joro

Joro A web exploitation framework for offensive security professionals. Intercepting proxy, blind vulnerability detection, web shell generation, C2 integration, and collaboration tools in a single binary with an embedded web UI. Warning: This tool is intended for authorized penetration testing an...

qub-network-security-cve-2023-20198

🛡️ qub-network-security-cve-2023-20198 Analysis, detection, and mitigation of CVE-2023-20198 exploitation in Cisco IOS XE 📘 Queen’s University Belfast – CSC3064 Network Security Assessment 📋 Assessment Overview This project involves analyzing PCAP files provided by Fox-IT to: Identify Indicators o...

SpoofcheckSelfTest

SpoofCheck Self Test Web application that lets you test if your domain is vulnerable to email spoofing. NOTE: This application is still in development. Installation: This application is designed to be used as a service. However, if you want to host this yourself, do the following: git clone...

aimap

AIMap Internet-scale discovery and security testing platform for exposed AI agent infrastructure. AIMap finds, fingerprints, and security-tests publicly exposed AI endpoints — MCP servers, Ollama instances, vLLM/LiteLLM proxies, LangServe chains, Gradio apps, ComfyUI nodes, and more. Think Shodan...

raink

Use LLMs for document ranking. Description There's power in AI in that you can "throw a problem at it" and get some result, without even fully defining the problem. For example, give it a bunch of code diffs and a security advisory, and ask, "Which of these diffs seems most likely to fix the...

You-re-Doing-IoT-RNG

You're Doing IoT RNG This repository contains our results and also the device code used to generate the random numbers across several devices. For a more complete explanation of the vulnerabilities and issues, check out our DEF CON 21 talk here: https://www.youtube.com/watch?v=Zuqw0-jZh9Y Or if y...

dissect

dissect Dissect est un framework et un ensemble d'outils de criminalistique numérique et de réponse aux incidents qui vous permet d'accéder rapidement et d'analyser des artefacts forensiques provenant de divers formats de disques et de fichiers, développé par Fox-IT partie de NCC Group. Ce projet...

eyeballer

Eyeballer Jetez un coup d'œil rapide à vos captures d'écran. Eyeballer est conçu pour les tests de pénétration réseau à grande échelle où vous devez trouver des cibles « intéressantes » parmi un vaste ensemble d'hôtes web. Utilisez votre outil de capture d'écran préféré comme d'habitude EyeWitnes...

zigdiggity

ZigDiggity Version 2 Introducing ZigDiggity 2.0 , a ZigBee penetration testing framework created by Matt Gleason & Francis Brown of Bishop Fox. Special thanks to Caleb Marion! ZigDiggity version 2 is a major overhaul of the original package and aims to enable cybersecurity professionals, auditors...

local-llm-ctf

Local LLM CTF & Lab This repository is intended to be accompanied with the content at https://bishopfox.com/blog/large-language-models-llm-ctf-lab, which covers the goals of the research, explanations of the implementation, and a few results of the CTF...

sonicrack

Sonicrack Developed by Team X at Bishop Fox Description A tool to decrypt SonicOSX NSv firewall firmware version 7.1.1+. Run it against an OVA image first to extract keys, then it can also decrypt SIG images. Firmware can be obtained from SonicWall's support site with a valid license. Keys seem t...

firecat

firecat For more info, see: http://www.bishopfox.com/resources/tools/other-free-tools/firecat/ Firecat is a penetration testing tool that allows you to punch reverse TCP tunnels out of a compromised network. After a tunnel is established, you can connect from an external host to any port on any...

ProxyListReliabilityCheck

ProxyListReliabilityCheck Perl script to test the reliability of a list of open web proxies. The script takes in a text file list of IPAddress:Port of open web proxies to test 1 per line. It then attempts to crawl to the following URL through each target proxy:...

bfdecrypt

bfdecrypt Utility to decrypt App Store apps on jailbroken iOS 11.x Decrypt App Store apps on LiberiOS Here's an example using https://github.com/BishopFox/bfinject to decrypt the Reddit app on an Electra-jailbroken iPhone: Cs-iPhone: root bash bfinject -P Reddit -l dylibs/bfdecrypt.dylib + Electr...

Orbit-Fox_SSRF_CVE-2025-10874

CVE-2025-10874 - Orbit Fox SSRF Proof of Concept Proof of concept exploit demonstrating Server-Side Request Forgery SSRF vulnerability in the Orbit Fox WordPress plugin with null byte injection bypass. Detailed blog post: https://ryanmroth.com/articles/orbit-fox-ssrf Vulnerability Details Detail|...

CVE-2023-48022

CVE-2023-48022 CVE-2023-48022 exploit modified from Bishop Fox work How to use set ip and port in jobs.py set payload in malicious.py $ pip install ray $ python3 jobs.py...

CVE-2023-20198

CVE-2023-20198 CVE-2023-20198 Checkscript based on: https://blog.talosintelligence.com/active-exploitation-of-cisco-ios-xe-software/ Including the updated where there is an Authorization header to check for the known implant. !! Upgraded to look for upgraded implant The script checks length of...

fortiweb-auth-bypass-check

FortiWeb Auth Bypass Check FortiWeb auth bypass scanner by Bishop Fox Tests a target for authentication bypass CVE-2025-64446 Only exploits a path traversal, does not exploit the actual auth bypass Does not perform any administrative actions on the target For more information about this...

CVE-2025-14156

CVE-2025-14156 Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder' ⚠️ CVE-2025-14156 – Fox LMS WordPress Unauthenticated Privilege Escalation Exploit 🛡️ Vulnerability Overview Fox LMS – WordPress LMS Plugin v1.0.4.7 to v1.0.5.1 – Unauthenticated...

sj v2.8.2

sj Swagger Jacker sj is a command line tool designed to assist with auditing of exposed Swagger/OpenAPI definition files by checking the associated API endpoints for weak authentication. It also provides command templates for manual vulnerability testing. It does this by parsing the definition fi...