titus

Titus: High-Performance Secrets Scanner Titus is a high-performance secrets scanner that detects credentials, API keys, and tokens in source code, files, and git history. It ships with 487 detection rules covering hundreds of services and credential types, drawn from NoseyParker and Kingfisher...

miasm

What is Miasm? Miasm is a free and open source GPLv2 reverse engineering framework. Miasm aims to analyze / modify / generate binary programs. Here is a non exhaustive list of features: Opening / modifying / generating PE / ELF 32 / 64 LE / BE Assembling / Disassembling X86 / ARM / MIPS / SH4 /...

n8n-CVE-2025-68613-exploit

n8n - CVE-2025-68613: Improper Control of Dynamically-Managed Code Resources Vulnerability n8n contains a critical Arbitrary Code Execution vulnerability in its workflow expression evaluation system. Under certain conditions, expressions supplied by authenticated users during workflow configurati...

CVE-2022-26134

CVE-2022-26134 Confluence OGNL expression injected RCECVE-2022-26134 poc and exp Update Add sandbox bypass, high version supported. Usage root@kitploit: Usage: python Confluencecve202226134RCE.py http://example.com/ The script will auto check target is vulnerable, and enter a pseudo-interactive...

CVE-2018-1273

CVE-2018-1273 Environment for CVE-2018-1273 CVE-2018-1273: RCE with Spring Data Commons https://pivotal.io/security/cve-2018-1273 Application https://github.com/spring-projects/spring-data-examples/tree/master/web/example Build root@kitploit: $ docker build -t cve-2018-1273 . Run root@kitploit: $...

octoscan

:octocat: octoscan Octoscan is a static vulnerability scanner for GitHub action workflows. Table of Contents Table of Contents Installation Usage download remote workflows analyze GitHub action Rules dangerous-checkout dangerous-action dangerous-write expression-injection runner-label repo-jackin...

CVE-2026-1731

CVE-2026-1731 BeyondTrust Remote Support Pre-Auth RCE PoC !WARNING This script is intended for educational and research purposes only. Do not use it against systems without explicit permission. Unauthorized access or testing is illegal and unethical. Read the full DISCLAIMER before using this...

cve-2022-22947

cve-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier contain a SpEL expression injection vulnerability. When an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Usage: root@kitploit:...

PoC-CVE-2025-25200

CVE-2025-25200 Context Vulnerability: CVE-2025-25200 Type: Regular Expression Denial of Service ReDoS Component: Kao = 2.0.0, = 3.0.0-alpha.0, = 1.0.0, 1.7.1, 0.21.2 Description: This vulnerability presents quadratic time complexity On² or, in more critical scenarios, exponential O2ⁿ, meaning the...

CVE-2025-68613

CVE-2025-68613 — n8n RCE via Expression Injection For educational and authorized security research purposes only. Overview Critical RCE vulnerability CVSS 9.9 in n8n workflow automation platform. Authenticated users can execute arbitrary OS commands via the executeCommand node, bypassing sandbox...

n8n-exploit-CVE-2025-68613-n8n-God-Mode-Ultimate

n8n God Mode Ultimate - CVE-2025-68613 Scanner & Exploitation Framework Advanced n8n Workflow Automation RCE Scanner & Exploitation Tool 🎯 Overview n8n God Mode Ultimate is a comprehensive security testing framework designed to detect and validate CVE-2025-68613 in n8n workflow automation...

jsfinder

Features | Installation | Usage | Demo | TODOs| Contact jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the UR...

CVE-2022-22963

CVE-2022-22963 Spring Cloud Function SpEL Expression Injection Remote Code Execution Vulnerability Detection and Exploitation Tool. Vulnerability Overview CVE-2022-22963 is a high-severity RCE vulnerability CVSS 9.8 in the routing functionality of Spring Cloud Function. When the application enabl...

CVE-2025-41243-Vulnerability-Lab

CVE-2025-41243: Spring Cloud Gateway RCE Lab Vulnerability Description Spring Cloud Gateway has a SpEL expression injection vulnerability. When the Actuator endpoint is enabled, an attacker can achieve remote code execution RCE. How to Start docker-compose up -d Reproduction 1. Access...

CoBRA

CoBRA Co efficient-B ased R econstruction of A rithmetic — a Mixed Boolean-Arithmetic expression simplifier. CoBRA deobfuscates expressions that interleave arithmetic +, -, with bitwise &, |, ^, and shift , operators — a technique commonly used in software obfuscation...

EXPLOIT-CVE-2021-44228

CVE-2021-44228 — Log4Shell PoC Lab DISCLAIMER This lab was created exclusively for educational and security research purposes. All traffic occurs within an isolated Docker network. Do not use this material on real systems or without explicit authorization. Misuse may be a crime. Use responsibly...

cve-2022-42889-text4shell

安装Maven - maven-linux 1. 安装Maven以创建fat jar root@kitploit: mvn clean install 2. Docker构建 root@kitploit: docker build --tag=text4shell . 3. Docker运行 root@kitploit: docker run -p 80:8080 text4shell 4. 测试应用 root@kitploit: http://localhost/text4shell/attack?search= 5...

CVE-2018-1270

CVE-2018-1270 CVE-2018-1270 Expression RCE Environment...

CVE-2026-21858-and-CVE-2025-68613

Ni8mare: n8n Pre-Auth RCE CVE-2026-21858 & CVE-2025-68613 — 脆弱性ラボ & PoC レポート Ni8mare 脆弱性チェーンの実践環境（Vulnerable Lab）と詳細なエクスプロイト分析レポートです。n8n プラットフォーム上で、Arbitrary File Read （CVE-2026-21858）から Remote Code Execution （CVE-2025-68613）まで、認証なしで攻撃可能です。 詳細な分析・エクスプロイトレポート 完全な分析資料と、各ステップを図解した PoC...

CVE-2022-1015

CVE-2022-1015 Root Cause In the nftparseregister function, because there is no validation when the arg defaults, an out-of-bounds OOB occurs on the stack of the nftdochain function. At this point, using the payload expression allows both read and write. The payload operates as follows: That is, b...