ccs-eval

Evaluates hosts for CVE-2014-0224 vulnerability https://vulners.com/cve/CVE-2014-0224 Usage: ccs-eval.py list-of-hosts.txt -Takes in a list of hosts, line seperated. Checks the host for common SSL ports using nmap. Peforms PoC injection test supplied by RedHat fake-client-early-ccs.pl. Writes...

anamnesis-release

Anamnesis: LLM Exploit Generation Evaluation This repository contains the evaluation framework for studying how LLM agents generate exploits from vulnerability reports in the presence of exploit mitigations. Given a bug report and proof-of-concept trigger, agents analyze vulnerable software and...

TLS-Scanner

TLS-Scanner TLS-Scanner is a tool to assist pentesters and security researchers in the evaluation of TLS server and client configurations. Please note: TLS-Scanner is a research tool intended for TLS developers, pentesters, administrators and researchers. There is no GUI. It is in the first versi...

CVE-2026-42533

CVE-2026-42533 — nginx map/regex capture clobbering tracking site Source for the CVE-2026-42533 patch-status tracker: a single-page site recording which distributions have shipped a fix for the nginx map/regex capture-clobbering heap overflow. Where the facts live Everything about the bug —...

claude_opus_cve_2023_0266

Demonstration that Claude 3 Opus does not understand CVE-2023-0266 and does not find it Demo 1. Even if told where the bug is Opus does not find it, and hallucinates the presence of lock acquisitions Demo 2. "Prompt engineering" aka telling the LLM exactly how to find the bug also doesn't work De...

skill-safety-bench

SkillSafetyBench SkillSafetyBench is a fully materialized benchmark for evaluating safety failures caused by attacks on skill-facing context. Each case keeps the user-facing task ordinary, while the attack is placed in local skills, helper scripts, sidecar files, corpora, templates, or other...

fuzzer-testing

fuzzer-testing Standardized Docker images for evaluating open-source fuzzers, fully integrated with the corpora for easy experimentation. Supported / Included Fuzzers AFL github.com/google/AFL AFLplusplus github.com/AFLplusplus Honggfuzz github.com/google/honggfuzzz QSYM sslab-gatech/qsym Eclipse...

CVE-2021-31805-POC

CVE-2021-31805-POC Vulnerability Information Apache Struts is a free, open-source MVC framework for creating elegant, modern Java web applications. It favors convention over configuration, can be extended using a plugin architecture, and ships with plugins that support REST, AJAX, and JSON...

magescan

Mage Scan The idea behind this is to evaluate the quality and security of a Magento site you don't have access to. The scenario when you're interviewing a potential developer or vetting a new client and want to have an idea of what you're getting into. Installation .phar Download the magescan.pha...

s3_objects_check

S3 Objects Check Description Whitebox evaluation of effective S3 object permissions, in order to identify publicly accessible objects. Allows identifying publicly accessible objects, as well as objects accessible for AuthenticatedUsers by using a secondary profile. A number of tools exist which...

CVE-2026-78844

Summary javadelight delight-nashorn-sandbox 0.5.5 suffers from Uncontrolled Resource Consumption. The sandbox enforces maxCPUTime limits by statically injecting interruption checks into JavaScript loops, but the sandbox fails to disable dynamic code evaluation. An attacker can use these functions...

yaradbg-frontend

Introduction YaraDbg is a free web-based Yara debugger to help security analysts to write hunting or detection rules with less effort and more confidence. By using YaraDbg, you can perform a thorough root-cause-analysis RCA on why some of your Yara rules did or did not match with a specific file...

Phishious

What is Phishious? Phishious is an open-source Secure Email Gateway SEG evaluation toolkit designed for red-teamers and developed by the team at CanIPhish. Phishious provides the ability to see how various Secure Email Gateway technologies behave when presented with phishing material. 📬 Secure...

flare-qdb

FireEye Labs Query-Oriented Debugger flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit. flare-qdb frees the analyst to take a nonline...

sniffles

Sniffles--Packet Capture Generator for IDS and Regular Expression Evaluation Sniffles is a tool for creating packet captures that will test IDS that use fixed patterns or regular expressions for detecting suspicious behavior. Sniffles works very simply. It takes a set of regular expressions or...

JSONPath Plus < 10.3.0 - Remote Code Execution

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

CVE_2018_16763_Proof_of_Concept

CVE-2018-16763 Proof-of-Concept A Proof-of-Concept PoC exploit for CVE-2018-16763 Fuel CMS - Preauthenticated Remote Code Execution. Description This Python 3 program serves as a PoC for the CVE-2018-16763 vulnerability in the Fuel CMS content management system. Specifically, the vulnerability...

secuimag3a

Based on a flaw or vulnerability either proposed by the instructor or chosen by you which must be related to the proposed theme: Specify which service or program is compromised, and what type of compromise it is Explain the vulnerability, describe the mechanism used to exploit it Does this flaw...

CVE-2020-17530

CVE-2020-17530 Quick POC for CVE-2020-17530. In Apache Struts versions 2.0.0 - 2.5.25 a forced Object Graph Navigational Language OGNL evaluation on raw user input in tag attributes may lead to remote code execution RCE. $ python CVE-2020-17530.py --help usage: CVE-2020-17530.py -h -c COMMAND -n...

Agentic-CLIP-Benchmark

Agentic-CLIP-Benchmark: Zero-Shot Evaluation on CIFAR-10 -green.svg This project implements a robust, automated pipeline for evaluating OpenAI's CLIP ViT-B/32 model on the full CIFAR-10 test set 10,000 images. Developed using an AI Native workflow Trae IDE , it achieves a high-precision zero-shot...