venom

VENOM 1.0.17 - metasploit Shellcode generator/compiller Version release : v1.0.17 Author : pedro ubuntu r00t-3xp10it Codename: Aconite Aconitum napellus Distros Supported : Linux Ubuntu, Kali, Mint, Parrot OS Suspicious-Shell-Activity SSA RedTeam develop @2019 LEGAL DISCLAMER The author does not...

OpenMalleableC2

OpenMalleableC2 Open Source Implementation of Cobalt Strike's Malleable C2 OpenMalleableC2 is a framework-agnostic library that implements Cobalt Strike's Malleable C2 profile format for HTTP transformations. It enables security researchers and red teams to easily implement malleable C2...

Php-unit-CVE-2017-9841

phpunit Remote Code Execution Vulnerability CVE-2017-9841 Composer is a PHP package management tool. Using Composer to install extension packages will create a vendor folder in the current directory and place all files in it. Usually this directory should be placed outside the web root so that...

feroxfuzz

🚀 FeroxFuzz 🚀 A structure-aware HTTP fuzzing library 🤔 Another ferox? why? 🤔 Chill, it's not another command-line tool, this one's a library! 😁 More specifically, FeroxFuzz is a structure-aware HTTP fuzzing library. The primary goal in writing FeroxFuzz was to move some core pieces out of...

purify

Purify All-in-one tool for managing vulnerability reports 🎮 Demo 📃 Docs 📹 Quick Vimeo Description The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various even custom tools. Purify is aims to be a tool-agnostic applicatio...

kafka-keycloak-oauth

Apache Kafka 4.1.0 with Keycloak OAuth2 Authentication Production-ready Apache Kafka 4.1.0 KRaft mode with Keycloak 26.1.1 OAuth2/OIDC authentication using Strimzi Kafka image. Why This Project vs kafka-oauth-keycloak-tls-demo This is an evolution of the previous POC with significant improvements...

PolinRider

PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos Date: 2026-03-07 Last updated: 2026-04-11 — see April 10–11 Update below Severity: CRITICAL — active supply chain infection across 1,950+ public repositories, confirmed operational merger with the TasksJacker / Contagious...

Koh

Koh Koh is a C and Beacon Object File BOF toolset that allows for the capture of user credential material via purposeful token/logon session leakage. Some code was inspired by Elad Shamir's Internal-Monologue project no license, as well as KB180548. For why this is possible and Koh's approeach, s...

follina.py

'Follina' MS-MSDT n-day Microsoft Office RCE Quick POC to replicate the 'Follina' Office RCE vulnerability for local testing purposes. Running the script will generate a clickme.docx or clickme.rtf payload file in your current working directory, and start a web server with the payload file...

CVE-2026-41089

CVE-2026-41089 ██████╗██╗ ██╗███████╗ ██╗ ██╗ ██╗ ██████╗ ██████╗ ██╔════╝██║ ██║██╔════╝ ██║ ██║███║██╔═████╗██╔═████╗ ██║ ██║ ██║█████╗ ███████║╚██║██║██╔██║██║██╔██║ ██║ ╚██╗ ██╔╝██╔══╝ ██╔══██║ ██║████╔╝██║████╔╝██║ ╚██████╗ ╚████╔╝ ███████╗ ██║ ██║ ██║╚██████╔╝╚██████╔╝ ╚═════╝ ╚═══╝ ╚══════...

WebminRCE-exploit

WebminRCE-exploit CVE-2022-0824, CVE-2022-0829 - File Manger privilege exploit Vulnerable application to test this PoC can be found here as a docker image. Prerequisites: Python3 Requests module Description Vulnerability Improper Access Control to Remote Code Execution Safe users Unpriviledged us...

trustmebro

Bypass llm guardrails by confusing it with fabricated tool output. Results · Installation · Quick start · Rules · Architecture TrustMeBro intercepts command-line tools invoked by coding agents such as Codex, Claude Code, and pi. Rules decide whether to return fabricated output, modify the real...

shannon

!NOTE Cyber verification for Anthropic and OpenAI models: complete your provider's cyber verification program to prevent model failures and refusals during cyber workloads. Shannon is an autonomous, AI pentester for web applications and APIs. It analyzes your source code, identifies attack paths,...

CVE-2024-53677-Exploitation

CVE-2024-53677 Exploitation Apache Struts RCE via File Upload Description CVE-2024-53677 is a vulnerability which impacts Apache Struts from 2.0.0 before 6.4.0. ⚠️ This was exploited in a Hack The Box lab. File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params...

CVE-2024-33113

CVE-2024-33113 The D-LINK DIR-845L router is vulnerable to information disclosure via the bscsmsinbox.php file. CVE-2024-33113 is a vulnerability in the D-LINK DIR-845L router that allows information disclosure through the bscsmsinbox.php file. The vulnerability stems from inadequate handling of...

CVE-2021-43798

CVE-2021-43798 Grafana 8.x Path Traversal Pre-Auth All credits go to j0v and his tweet https://twitter.com/j0v0x0/status/1466845212626542607 Disclaimer This is for educational purposes only. I am not responsible for your actions. Use at your own discretion. In good faith, I've held back releasing...

cpanel2shell-scanner

cpanel2shell-scanner A high-fidelity scanner for the cPanel/WHM authentication bypass tracked as CVE-2026-41940. It identifies vulnerable hosts without producing the false-negatives common to public proofs-of-concept and detections, and without triggering the account lockout and root-IP-allowlist...

wphardening

WPHardening Fortify the security of any WordPress installation. ❮ NOTE ❯ This tool releases new versions on a regular basis. Make sure to update your dependencies frequently to get the latest version. Check out the changelog or CHANGELOG.md to learn about the new features. Installation Installing...

CallStackMasker

CallStackMasker This repository demonstrates a PoC technique for dynamically spoofing call stacks using timers. Prior to our implant sleeping, we can queue up timers to overwrite its call stack with a fake one and then restore the original before resuming execution. Hence, in the same way we can...

IATelligence

IATelligence IATelligence is a Python script that extracts the Import Address Table IAT from a PE file and uses OpenAI's GPT-3 model to provide details about each Windows API imported by the file. The script also searches for related MITRE ATT&CK techniques and explains how the API could...