Hunt-Sleeping-Beacons

Hunt-Sleeping-Beacons This project is mostly a callstack scanner which tries to identify IOCs indicating an unpacked or injected C2 agent. All checks are based on the observation that C2 agents wait between their callbacks causing the beacons thread to idle and this tool aims to analyze what...

ldap_shell

LDAP shell This project is a fork of ldapshell from Impacket. It provides an interactive shell for Active Directory enumeration and manipulation via LDAP/LDAPS protocols, making it useful for both system administrators and security professionals. Installation These tools are only compatible with...

PENeL

PENeL - Powershell with Embedded .NET Library Program that prepares a .NET DLL Library to run embedded in Powershell Script Created By: Guilherme Bacellar Moralez Th3 0bservator https://twitter.com/th30bservator Disclaimer This code is created and maintened only for a research proposal. Please do...

sharem

SHAREM Welcome to SHAREM! SHAREM was presented at DEFCON 31 in "Game-Changing Advances in Windows Shellcode Analysis" and Black Hat USA Arsenal. A companion Ghidra plugin was made available separately from Trellix, courtesy of Max Kersten. Thus, you can extend the power of SHAREM to Ghidra, if yo...

CVE-2021-36749

CVE-2021-36749 Apache Druid Arbitrary File Read Affected versions: version = 0.21.1 Either of the following two methods can be used Command Line Method root@kitploit: curl http://127.0.0.1:8888/druid/indexer/v1/sampler?for=connect -H "Content-Type:application/json" -X POST -d...

strutt-cve-2014-0114

CVE-2014-0114 - Vulnerability in Struts 1 Parameters in a POST or GET request are handled as properties to be set with the form as a starting point. Parameters can be a path to a nested object. Apache Struts 1.x can be manipulated to call getClass on Form Beans. For example, one can directly...

CVE-2018-2628all

CVE-2018-2628 Vulnerability Batch Detection Script Usage IP format: root@kitploit: 192.168.31.1:443 192.168.31.100:443 Save it as url.txt in the same directory and run the script. Please comment on the output effect yourself! Execute like this: root@kitploit: The program works fine under Deepin,...

Forerunner

Forerunner The Forerunner library is a fast, lightweight, and extensible networking library created to aid in the development of robust network centric applications such as: IP Scanners, Port Knockers, Clients, Servers, etc. In it's current state, the Forerunner library is able to both...

Kerbeus-BOF

Kerbeus-BOF Beacon Object Files for Kerberos abuse. This is an implementation of some important features of the Rubeus project, written in C. The project features integration with the C2 frameworks Cobalt Strike, Havoc, AdaptixC2 and Outflank C2. Ticket requests and renewals asktgt The asktgt...

idacode

IDACode IDACode makes it easy to execute and debug Python scripts in your IDA environment without leaving Visual Studio Code. The VS Code extension can be found on the marketplace. IDACode is still in a very early state and bugs are to be expected. Please open a new issue if you encounter any...

CVE-2021-30005-POC

CVE-2021-30005-POC PoC for CVE-2021-30005. Details The vulnerability resides in the fact that PyCharm would automatically activate a virtual environment found in the project when opened for the first time. This allowed an attacker to create a repository containing a malicious virtual environment...

xtrace-sdk

The encrypted vector database. Your data never leaves your machine in plaintext. Documentation | X | LinkedIn Manage your AI memory → mem.xtrace.ai What is XTrace? Every vector database on the market requires you to hand your data to a third party in plaintext. XTrace doesn't. Your documents and...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Proof-of-Concept for CVE-2025-31324: Unauthenticated upload in SAP NetWeaver Visual Composer Metadata Uploader This script performs: 1. File upload to the vulnerable endpoint via Upload host/port 2. Optional trigger via HTTP GET via Trigger host/port 3. Basic response...

Make-and-Break

Make-and-Break Create and exploit a vulnerable Virtual Machine Description: Built a custom Virtual Machine, running Ubuntu 18.04.1 and Webmin 1.810. Using CVE-2019-15107 to exploit a backdoor in the Linux System Administration Interface PROOF of CONCEPT --- Linux OS Ubuntu 18.04.1 will be deploye...

airpydump

airpydump Analyze Wireless Packets on the fly. Currently supporting three working Modes Reader, Live, Stealth Description airpydump is a wireless packet analyzer, providing the interface most likely that of airodump-ng from aircrack suite. It currently provides three working modes which are Reade...

graphw00f

Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...

graphw00f

标志致谢 Nick Aleks！ graphw00f - GraphQL 服务器指纹识别 目录 工作原理是什么？ 检测引擎 GraphQL 威胁矩阵 前置条件 安装 配置 使用示例 指纹识别 GraphQL 检测并指纹识别 GraphQL 支持与问题 资源 工作原理是什么？ graphw00f（灵感来源于 wafw00f）是针对 GQL 端点的 GraphQL 指纹识别工具，它通过发送一系列良性和畸形的查询来识别后台运行的 GraphQL 引擎。 graphw00f 将利用 GraphQL 威胁矩阵项目，提供每项技术默认提供的安全防御措施以及它们是默认开启还是关闭的洞察。...

GC2-sheet

GC2 GC2 Google Command and Control is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint List and exfiltrate files using Google Drive or Microsoft SharePoint Document. Why This project has been developed t...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

TLS-Attacker

TLS-Attacker TLS-Attacker is a Java-based framework for analyzing TLS libraries. It is able to send arbitrary protocol messages in an arbitrary order to the TLS peer, and define their modifications using a provided interface. This gives the developer an opportunity to easily define a custom TLS...