sgn

SGN is a polymorphic binary encoder for offensive security purposes such as generating statically undetecable binary payloads. It uses a additive feedback loop to encode given binary instructions similar to LFSR. This project is the reimplementation of the original Shikata ga nai in golang with...

Zetsu

A personal offline RAG system for offensive security knowledge. Ingest your writeups, lab solutions, bug bounty reports, and security blogs, then query them in natural language during engagements. No cloud, no SaaS, your knowledge stays yours. What it does ZETSU turns your accumulated knowledge...

The-Axer

The axer will replace the manual procedure of creating your payloads with msfvenom , making it easier and a lot quicker Contact The Owner THE AXER WILL LET YOU CHOOSE THE PLATFOR , FORMAT , ENCODER , Bind with another file and alot of other features...

owasp-java-encoder

OWASP Java Encoder Contextual output encoding for Java 8+. Choose an encoder for the parser context receiving untrusted text: HTML, JavaScript, CSS, XML or a URL component. The core has no runtime dependencies; optional JSP and Jakarta adapters provide view-layer bindings. Encoding is one part of...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

CVE-2026-42530

🛡️ CVE-2026-42530 - NGINX HTTP/3 QUIC Use-After-Free Vulnerability High-Severity Use-After-Free in NGINX HTTP/3 QUIC ⚠️ QPACK Encoder Stream Vulnerability 🔍 Overview CVE-2026-42530 is a use-after-free vulnerability in NGINX's ngxhttpv3module. A remote unauthenticated attacker can trigger it by...

Ascii-And-Sub-Encoder

ASCII And/Sub Encoder This tool has been created while i was preparing for the offensive security CTP course leading to legacy OSCE certification. The tool generates nasm friendly assembly instructions of a customized Ascii Subtraction Encoder. The development of this tool is based on the...

ESAPI-SQLinjection-CVE-2025-5878-Exploit

Affected: ESAPI.encoder.encodeForSQL method and OracleCodec class Affected versions: 2.2.0.0-2.6.2.0 Usage: similar to sqlmap usage: esapi-sqlinjection.py -h -u URL -c COOKIE --dbs --tables --columns -D DB -T TABLE -C COLUMN --dump esapi-sqlinjection.py: error: the following arguments are require...

CVE-2026-42530

CVE-2026-42530 Scanner for CVE-2026-42530, a use-after-free in nginx's HTTP/3 module. Affected: nginx 1.31.0, 1.31.1 Fixed: nginx 1.31.2 Usage pip install aioquic python3 scannerCVE-2026-42530.py port python3 scannerCVE-2026-42530.py --file hosts.txt How it works Opens two QPACK encoder streams o...

SLAE

SecurityTube Linux Assembly Expert This blog post has been created for completing the requirements of the SecurityTube Linux Assembly Expert certification: http://securitytube-training.com/online-courses/securitytube-linux-assembly-expert/ Student ID: SLAE-1134 Articles Assignment 1: Linux x86...

NOW

NØW — Word-Based Shellcode Encoder Encode shellcode as natural-looking English prose. Decode it back with the right sentence + password. What is NØW? NØW Natural Output Words is a C tool that converts raw shellcode bytes into human-readable English text — either a plain list of codewords or fluen...

pyrmax

pyrmax Decoder and encoder for Ubiquiti AirMAX wire-protocol frames, covering both the AC WA firmware and M XW/XM firmware series. Decode of the cleartext outer headers is driven by Kaitai Struct schemas under ksy/. The AC payload version-gated, switched on msgtype, with the deauth XOR-unmask is...

Brosec

Overview tl;dr Brosec is a terminal based reference utility designed to help us infosec bros and broettes with useful yet sometimes complex payloads and commands that are often used during work as infosec practitioners. An example of one of Brosec's most popular use cases is the ability to genera...

YouPHPTube Encoder 2.3 - Command Injection

Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube.The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack. id: CVE-2019-5129 info: name: YouPHPTube Encoder 2.3 - Command...

YouPHPTube Encoder - Arbitrary File Write

Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube.The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack. id: CVE-2019-5128 info: name: YouPHPTube Encoder - Arbitrary...

Slink

Slink is an alphanumeric shellcode x86 encoder that use simple math operations to reformat characters beyond 7f. The tool creation was inspired by the following sploit EDB-ID: 44455. Here's the list of current features: Encode using 01-7f characters set. Exclude common bad characters such as...

YouPHPTube Encoder 2.3 - Remote Command Injection

YouPHPTube Encoder 2.3 is susceptible to a command injection vulnerability which could allow an attacker to compromise the server. These exploitable unauthenticated command injections exist via the parameter base64Url in /objects/getImage.php. id: CVE-2019-5127 info: name: YouPHPTube Encoder 2.3 ...

CLEANSTART-2026-WJ81202 HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details...

EUVD-2026-108550

The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can...

EUVD-2026-108549

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...