RedbloodC2

Public version of Redblood C2 This is a simple command and control server to handle sessions and your victims installation $ git clone https://github.com/kira2040k/RedbloodC2.git $ cd RedbloodC2 $ npm install $ node server.js Usage After install node.js and and all modules from npm execute: node...

bitcracker

BitCracker BitCracker is the first open source password cracking tool for storage devices Hard Disk, USB Pendrive, SD card, etc... encrypted with BitLocker, an encryption feature available on Windows Vista, 7, 8.1 and 10 Ultimate, Pro and Enterprise editions. BitLocker offers a number of differen...

CVE-2022-3656

Imperva Red Team recently revealed a vulnerability called CVE-2022-3656 that affects more than 2.5 billion users of Google Chrome and Chromium-based browsers. This vulnerability allows the theft of sensitive files, such as encrypted wallets and cloud provider credentials. Vulnerability...

CipherGist

If you find this GitHub repo useful, please consider giving it a star! ⭐️ 🛡️ CipherGist - End-to-End Encrypted Messaging via GitHub Gists CipherGist is a lightweight, secure, and open-source encrypted messenger that enables private communication using GitHub Gists as the backend. It leverages NaCl...

bantam

Bantam An advanced PHP backdoor management tool, with a lightweight server footprint, multi-threaded communication, and an advanced payload generation and obfuscation tool. Features end to end encryption with request unique encryption keys, and payload streaming designed to bypass WAF, IDS, SIEM...

plugxdecoder

plugxdecoder Basic Python script which Decodes PlugX traffic and encrypted/compressed artifacts. Accepting pull requests from those who wish to contribute. Currently requires: CTypes with ntdll, dpkt http://code.google.com/p/dpkt Tested with Python 2.7, on Windows. Long-term goal is to make a pur...

enseal

enseal Secure, ephemeral secret sharing for developers. Stop pasting secrets into Slack. enseal makes the secure path faster than the insecure one — share .env files and secrets through encrypted, single-use channels with one command and zero setup. sender $ enseal share .env Share code:...

libredns.gr

DNS - over TLS/HTTPS Support Join License...

AnonX

NOTE AnonX script was based on we-transfer public API and has stopped working after three weeks from its release. “All good things must come to an end, so it’s with a heavy heart and through held-back tears that we must announce that we’ll be retiring our Public API. Sad times.” says Stephen. For...

CVE-2019-5420-PoC

CVE-2019-5420-PoC Wrote this for PentesterLab If you are from PentesterLab's don't cheat, it's alot better to learn. Hope it's useful to someone, if not to me in the future : Nice argparse stuff, not a bad PoC Usage usage: script.py -h --appname APPNAME --cookie COOKIE --modify KEY VALUE...

BlackMamba

BlackMamba Command and Control What's BlackMamba? Black Mamba is a Command and Control C2 that works with multiple connections at same time. It was developed with Python and with Qt Framework and have multiples features for a post-exploitation step. Some Features Multiple clients. Real-time...

WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6671 info: name: WhatsUp Gold GetStatisticalMonitorList SQL Injectio...

CLEANSTART-2026-RV97727 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

Security vulnerability affects the argo-cd package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...

encrypted-linux-kernel-modules

ELKM: Encrypted Linux x86-64 Loadable Kernel Modules ELKM provides a mechanism to securely transport and load encrypted Loadable Kernel Modules LKM. The aim is to protect kernel-based rootkits and implants against observation by Endpoint Detection and Response EDR software and to neutralize the...

CVE-2018-15133-PoC

CVE-2018-15133-PoC This Python script implements a remote code execution RCE exploit for vulnerable Laravel applications through insecure deserialization, based on the CVE-2018-15133 vulnerability. The exploit takes advantage of a vulnerability in Laravel versions 5.5.40 and earlier, and 5.6.0 to...

CLEANSTART-2026-SE65887 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello

CVE-2026-42505 affects multiple packages. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. See references for individual vulnerability details...

Malicious code in libseal (PyPI)

Source: kam193 7e6d706d49a7fce89545d12c5bd5a0cab0a4919a95ff89150b28cb838967bb09 In this campaign, one package iterquarry holds an encrypted payload, while another one libseal provides algorithms to decrypt and execute it. In earlier versions, the code used an embedded key and the payload was...

Malicious code in iterquarry (PyPI)

Source: kam193 229de224c9319ae50283d0c8fb0f76e351d82327ac204193b7dd2d62026ee41d In this campaign, one package iterquarry holds an encrypted payload, while another one libseal provides algorithms to decrypt and execute it. In earlier versions, the code used an embedded key and the payload was...

CVE-2025-49091-Gajim-RCE

CVE-2025-49091 - Python Proof of Concept Proof-of-concept PoC exploit for CVE-2025-49091 for Gajim encrypted messenger. Discovered by Patryk Ptak SivertPL and Dennis Dast independently, exploit by Patryk Ptak. Files CVE-2025-49091.py – Python PoC. Usage python3 CVE-2025-49091.py Adjust any requir...

CVE-2026-76406

Versions of Splunk SOAR below 8.7.0 are vulnerable to an information disclosure flaw in the REST API . The root cause is that the system decrypts encrypted Basic authentication values before completing the necessary authentication checks. An unauthenticated user who already possesses encrypted cr...