CVE-2018-4878

CVE-2018-4878 Samples Sample source: https://github.com/brianwrf/CVE-2017-4878-Samples Analysis report: http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html Exploit source in Python script: https://github.com/vysec/CVE-2018-4878 cve-2018-4878.py is the exploit generation script, the...

redis-post-exploitation

redis-post-exploitation For educational purposes only Reference https://2018.zeronights.ru/wp-content/uploads/materials/15-redis-post-exploitation.pdf https://paper.seebug.org/975/ Rogue Server https://github.com/knqyf263/redis-rogue-server Build $ docker-compose build Run $ docker-compose up -d ...

postshell

PostShell PostShell is a post-exploitation shell that includes both a bind and a back connect shell. It creates a fully interactive TTY which allows for job control. The stub size is around 14kb and can be compiled on any Unix like system. ScreenShots Banner and interaction with shell after a...

ibombshell

ibombshell - Dynamic Remote Shell ,--.!, / -- / / / // / / / / ,d08b. '| / / / / / \ / / / / / 0088MM / / // / // / / / / / / // // / / / / / / / 9MMP' ///// // //./// ///// + Starting the console... Console ready! ibombshell is a tool written in Powershell that allows you to have a prompt...

CVE-2019-14287

CVE-2019-14287 A script to check for the sudo security bypass CVE-2019-14287. This script checks for a vulnerable sudo version and tries to exploit it. It can run alone or can be integrated into a enumeration scanner like LinEnum.sh...

openclaw-vuln-report

OpenClaw Vulnerability Analysis Report Chinese Interpretation of Security Vulnerability CVE-2026-25253 Read Online GitHub Pages: https://joseph19820124.github.io/openclaw-vuln-report/ Vulnerability Summary CVE : CVE-2026-25253 Score : CVSS 8.8 High Type : Cross-Site WebSocket Hijacking Impact :...

CVE-2021-44228-POC

CVE-2021-44228-POC exploit CVE-2021-44228 download nuclei sudo cp nuclei /usr/bin/nuclei sudo chmod +x /usr/bin/nuclei git clone https://github.com/sec13b/CVE-2021-44228-POC.git mv CVE-2021-44228-POC log4shellexploit mkdir yaml mv .yaml yaml/ run: python3 log4shellexploit.py http://iptoexploit...

SILENTTRINITY

SILENTTRINITY SILENTTRINITY is modern, asynchronous, multiplayer & multiserver C2/post-exploitation framework powered by Python 3 and .NETs DLR. It's the culmination of an extensive amount of research into using embedded third-party .NET scripting languages to dynamically call .NET API's, a...

HiveJack

HiveJack This tool can be used during internal penetration testing to dump Windows credentials from an already-compromised host. It allows one to dump SYSTEM, SECURITY and SAM registry hives and once copied to the attacker machines provides an option to delete these files to clear the trace. Ofte...

HIKRAVEN

HIKRAVEN 🛡️ Advanced Hikvision Security Assessment Platform - Professional Edition Features • Quick Start • Installation • Usage • Documentation • Disclaimer ⚠️ IMPORTANT LEGAL NOTICE ! THIS TOOL IS FOR AUTHORIZED SECURITY TESTING ONLY ! Unauthorized access to computer systems is illegal and...

WEF

WiFi Exploitation Framework Coded with 💙 by D3Ext Introduction • Attacks • Features • Installation • Usage README in spanish Introduction This tool is designed for security researchers and penetration testers to analyze and exploit vulnerabilities in Wi-Fi networks. It provides an intuitive...

Presentations

Presentations Presentation| Slides| Video ---|---|--- BlueHat IL 2020 - Trinity: PSP Emulator Escape| 2020-BlueHatIL-Trinity.pdf| https://www.youtube.com/watch?v=J0OQsDTyAL8 Hardwear.io USA 2022 - bd-jb: Blu-ray Disc Java Sandbox Escape| 2022-hardwear-io-bd-jb.pdf|...

SharpShares

SharpShares Multithreaded C .NET Assembly to enumerate accessible network shares in a domain Built upon djhohnstein's SharpShares project .\SharpShares.exe help Usage: SharpShares.exe /threads:50 /ldap:servers /ou:"OU=Special Servers,DC=example,DC=local" /filter:SYSVOL,NETLOGON,IPC$,PRINT$ /verbo...

XSRFProbe

XSRFProbe The Prime Cross Site Request Forgery Audit & Exploitation Toolkit. -blue.svg About XSRFProbe is an advanced Cross Site Request Forgery CSRF/XSRF Audit and Exploitation Toolkit. Equipped with a powerful crawling engine and numerous systematic checks, it is able to detect most cases of CS...

challenges

Hex Advent CTF WELCOME TO HEX ADVENT 2025, ‘tis the season to Unwrap Your Potential! 🎁 HEX ADVENT 2025 is a Christmas-themed CTF Advent Calendar, designed for women, by women. 12 Days, 12 Challenges: A structured schedule to build mastery across different CTF categories. Focus Areas - Pwn Binary...

log4shell_1.x

Log4jShell1.x Log4j RCE 1.x Poc Attack Restriction 1. The target has jms environment 2. You need to gain access to modify the log4j.properties file Conclusion Not as useful as log4shell 2.x Log4shell Topic https://github.com/cckuailong/reapoc/tree/main/Topic/Log4j Welcome to contribute in reapoc...

expluatation_CVE-2022-29078

This repository does not have a README...

hekate

Hekate - A VMWare Workspace ONE Access Remote Code Execution Exploit Steven Seeley of Qihoo 360 Vulnerability Research Institute Original rogue MySQL server by LandGrey Details Hekate is pronounced as heh-ka-teh Date: Tue Feb 22 13:37:00 CST 2022 Version: 21.08.0.1 latest File:...

ChromSploit-Framework

ChromSploit Framework v3.0 Professional Security Research Platform for Browser Vulnerability Analysis Multi-CVE exploitation chains with advanced obfuscation, intelligent detection, and comprehensive analytics Overview ChromSploit Framework is a cutting-edge educational security research tool...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...