CVE-2022-40317

CVE-2022-40317 XSS almacenado en Notas Se encontró un XSS almacenado en la sección de notas de la aplicación mientras pentesteábamos un cliente que usaba OpenKM. Básicamente, al almacenar notas, de alguna manera se permitía HTML normal y se renderizaba tal cual. Como saben, las etiquetas Sin...

distributed-system-testing

Distributed Systems Testing Skills Two skills for AI coding agents that design and run claim-driven tests for distributed and stateful systems. Together they produce a structured Markdown test plan and a findings report with 10-state verdicts and an explicit SUT / harness / checker / environment...

quick-fix-cve-2024-38063

quick-fix-cve-2024-38063 Script rápido de PowerShell para corregir cve-2024-38063 Donación Si quieres apoyar mi trabajo, puedes donarme en la siguiente dirección de Monero: root@kitploit: 4B9WQivaHfd3miDfPKEfCianocGpBx9d8FXycz2vmNW3aBDVKHgkBd9Gmapt4RBVEpTwnehujsiUBBehUiLvnEHs7VFstCC O usando...

clickfix-simulator-2025

ClickFix Training Tool A lightweight, self-hosted simulation tool for "ClickFix" type social engineering attacks. Disclaimer This tool is for AUTHORIZED SECURITY AWARENESS TRAINING ONLY. Unauthorized use of this tool to target systems or users without explicit permission is illegal and unethical...

dorkish

Dorkish During reconaissance phase or when doing OSINT , we often use google dorking and shodan and thus the idea of Dorkish. Dorkish is a Chrome extension tool that facilitates custom dork creation for Google and Shodan using the builder and it offers prebuilt dorks for efficient reconnaissance...

IronFox

IronFox Código QR de F-Droid: IronFox es una bifurcación del Mull Browser de Divested Computing Group, basado en Mozilla Firefox. Nuestro objetivo es continuar el legado de Mull proporcionando un navegador web gratuito y de código abierto, orientado a la privacidad y la seguridad, para uso diario...

bad-epoll

Bad Epoll: The bug missed by Mythos An unprivileged process escalating to root on Google kernelCTF. Bad Epoll CVE-2026-46242 is a race-condition use-after-free in the Linux kernel's epoll subsystem. This bug lets an unprivileged process become root, not only on Linux desktops and servers but also...

Vision-MSI-Thermal-Control

Vision MSI Thermal Control MSI Modern 15H AI C1MG-096IT Linux thermal management - Control EC de ingeniería inversa con perfiles de ventilador y umbral de batería 🎯 Propósito de este Proyecto Esta aplicación nació de la necesidad de los usuarios de portátiles MSI en Linux. El viaje comenzó cuando...

netwatch

NetWatch A network monitor for the terminal that helps identify the process behind connections, reads TLS you hold the keys to, and tells you what is wrong and how to fix it...

sx

sx is the command-line network scanner designed to follow the UNIX philosophy. The goal of this project is to create the fastest network scanner with clean and simple code. 📖 Table of Contents Features Install Build from source Quick Start References Contributing Credits License ✨ Features ⚡ 30x...

cip-security-poc

cip-security-poc — proving the fix principle behind CVE-2021-22681 not just its flaw Six runnable scripts — real EtherNet/IP protocol traffic Test 1, real TLS/PKI mechanics Tests 3–6 — zero Rockwell software or licensing anywhere in the chain. Built to test a claim before writing it up, not to...

github-endpoints

github-endpoints Find endpoints on GitHub. Description This Go tool performs searches on GitHub and parses the results to find endpoints of a given domain. Install root@kitploit: go install github.com/gwen001/github-endpoints@latest or root@kitploit: git clone...

fusionauth-samlv2

fusionauth-samlv2 This repository is SAML v2.0 bindings in Java using JAXB. You'd use this library to process SAML requests and responses. See the tests for example code. Security disclosures If you find a vulnerability or other security related bug, please report the vulnerability here before...

Important: Red Hat Security Advisory: postgresql:18 security update

An update for the postgresql:18 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

linset

Linset Is Not a Social Enginering Tool First of all, commented that this is a project for educational purposes that have served to me and hopefully others to be more in touch with the world of programming and Wireless. It is prohibited under any circumstances the use this tool in foregin Wireless...

EUVD-2026-80330

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-59739 Apache ZooKeeper: Information disclosure via SetWatches reconnect replay

Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registering exists-watches on non-existent paths, then reconnecting after the paths are created with restricted ACLs. Issue is caused by incomplete...

CVE-2026-59739

Apache ZooKeeper has an information disclosure vulnerability in the DataTree.setWatches() reconnect replay handler (SetWatches/SetWatches2). This is an incomplete fix for CVE-2024-23944 (ZOOKEEPER-4799): the prior patch added an ACL check in WatchManager.triggerWatch(), but DataTree.setWatches() ...

copy-fail-zig

Copy Fail CVE-2026-31431 Zig implementation Zig implementation of the 732 Byte proof of concept for the Copy Fail Linux LPE CVE-2026-31431, which was disclosed by Theori / Xint on April 29th 2026 The writeup can be found at copy.fail. This implementation has no runtime dependencies and can be run...

subdomain3

Subdomain3 README.md inChinese 中文 Description Subdomain3 is a new generation of tool , It helps penetration testers to discover more information in a shorter time than other tools.The information includes subdomains, IP, CDN, and so on. Please enjoy it. Screenshot medium pattern for speed Feature...