3はセキュリティテスト目的のみに使用してください。 法律免責事項 事前の双方同意なしに pocsuite3 を使用してターゲットを攻撃することは違法です。pocsuite3 はセキュリティテスト目的のみで使用されます。 概要 pocsuite3は、Knownsec 404 Team によって開発された、オープンソースのリモート脆弱性テストおよび概念実証開発フレームワークです。...

FML-Network

FLNET2023: Realistic Network Intrusion Detection Dataset for Federated Learning Paper: FLNET2023: Realistic Network Intrusion Detection Dataset for Federated Learning Dataset: FLNET2023 Introduction FLNET2023 is a state-of-the-art benchmark dataset for intrusion detection systems, specifically fo...

awesome-soc-analyst

awesome-soc-analyst SOCアナリストおよびSOCアナリスト志望者のための有用なリソースを集めました。 このリポジトリは LetsDefend によって管理されています。新しいリソースを自由に追加してください。 目次 書籍 マルウェア解析 実践ラボ フィッシング分析 調査ツール ネットワークログソース ネットワークデバイスログ Linuxファイアウォールログ SMBログ Windowsファイアウォールログ ネットワークセキュリティデバイスログ IDS/IPSログ ネットワークファイアウォールログ Webアプリケーションファイアウォール（WAF）ログ Webサーバーログ...

web-check

Web-Check Comprehensive, on-demand open source intelligence for any website 🌐web-check.xyz Kindly supported by: Terminal Trove The $HOME of all things in the terminal | Warp Built for coding with multiple AI agents ---|--- Contents About Screenshot Live Demo Mirror Features Usage Deployment...

web-check

Web-Check Comprehensive, on-demand open source intelligence for any website 🌐web-check.xyz Kindly supported by: Terminal Trove The $HOME of all things in the terminal | Warp Built for coding with multiple AI agents ---|--- Contents About Screenshot Live Demo Mirror Features Usage Deployment...

ntpdos

ntpdos 分散型NTPリフレクションDoS CVE-2013-5211 のPoC。 使用方法 root@kitploit: $ ./ntpdos -H --== ntpdos by sepehrdad ==-- usage: ntpdos -t -s options | misc options: -t - target ip address -T - list of target ip addresses -s - ntp server ip address -S - list of ntp server ip addresses -p - number of parallel...

CVE-2026-82820

A vulnerability was found in FLVMeta up to 1.2.2. Affected is the function amfstringnew of the file src/amf.c of the component AMF String Processing. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. The exploit has been made publi...

CVE-2026-82821

A vulnerability was determined in FLVMeta up to 1.2.2. Affected by this vulnerability is the function amfobjectget of the file src/amf.c of the component AMF Object Parsing. This manipulation causes null pointer dereference. The attack may be initiated remotely. The exploit has been publicly...