HTMLawed

HTMLawed is ... ... a single-file, 45 kb PHP script that makes input text more secure, HTML standards-compliant, and suitable in general from the viewpoint of a web-page administrator, for use in the body of HTML, XHTML or XML documents. A simple HTMLTidy alternative, the htmLawed filter,...

pecli

PEcli Tool to analyze PE files in python 3. Current features : Show information about the file import, exports, resources Search for interesting information in the file abnormal resources, peid... Dump sections or resources Check size Search for a string in the file Installation You can install i...

CVE-2024-23334

CVE-2024-23334 PoC Description This repository contains a Proof of Concept PoC for CVE-2024-23334, demonstrating how malicious actors can exploit vulnerabilities in aiohttp using LFI . !CAUTION Disclaimer: IMPORTANT: This PoC is for educational purposes only. Unauthorized access to computer syste...

reverse-ssh

ReverseSSH A statically-linked ssh server with a reverse connection feature for simple yet powerful remote access. Most useful during HackTheBox challenges, CTFs or similar. Has been developed and was extensively used during OSCP exam preparation. Get the latest Release Features Catching a revers...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

ssh-auditor

SSH Auditor Features ssh-auditor will automatically: Re-check all known hosts as new credentials are added. It will only check the new credentials. Queue a full credential scan on any new host discovered. Queue a full credential scan on any known host whose ssh version or key fingerprint changes...

CVE-2025-4603

eMagicOne Store Manager for WooCommerce = 1.2.5 - Unauthenticated Arbitrary File Deletion The eMagicOne Store Manager for WooCommerce plugin exposes a remote management protocol endpoint ?connector=bridge that allows file deletion operations on the server. The authentication mechanism relies on a...

domhttpx

domhttpx is a google search engine dorker with HTTP toolkit built with python, can make it easier for you to find many URLs/IPs at once with fast time. List Install Usage Flags Basic Usage One Keyword Multiple Keyword Extract Title Page Extract Title Page from Real Path Extract Status Code Extrac...

lst2x64dbg

lst2x64dbg This command extracts all the labels found in the LST file that is given as the single argument. An x64dbg database is created in the current directory based on the extracted labels. The LST file can be generated in IDA from the File menu: Produce file - Create LST file... Example $...

SSMA

SSMA SSMA is a simple malware analyzer written in Python 3. Features: Analyze PE file's header and sections number of sections, entropy of sections/PE file, suspicious section names, suspicious flags in the characteristics of the PE file, etc. Analyze ELF file for Linux malware analysis, it uses...

rizin

Rizin Rizin est un framework de rétro-ingénierie, né d'un fork de radare2, axé sur l'ergonomie, les fonctionnalités et la propreté du code. Rizin est portable et peut être utilisé pour analyser des binaires, désassembler du code, déboguer des programmes, comme outil forensique, comme éditeur...

cve-2022-44268

Exploit tailored for HackTheBox Pilgrimage Automatic python script using cve-2022-44268 to add a profile value with a filename from a input filelist in an input file, update the image file upload using a input request.req file from Burpsuite already included of the file upload uploading each...

day05-grafana-sqlexpr-lab

Day 5 – Grafana SQL Expressions → DuckDB LFI CVE-2024-9264 TL;DR: On affected Grafana 11.x builds, a logged-in Viewer can use SQL Expressions. Grafana forwards the expression to DuckDB on the server. With readtext / readblob, you can read local files LFI. We plant a flag at /opt/flag.txt. Build →...

CVE-2017-5638-PoC

CVE-2017-5638 Apache Struts 2 RCE Proof of Concept This repository contains a Proof of Concept PoC script demonstrating the Remote Code Execution RCE vulnerability identified as CVE-2017-5638 in Apache Struts 2. Vulnerability Details CVE ID: CVE-2017-5638 Affected Software: Apache Struts 2 versio...

Zip-Cracker-

Zip Cracker This Script Supports Only Zip File in This Verson You Can Also Use This Script With crunch Cross-platform Supported Usage: zipcracker.py options Options: --version show program's version number and exit -h, --help show this help message and exit -f FILENAME, --file=FILENAME Please...

CVE-2024-2053

LFI to RCE Exploit via Log Poisoning Python3 exploit for CVE-2024-2053 Artica Proxy 📝 Description This Python3 script exploits Local File Inclusion LFI vulnerabilities to achieve Remote Code Execution RCE through log poisoning techniques. Specifically designed for Artica Proxy CVE-2024-2053 but...

CVE-2022-30190

CVE-2022-30190 IMPORTANT Patched as of: June 14th 2022 Security updates CVE Report HTML file must be served to target exaple exploit.html An easy way to run the attack is by running server.py...

cve-2021-42013-docker-lab

CVE-2021-42013 Introduction It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not...

whatfiles

whatfiles Whatfiles एक Linux उपयोगिता है जो लॉग करती है कि कोई अन्य प्रोग्राम आपके सिस्टम पर कौन सी फ़ाइलें पढ़ता/लिखता/बनाता/हटाता है। यह लक्षित प्रक्रिया द्वारा बनाए गए किसी भी नए प्रोसेस और थ्रेड का भी पता लगाती है, और रिकॉर्ड करती है कि प्रत्येक ऑपरेशन सफल हुआ या नहीं। तर्क: मैं लंबे समय से इ...

BIT-GHOST-2026-104411 Ghost 6.22.1 before 6.64.0 Stored XSS via Local Storage File Uploads

Ghost from 6.22.1 before 6.64.0 contains a stored cross-site scripting vulnerability that allows staff users to host scripts by uploading files served with extension-derived content types on the default local storage adapter. Attackers can upload script-bearing files to the site's domain to...