Crater-CVE-2023-46865-RCE

Crater-CVE-2023-46865-RCE Crater =6.0.6, CVE-2023-46865 Post-Auth RCE Superadmin Vulnerability Description Crater Invoice is vulnerable to unrestricted file upload with dangerous type due to lack of proper input validation. The Base64Mime checking class can be bypassed by embedding a valid PHP...

machofile

machofile machofile is a module to parse Mach-O binary files, with a focus on malware analysis and reverse engineering. Inspired by Ero Carrera's pefile, this module aims to provide similar capabilities but for Mach-O binaries instead. Reference material and documentation used to gain the file...

CVE2PoC

CVE2PoC CVE2PoC is a tool that helps penetration testers, bug hunters, and security researchers quickly find public exploits, Proof-of-Concepts PoCs, and advisories related to a CVE ID. Table of Contents Features Installation Usage Public Exploits Finding Report Generation CVE Description...

Termix-research

Termix Security Research Vulnerability research on Termix, a web-based SSH and server management platform 13k+ stars. CVE| Issue| Severity| Fixed| Advisory ---|---|---|---|--- CVE-2026-45746| Session hijacking → RCE| 9.0 Critical| v2.3.2| GHSA-cx2r-843c-vww8 CVE-2026-45750| OS command injection|...

Linux-for-a-Pentester

🐧 Linux for a Pentester 💀 "Theory is great, but the shell is where the magic happens." This repository is a curated collection of Linux command notes built from real-world labs, CTFs, and hands-on practice. No fluff, just the raw commands and practical notes needed for a Pentester. 📂 Repository...

nGixshell

nGixShell is an nginx CVE scanner and RCE exploit framework. It ships a proof-of-concept for CVE-2026-42945 CVSS 3.1 8.1 HIGH per F5/NVD — a heap buffer overflow in ngxhttprewritemodule — and a scanner covering 64 nginx CVEs with automated HTTP probes, fingerprinting, WAF detection/bypass, web...

jdwp-shellifier

JDWP exploitation script What is it ? This exploitation script is meant to be used by pentesters against active JDWP service, in order to gain Remote Code Execution. How does it work ? Well, in a pretty standard way, the script only requires a Python 2 interpreter: % python ./jdwp-shellifier.py -...

threatmap

threatmap Static IaC threat modeler that parses Terraform, CloudFormation, and Kubernetes manifests and produces structured threat model reports using STRIDE, MITRE ATT&CK, or PASTA frameworks. No network calls, no cloud credentials, fully offline. Runs as a CLI, REST API, or containerized servic...

exploit-CVE-2024-25723

Exploit for CVE-2024-25723 This repository is dedicated to addressing CVE-2024-25723, a critical security vulnerability in ZenML, with an educational Proof of Concept PoC provided to illustrate the issue and encourage prompt mitigation. The PoC demonstrates how an unauthorized user could...

CVE-2023-32315-POC

CVE-2023-32315-POC CVE-2023-32315-Openfire-Bypass-Py Overview This code is a Python version POC for CVE-2023-32315. It performs a series of operations to verify whether the target website is affected by the CVE-2023-32315 vulnerability and attempts to execute certain operations on the affected...

smart-tree

🌳 Smart Tree - The Smart Treehouse: Cyber-Botanical Dashboard & Agent-Agnostic Hooks! 🌐 Smart Tree is a blazingly fast, AI-friendly directory visualization tool that's 10-24x faster than traditional tree. Now with Security Scanner for supply chain attack detection, Aye Consciousness preservation,...

censys-python

Censys Python Library !WARNING DEPRECATION NOTICE : The Censys Search v1 and v2 APIs will be deprecated soon. Please migrate to the new Censys Platform. 📖 New API Documentation : https://docs.censys.com/reference/get-started 📦 New Python SDK : censys/censys-sdk-python 🖥️ New CLI Tool cencli:...

poc_CVE-2018-1002105

CVE-2018-1002105 PoC Authenticated PoC Demo Usage Unauthenticated PoC Demo Usage Authenticated PoC Proof-of-Concept exploit for CVE-2018-1002105. The current exploit requires create and get privileges on pods and pods/exec. Support has been added for portforward and attach, which require similar...

AMSI.fail

AMSI.fail Originally C Azure Function Later ported to JS with an HTTP trigger that generates obfuscated PowerShell snippets that break or disable AMSI for the current process. The snippets are randomly selected from a small pool of techniques/variations before being obfuscated. Every snippet is...

CrucibleC2

HardHat C2 A cross-platform, collaborative, Command & Control framework written in C, designed for red teaming and ease of use HardHat is a multi-user C .NET-based command and control C2 framework designed to aid in red team engagements and penetration testing. It aims to improve quality-of-life...

CVE-2023-27163-exploit

CVE-2023-27163 — request-baskets SSRF Exploit I wrote this exploit to target CVE-2023-27163 , a Server-Side Request Forgery SSRF vulnerability found in request-baskets versions ≤ 1.2.1. The flaw lives in the /api/baskets/name endpoint, where the forwardurl parameter allows an attacker to make the...

LibSSH-Authentication-Bypass

LibSSH-Authentication-Bypass LibSSH Authentication Bypass CVE-2018-10933 Usage: To use this script type in: python3 LibAuth.py –help to see all the options and parameters we need to use. So we need to specify the victim’s IP address, port no and finally the command that we want to execute in the...

trojanizer

TROJANIZER Version release : v1.1 Stable Author : pedro ubuntu r00t-3xp10it Codename: TroiaRevisited Distros Supported : Ubuntu, Kali, Mint, Parrot OS Suspicious-Shell-Activity SSA RedTeam develop @2017 FRAMEWORK DESCRIPTION The Trojanizer tool uses WinRAR SFX to compress the two files input by...

CVE-2021-41773S

Vulnerable docker images for CVE-2021-41773 Apache path traversal This vulnerabiltiy only applies to version 2.4.49 that have specific non-default configs. In certain situations this can result in either file read or code execution. https://twitter.com/ptswarm/status/1445376079548624899 Vulnerabl...

CVE-2019-18935-bypasswaf

CVE-2019-18935-bypasswaf Modified from the original project: https://github.com/noperator/CVE-2019-18935 1. The attack malicious payload is passed from the cookie 2. Metadata data is passed in through an encrypted interface and deserialized 3. Default proxy 127.0.0.1:8080 4. Default attack payloa...