CVE-2026-85222

D-Link DNS-340L (firmware 1.01B04) is affected by an OS command injection in the Add-On Center component, specifically in /cgi-bin/addon_center.cgi. Manipulation of the f_name, f_url, f_flag, and f_login_user arguments allows remote code execution. The attack requires high privileges (authenticat...

CVE-2026-85222 D-Link DNS-340L Add-On Center addon_center.cgi os command injection

A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addoncenter.cgi of the component Add-On Center. Such manipulation of the argument fname/furl/fflag/floginuser leads to os command injection. It is possible to...

CVE-2024-23346

root@kitploit: /bin/python3.11 exploit.py -t -u -p -l...

CVE-2021-44228

Log4j Vulnerability - CVE-2021-44228 📗 Introduction This vulnerability was discovered on December 9, 2021, identified with CVE-2021-44228 , this flaw affects the java log package, generating a Severity Score CVSS of 10 points , providing execution of remote access to the host. This vulnerability...

CVE-2006-3392

CVE-2006-3392 취약점 정보 Webmin 및 Usermin에서 악성 사용자가 잠재적으로 민감한 정보를 노출할 수 있는 취약점이 보고되었습니다. 이 취약점은 URL 처리 과정에서 발생하는 특정되지 않은 오류로 인해 발생합니다. 이를 악용하면 유효한 로그인 없이 특수하게 조작된 URL을 통해 서버에 있는 모든 파일의 내용을 읽을 수 있습니다. 이 취약점은 Webmin1.290 이전 버전 및 Usermin1.220 이전 버전에서 보고되었습니다. 이 작은 스크립트는 기업 침투 테스트Enterprise pentests 및 OS...

requests-racer

Requests-Racer Requests-Racer is a small Python library that lets you use the Requests library to submit multiple requests that will be processed by their destination servers at approximately the same time, even if the requests have different destinations or have payloads of different sizes. This...

zizzania

zizzania zizzania sniffs wireless traffic listening for WPA handshakes and dumping only those frames suitable to be decrypted one beacon + EAPOL frames + data. In order to speed up the process, zizzania sends IEEE 802.11 DeAuth frames to the stations whose handshake is needed, properly handling...

zizzania

zizzania zizzania captura tráfico inalámbrico escuchando handshakes WPA y volcando solo aquellos marcos adecuados para ser descifrados un beacon + tramas EAPOL + datos. Para acelerar el proceso, zizzania envía tramas IEEE 802.11 DeAuth a las estaciones cuyo handshake se necesita, manejando...

jsmon

JSMon JSMon - Monitor de Cambios JavaScript para BugBounty Usando este script, puedes configurar una cantidad de archivos JavaScript en sitios web que deseas monitorear. Cada vez que ejecutes este script, estos archivos se obtendrán y se compararán con la versión obtenida anteriormente. Si han...

jsmon

JSMon JSMon - JavaScript Change Monitor for BugBounty Using this script, you can configure a number of JavaScript files on websites that you want to monitor. Everytime you run this script, these files will be fetched and compared to the previously fetched version. If they have changed, you will b...

CVE-2021-25461

CVE-2021-25461 This is a repo with the Proof of Concept for the CVE discovered for the SAUSAGE Security Analysis of Unix domain Socket usAGE in Android paper that was accepted to EuroS&P 2022. I worked on this paper with Mounir Elgharabawy, the one who discovered the vuln and wrote the Proof of...

thetick

The Tick A simple embedded Linux backdoor. The Tick Compiling Installing Usage Media Compiling The Tick depends only on libcurl, so make sure you have the corresponding development package. For example on Debian based distributions you would do the following: root@kitploit: sudo apt-get install...

TriforceOpenBSDFuzzer

TriforceOpenBSDSyscallFuzzer 20160825 https://github.com/nccgroup/TriforceOpenBSDFuzzer Jesse Hertz [email protected] Tim Newsham [email protected] This is a collection of files used to perform system call fuzzing of OpenBSD amd64 using TriforceAFL i.e. AFL and QEMU. To use it you will...

UPnP-Pentest-Toolkit

UPnP Pentest Toolkit This tool aims to bring together a range of UPnP assessment features, enabling quick assessment with minimal configuration and set-up. It has been developed to aid security consultants in exploring, spoofing and manipulating of UPnP devices and the underlying protocols at wor...

WMIcmd

The problem When doing low impact investigations and other similar activities you may want to minimize what is written to disk / obvious. This tool allows us to execute commands via WMI and get information not otherwise available via this channel. Purpose A small utility which only uses WMI to...

through_the_wire

Through the Wire Through the Wire は、CVE-2022-26134 の Proof of Concept エクスプロイトです。この脆弱性は、Atlassian Confluence Server および Data Center のバージョン = 7.13.6 LTS と = 7.18.0 "Latest" に影響する OGNL インジェクションの脆弱性です。これは元々、実環境で悪用されたゼロデイでした。 ベンダー勧告 Volexity の「in-the-wild」に関する分析記事 Rapid7 の分析記事 Through the Wire...

R4venzCl4w

R4venzCl4w ◣◢ノ-=≡≡卍 Un marco modular para Pentesters y Bug Hunters escrito en Python3. Tabla de Contenidos R4venzCl4w ◣◢ノ-=≡≡卍 Tecnologías y Herramientas Requisitos Características Implementación de Características Instalación Configuración Uso Opciones Ejemplo Pendientes Contribuciones Licencia ...

dnscat2

NOTE: The password for the .zip downloads are all "password"! Introduction Welcome to dnscat2, a DNS tunnel that WON'T make you sick and kill you! This tool is designed to create an encrypted command-and-control C&C channel over the DNS protocol, which is an effective tunnel out of almost every...

payloadgenerator

PGen PGen es una herramienta escrita en Bash para generar los payloads de Meterpreter más comunes a través de MSFvenom, parte del framework Metasploit. Acerca de PGen es un envoltorio alrededor de MSFvenom que proporciona una experiencia más amigable para generar múltiples tipos de payloads...

ThePhish

ThePhish ThePhish es una herramienta automatizada de análisis de correos electrónicos de phishing basada en TheHive, Cortex y MISP. Es una aplicación web escrita en Python 3 y basada en Flask que automatiza todo el proceso de análisis, desde la extracción de los observables del encabezado y el...