ratched

ratched ratched is a Man-in-the-Middle MitM proxy that specifically intercepts TLS connections. It is intended to be used in conjunction with the Linux iptabes REDIRECT target; all connections that should be intercepted can be redirected to the local ratched port. Through the SOORIGINALDST sockop...

httplab

The interactive web server. HTTPLabs let you inspect HTTP requests and forge responses. Install Golang root@kitploit: go install github.com/gchaincl/httplab/cmd/httplab@latest Archlinux root@kitploit: yaourt httplab...

jwt_tool

El kit de herramientas JSON Web Token v2 jwttool.py es un kit de herramientas para validar, forjar, escanear y manipular JWTs JSON Web Tokens. Su funcionalidad incluye: Comprobar la validez de un token Probar exploits conocidos: CVE-2015-2951 La vulnerabilidad de omisión de firma alg=none...

scapy

Scapy Scapy 是一个基于 Python 的强大交互式数据包操作程序与库。 它能够伪造或解码大量协议的数据包，在网络上发送、捕获，使用 pcap 文件存储或读取，匹配请求与回复，以及更多功能。它设计为通过使用可工作的默认值来实现快速数据包原型开发。 它可以轻松处理大多数经典任务，例如扫描、路由追踪、探测、单元测试、攻击或网络发现（它可以替代 hping、85% 的 、、、、、、 等）。它还在许多其他特定任务中表现出色，而这些任务大多数其他工具无法处理，例如发送无效帧、注入自定义的 802.11 帧、组合技术（VLAN 跳跃 + ARP 缓存中毒、WEP 保护通道上的 VoIP...

CVE-2026-87859

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote attacker can exploit this vulnerability by injecting an unescaped double quote into a log field they control, such as the User-Agent or Referer header. This causes the log field to close...

CVE-2026-23003-Cross-Chain-Bridge-Message-Forging-via-Missing-Origin-Chain-ID

CVE-2026-23003 – Falsificación de mensajes de puente entre cadenas por ID de cadena de origen ausente Código del programa Solidity + exploit de Python root@kitploit: // Bridge.sol - Vulnerable bridge contract contract Bridge mappingbytes32 = bool public processed; event Depositedaddress from,...

CVE-2026-18963

CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector https://github.com/user-attachments/assets/005fab89-339a-4e4e-881c-da6a626f6c9e root@kitploit: python3 kc-resetforge.py -h usage: kc-resetforge.py -h --target TARGET --targets-file TARGETSFILE --port PORT --realm REALM --client-id...

ClaimJumper

root@kitploit: / | | | | | | | | | | | | | |/ | | ' \ | | | | | ' | ' \ / \ '| | || | | | | | | | | || | || | | | | | | | | / | ||,||| || ||/ |,|| || || ./ || |/ | | || v0.1.0 Professional JWT security testing toolkit. Analyze, crack, forge, and exploit JSON Web Tokens with 15+ vulnerability...

CVE-2026-85544

There is an Improper Encryption Configuration Vulnerability in some Hikvision Intercom Products. This could allow attackers to forge M1 cards...

CVE-2024-3408-dtale

CVE-2024-3408 - Omisión de autenticación y RCE en D-Tale Entorno de laboratorio reproducible para CVE-2024-3408, una vulnerabilidad de omisión de autenticación y ejecución remota de código en D-Tale. Vulnerabilidad Las versiones de D-Tale hasta la 3.15.1 son vulnerables debido a: 1. SECRETKEY...

cs50-cyber-paloalto-oauth

CS50 网络安全期末项目 标题： Salesloft OAuth 漏洞利用与 CVE-2024-3400（影响 Palo Alto） 作者： Yafiya Darwesh（GitHub：Yafiah-Darwesh） YouTube 视频： https://youtu.be/CxQNj9qWoZ0?si=cHCwuTIY26YHJ8aw CVE： CVE-2024-3400 文件 presentation.pdf — 幻灯片 script.txt — 演讲笔记 摘要 简短说明：配置错误的 OAuth 令牌验证导致令牌伪造和跨 OAuth 集成的未授权访问（影响 Palo...

EUVD-2026-67720

morgan vulnerable to Log Forging via unescaped Unicode line separators...

morgan vulnerable to Log Forging via unescaped Unicode line separators

Impact Morgan writes attacker-controlled request data to the access log through its tokens. The 1.11.0 fix neutralizes C0 control characters, DEL, and backslash, but it does not escape the Unicode line separators U+0085 NEL, U+2028 LINE SEPARATOR, or U+2029 PARAGRAPH SEPARATOR. These code points...

CVE-2026-0257

CVE-2026-0257 PAN-OS GlobalProtect 身份验证绕过漏洞 ⚡ 简单用法 仅在安全且授权的环境中使用本项目，例如： 本地虚拟机 Docker 容器 隔离实验环境 授权的渗透测试环境 示例设置： root@kitploit: git clone https://github.com/HORKimhab/CVE-2026-0257 cd CVE-2026-0257 Create virtual environment python -m venv venv Active virtual environment Linux / macOS: source...

CVE-2026-45156-POC

黑客矩阵故障 🚨 CVE-2026-45156 🚨 Nextcloud useroidc ID4me JWT 签名绕过 用于管理员接管的全自动概念验证（PoC）利用程序。 📖 故事背后 每一个 CVE 背后都有一个故事。这个漏洞是在一个寒冷的冬夜凌晨 2 点发现的，伴随着分手混音单曲循环。阅读完整的技术深度剖析、情感过山车以及零信任经验教训： 🔗 阅读完整博客文章 （链接你的博客文章） 🎯 漏洞概述 在处理从 ID4me 身份提供商接收的 JWT 令牌时，Nextcloud 的 useroidc 应用使用 base64decode 处理令牌载荷，而未验证加密签名。 🔥...

EUVD-2026-70668

Peppermint through 0.5.5 contains a hardcoded JWT signing secret in docker-compose.yml that allows unauthenticated attackers to forge session tokens for any account. Attackers can use the published secret to mint valid tokens for arbitrary user IDs and access protected endpoints without credentia...

CVE-2026-85175 SiYuan before v3.8.2 TLS Private Key Disclosure via getFile

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-85175 SiYuan before v3.8.2 TLS Private Key Disclosure via getFile

SiYuan versions = 3.8.1 fixed in v3.8.2 contain an incomplete blocklist in the IsForbiddenAbsPath function kernel/util/pathguard.go, which only blocks conf/conf.json by exact match and does not restrict the TLS private key conf/key.pem or CA private key conf/ca.key stored in the same conf/...

CVE-2026-15603

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote client can inject specific Unicode line separator characters into log token values. This manipulation can cause downstream log processing systems to misinterpret a single log entry as multiple...

EUVD-2026-68133

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.4.6. This is due to the mosamlloginvalidate ACS handler persisting the X.509 certificate extracted from an incoming SAMLResponse into the mosamlrequiredcertificate...