Exploit for Out-of-bounds Write in Fortinet Fortiproxy

FortiGate SSL-VPN kit recovered in the wild Research arch...

CVE-2026-15826-CVE-2026-15748

CVE-2026-15826, CVE-2026-15748 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing...

SteppingStones

Stepping Stones Purpose A hub for Red Team activity to aid in record keeping, situational awareness and reporting. Stepping Stones provides a web based UI for the team to log activity and generate report snippets. The UI is intended to be rapid enough to be used throughout the engagement, not jus...

SleuthQL

SleuthQL Description SleuthQL is a python3 script to identify parameters and values that contain SQL-like syntax. Once identified, SleuthQL will then insert SQLMap identifiers into each parameter where the SQL-esque variables were identified. Supported Request Types SleuthQL requires an export of...

vBulletin-5.x-0day-pre-auth-RCE-exploit

vBulletin-5.x-0day-pre-auth-RCE-exploit 影响版本：vBulletin 5.0.05.5.4 poc如下: !/usr/bin/python vBulletin 5.x 0day pre-auth RCE exploit This should work on all versions from 5.0.0 till 5.5.4 Google Dorks: - site:.vbulletin.net - "Powered by vBulletin Version 5.5.4" import requests import sys if...

bro-shellshock

ShellShock Detector for Bro This script detects successful exploitation of the Bash vulnerability with CVE-2014-6271 nicknamed "ShellShock". It's more comprehensive than most of the detections around in that it's watching for behavior from the attacked host that might indicate successful compromi...

wireguard-tools

wireguard-tools — tools for configuring WireGuard This supplies the main userspace tooling for using and configuring WireGuard tunnels, including the wg8 and wg-quick8 utilities. This project supports Linux, OpenBSD, FreeBSD, macOS, Windows, and Android. More information may be found...

fcn-

fcn free connect your private network from anywhere 1. What is fcn fcnfree connect is a foolproof one-click tool for accessing private networks, consisting of the server side and the client side fcn uses fcn public data servers and data encryption technology to virtually connect user clients to...

frinet

Frinet By combining Frida with an enhanced version of Tenet, Frinet facilitates the study of large programs, vulnerability research and root-cause analysis on iOS, Android, Linux, Windows, and most architectures. Blogpost on the Synacktiv website This version is a complete rewrite of...

cyclonedx-cli

root@kitploit: / / / / / \ |/ / / / / / / / / / / / / / / / / / / / / / / / / / / / / // // / // / // / / / / / // / | / // // / /, ///// /////|| /// // Usage: cyclonedx command options Options: --version Show version information -?, -h, --help Show help and usage information Commands: add...

CVE-2025-32463_exploit

CVE-2025-32463 — sudo "chwoot" chroot Local Privilege Escalation Local privilege escalation to root in sudo via the --chroot -R option. Works for any local user , including accounts with no sudoers entry at all e.g. www-data. sudo 1.9.14 – 1.9.17 chroots into the user-supplied directory while the...

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

Summary A crafted lockfile alias could reach several install-time filesystem joins. With --trust-lockfile or a frozen lockfile, traversal segments could create links outside the intended project or nodemodules boundary. This patch validates dependency names and every virtual-store slot before...

CVE-2024-21626-runcPOC

Vulnerability Reproduction CVE-2024-21626 docker runc Escape Vulnerability 1. Vulnerability Overview Vulnerability Name| docker runc Escape Vulnerability ---|--- CVE ID| CVE-2024-21626 Disclosure Date| 2024-01-31 Characteristic| / Affected Versions| runc @ v1.0.0-rc93, 1.1.11 2. Exploitation &...

lighty-sqlinj-demo

title: Ep4 - Network-Related Vulnerability members: Ciro S. Costa Marcela Terakado date: 10 Nov, 2015 Related vulnerability: root@kitploit: CVE-2014-2323 1 was assigned to SQL injection bug. CVE-2014-2324 2 was assigned to the path traversal bug. Confirm:...

Better-CVE-2022-29464

Better CVE-2022-29464 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a...

POC_CVE-2025-32433

⚠️ Ethical Disclaimer This repository contains code that demonstrates a real CVE CVE-2025-32433. Use it only in environments where you have explicit authorization. Never test this exploit against systems you do not own or manage. Unauthorized use is illegal, unethical, and harmful to the...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

CVE-2026-17106

CVE-2026-17106 — CopyEscape:docker cp container-to-host arbitrary file write HackSpeak distribution mirror. This repository is a distribution mirror of the CopyEscape PoC CVE-2026-17106 published by the Imperva Red Team Ron Masas , with the code identical to upstream; upstream does not include a...

CVE-2019-10149

CVE-2019-10149 - Exim 4.87 Local/Makefile cp eximmonitor/EDITME Local/eximon.conf Create exim user and group sudo groupadd -g 31 exim sudo useradd -d /dev/null -c "Exim Daemon" -g exim -s /bin/false -u 31 exim Install dependencies sudo apt-get update sudo apt-get install -y make build-essential...

CVE-2022-36231

CVE-2022-36231 The ruby gem pdfinfo = 0.5.3 is vulnerable to OS Command Injection when executing a method on a PDF::Info object. An attacker using a specially crafted payload may execute OS commands by using command chaining. Vulnerability Analysis When creating a new PDF::Info object the...