KITT

KITT 2.0 Penetration Testing Framework The KITT Penetration Testing Framework was developed as an open source solution for pentesters and programmers alike to compile the tools they use with what they know into an open source project. With KITT, users are able to easily access a list of commonly...

Security Bulletin: Maximo AI Service uses perl 0:5.32.1-481.1.el9_6 which is vulnerable to CVE-2023-47038 and CVE-2025-40909.

Summary Maximo AI Service uses perl 0:5.32.1-481.1.el96 which is vulnerable to CVE-2023-47038 and CVE-2025-40909. This bulletin contains information regarding the vulnerability and its fix. Vulnerability Details CVEID:CVE-2023-47038 DESCRIPTION: A vulnerability was found in perl 5.30.0 through...

PiFinger

root@kitploit: | \ | | | | | | | | .--. .--./ .---. .--. | / | | | | .-. | / /';/ /\ /'\ | | | | | | | | | | | | \ .//| ., | | || || ||.', '..' --- Just for fun and security...

vamp-forticheck

vamp-forticheck Multi-Vendor Edge Device CVE Scanner — VampSecure Labs Overview vamp-forticheck is an asynchronous, non-destructive security scanner that detects CVE vulnerabilities across seven major network security vendors. It performs a structured three-phase analysis: 1. Passive detection —...

CVE-2025-46295-fix-fms

FileMaker Apache Commons JAR Replacer Overview The FileMaker Apache Commons JAR Replacer is an automation solution that addresses CVE-2025-46295 by replacing vulnerable Apache Commons JAR files in FileMaker Server installations. Instead of upgrading the entire FileMaker Server, this solution...

NodeSecurityShield

Node Security Shield Node Security Shield NSS is an Open source Runtime Application Self-Protection RASP tool which aims at bridging the gap for comprehensive NodeJS security by enabling Developer and Security Engineer to declare what resources an application can access. Inspired by the Log4Shell...

stegseek

⚡ Stegseek Stegseek is a lightning fast steghide cracker that can be used to extract hidden data from files. It is built as a fork of the original steghide project and, as a result, it is thousands of times faster than other crackers and can run through the entirety of rockyou.txt in under 2...

godehashed

Godehashed A golang tool that uses the dehashed.com API to search for compromised assets. Results can then be compiled into a CSV for further analysis. Screenshot Dehashed API You must supply the tool an api key. See apikeytemplate.txt for example. Installation To install the tool in CLI run the...

godehashed

Godehashed Una herramienta en golang que utiliza la API de dehashed.com para buscar activos comprometidos. Los resultados se pueden compilar en un CSV para su posterior análisis. Captura de pantalla Dehashed API Debes proporcionar una clave API a la herramienta. Consulta apikeytemplate.txt como...

XSS2Shell

XSS2Shell ULTIMATE v3.0 WordPress Pre-Auth XSS → RCE Chain Exploit Developed by G0D150NE 📌 Features 🔍 Auto-detect XSS & WordPress version 🎯 3 Modes: Auto, XSS, Direct 📡 Callback server to capture credentials 🐚 WebShell with multiple execution methods 🔄 Persistence cron job, hidden admin,...

CVE-2022-21587-POC

CVE-2022-21587-POC- CVE-2022-21587 POC root@kitploit: file exploit.py will overwrite to file .pl not recommended for use, will affect the system file EBS not overwrite, will create a new shell file install slipit: git clone https://github.com/usdAG/slipit root@kitploit: cd slipit python3 setup.py...

send

Send A fork of Mozilla's Firefox Send. Mozilla discontinued Send, this fork is a community effort to keep the project up-to-date and alive. Forked at Mozilla's last publicly hosted version Mozilla & Firefox branding is removed so you can legally self-host Kept compatible with ffsend CLI for Send...

CVE-2023-43872-CMSmadesimple-Arbitrary-File-Upload--XSS---File-Manager

CMSmadesimple File Upload - XSS v2.2.18 Author: Sergio Description: File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden XSS. Attack Vectors: A vulnerability in File Manager file upload sanitation allows you to upload a PDF file with hidden...

CVE-2016-10956-mail-masta

Mail Masta - Local File Read CVE-2016-10956 The mail-masta plugin 1.0 for WordPress has local file read in countofsend.php and csvexport.php. Usage root@kitploit: $ ./CVE-2016-10956mailmasta.py -h + Mail Masta - Local File Read CVE-2016-10956 usage: CVE-2016-10956mailmasta.py -h -v -s -t TARGETUR...

cve-2020-5902-ioc-bigip-checker

CVE-2020-5902 Herramienta de Detección de IoC Este script está diseñado para ser ejecutado localmente en un F5 BIG-IP en Advanced Shell bash por un usuario con privilegios de root; no está diseñado para ser ejecutado en ningún otro entorno. Nota: El modo Appliance no permite el acceso a Advanced...

cve-lfi-lab

🧠 CVE Lab: Tier 1 SOC Analyst Simulation CVE-2025-39507 | Local File Inclusion in WordPress Nasa Core Plugin 📝 Scenario: A Day in the SOC It’s a regular Monday. I’m logged into the SOC dashboard, reviewing alerts like usual. One comes in that catches my eye: ALERT: Possible Local File Inclusion L...

BigFinger

CVE-2023-46747 - Big-IP RCE No autenticado Este es un script de Python3 para explotar la vulnerabilidad de ejecución remota de código no autenticado CVE-2023-46747 en dispositivos F5 BIG-IP a través de la interfaz TMUI. Básicamente, si esta vulnerabilidad impacta, obtienes una shell sin...

CVE-2021-40444

CVE-2021-40444 PoC Malicious docx generator to exploit CVE-2021-40444 Microsoft Office Word Remote Code Execution Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 docx file You need to...

cdpsnarf

CDPSnarf v0.1.6 Cisco Discovery Protocol Sniffer by Tasos "Zapotek" Laskos [email protected] [email protected] root@kitploit: Licensed under the GNU General Public License v2 General root@kitploit: CDPSnarf is a network sniffer exclusively written to extract information from CDP packets...

OSTE-Web-Log-Analyzer

OSTE-Web-Log-Analyzer Automate the process of analyzing web server logs with the Python Web Log Analyzer. This powerful tool is designed to enhance security by identifying and detecting various types of cyber attacks within your server logs. Stay ahead of potential threats with features that...