Karkinos

Disclaimer This is an OLD project I did in university... all code was improvised as I progressed, and hardly anything was planned. This tool should be used on applications/networks that you have permission to attack only. Any misuse or damage caused will be solely the users’ responsibility. What ...

KITT

KITT 2.0 Penetration Testing Framework The KITT Penetration Testing Framework was developed as an open source solution for pentesters and programmers alike to compile the tools they use with what they know into an open source project. With KITT, users are able to easily access a list of commonly...

rekono

Automate the recon, keep your time for the part that actually needs a hacker Think about how an assessment really starts. You gather public information about the target. You discover its hosts, enumerate their ports and identify the services behind them. Then you run a more specific tool against...

Cybersec

Offensive CyberSec Cheat Sheet A highly dynamic, single-file HTML cheat sheet designed for Red Teamers, Pentesters, and CTF players. Tired of typing the same Reverse Shell payloads and constantly replacing your local IP and port? This tool eliminates the "Typo Fatigue" and cognitive load during...

sippts

ما هو Sippts؟ Sippts هي مجموعة أدوات لتدقيق خوادم وأجهزة VoIP باستخدام بروتوكول SIP. Sippts مبرمجة بلغة Python وتسمح لنا بفحص أمان خادم VoIP باستخدام بروتوكول SIP. هل هي مجانية؟ نعم. يمكنك استخدامها وتعديلها وتوزيعها بحرية. إذا قمت بتعديلها، فيرجى وضع إشارة إلى هذا الموقع. هل يمكن استخدام Sippts...

apache_normalize_path

CVE-2021-41773|CVE-2021-42013: Path Traversal Zero-Day in Apache HTTP Server Exploited On October 5, the Apache HTTP Server Project patched CVE-2021-41773, a path traversal and file disclosure vulnerability in Apache HTTP Server, an open-source web server for Unix and Windows that is among the mo...

CVE-2025-65964-Exploit

Reproduction Steps First, prepare a repository containing a malicious file. root@kitploit: mkdir n8n-rce-poc && cd n8n-rce-poc git init git remote add origin mkdir evilhooks echo '!/bin/sh' evilhooks/pre-commit echo 'touch /tmp/pwnedsuccess' evilhooks/pre-commit chmod +x evilhooks/pre-commit git...

RedTeamCoin

RedTeamCoin RedTeamCoin is a blockchain-based cryptocurrency mining pool implementation designed for authorized security testing and red team operations. Built in Go with Java client support, it simulates real-world cryptomining attacks to help organizations assess their detection capabilities an...

awesome-soc-analyst

awesome-soc-analyst हमने SOC विश्लेषकों और SOC विश्लेषक उम्मीदवारों के लिए उपयोगी संसाधन एकत्र किए हैं। यह रिपॉजिटरी LetsDefend द्वारा बनाए रखा जाता है। यहां नए संसाधन जोड़ने के लिए स्वतंत्र महसूस करें। विषय-सूची पुस्तकें मैलवेयर विश्लेषण अभ्यास प्रयोगशालाएँ फ़िशिंग विश्लेषण जांच के उपकरण नेटवर्क...

public-research

Nokia Deepfield ERT — public research Threat research from the Nokia Deepfield Emergency Response Team ERT, focused on DDoS botnets and related infrastructure. Each directory covers a botnet family with a brief summary and machine-readable indicators of compromise IoCs. This repo consolidates pri...

CrackQL

CrackQL CrackQL is a GraphQL password brute-force and fuzzing utility. CrackQL is a versatile GraphQL penetration testing tool that exploits poor rate-limit and cost analysis controls to brute-force credentials and fuzz operations. Table of Contents How it works Attack Use Cases Defense Evasion...

kbd-audio

kbd-audio This is a collection of command-line and GUI tools for capturing and analyzing audio data. Keytap The most interesting tool is called keytap - it can guess pressed keyboard keys only by analyzing the audio captured from the computer's microphone. Check this blog post for more details:...

CVE-2019-9053

CVE 2019-9053 Detail Description This code is an implementation of a Time-Based Blind SQL Injection attack in Python 3. The attack is designed to exploit a SQL injection vulnerability in a Content Management System CMS Made Simple 2.2.8 through an HTTP request. Exploit Use: root@kitploit:...

private-landing

Private Landing Learn authentication by building it right. Live Demo · Threat Model · Auth Flows · ADRs Demo note: The login endpoint is protected by adaptive PoW challenges — repeated failures return increasing proof-of-work difficulty. Cache-backed rate limiting is implemented and tested but no...

Intel-CVE-2015-2291

Intel-CVE-2015-2291 PoC exploit for CVE-2015-2291 Data-only attack to pop a system shell with the vulnerable intel driver. The code itselfs implements more "functionality" provided from the driver, like physical to virtual address translation, mapping physical memory This two combined = arbitrary...

CVE-2020-27747

CVE-2020-27747 Possible Account Takeover | Brute Force Ability Suggested description An issue was discovered in Click Studios Passwordstate 8.9 Build 8973. If the user of the system has assigned himself a PIN code for entering from a mobile device using the built-in generator 4 digits, a remote...

Moxy

Moxy Moxy Next-Gen Man in the middle proxy Open-source DAST tool for pentesting powered by agentic AI capabilities Supporting Ollama. Built on top of browser-use, Moxy streamlines dynamic application security testing. 🚀 INSANELY EASY TO USE And it's free, who doesn't like free stuff? Preview Aler...

Bug-Bounty-Arsenal-v.3

BugBounty Arsenal A free, full-stack security scanning platform for bug bounty hunters and security researchers — 50+ detectors, continuous monitoring, and CI/CD gating from a single dashboard. ▶ Live app:bugbounty-arsenal.net — free, no credit card. If this is useful, please ⭐ the repo — it...

cve-2019-9053-py3

CVE-2019-9053 — CMS Made Simple SQLi Exploit Python 3 Disclaimer: This tool is intended for authorized penetration testing and educational purposes only. Running this against systems without explicit written permission is illegal. The author assumes no liability for misuse. Overview This is a...

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. root@kitploit: python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY...