xss2shell

🔥 XSS2Shell — CVE-2026-64638 スキャナー & PoC ツールキット ビヘイビアファーストのマススキャナー兼エビデンスグレードのPoCジェネレーター。5億以上のWebサイトに影響するWordPressの 認証前XSS-to-RCEチェーンに対応します。 検出のみ。武器化は一切行いません。バグバウンティプログラムとブルーチーム向けに作られています。 公式チェッカー: https://pwn.ai/xss2shell-checker.html これは何か？ • クイックスタート • Shodan ダークス • 使い方 • 判定マトリックス • 検出 • FAQ 🔎...

vue-template-compiler-patched

vue-template-compiler-patched A security-patched version of vue-template-compiler to fix the prototype pollution vulnerability CVE-2024-6783 and the ReDoS vulnerability CVE-2024-9506. Based on [email protected]. Development and issues live in vue-patched. Related If you use the Vue full buil...

UserLAnd

UserLAnd에 오신 것을 환영합니다 Android에서 Linux 배포판이나 애플리케이션을 실행하는 가장 쉬운 방법입니다. 기능: Android 위에서 전체 Linux 배포판 또는 특정 애플리케이션을 실행합니다. 일반 앱처럼 설치 및 제거할 수 있습니다. 루트 권한이 필요 없습니다. 버그 신고 또는 기능 요청이 있으신가요? 이슈 센터에서 템플릿을 확인하실 수 있습니다. UserLAnd 사용 시작하기 시작하기 페이지를 참조하세요. UserLAnd 자산 UserLAnd가 의존하는 자산과 이를 빌드하는 스크립트는 다른 저장소에...

CVE-2021-44228-playground

LOG4SHELL-CVE-2021-44228-Validator 概要 このツールを使用すると、ユーザーが指定したJavaおよびLog4Jのバージョンについて、単純なJava WebアプリケーションがCVE-2021-44228に対して脆弱であるかどうかを検証できます。 また、オプションで事前定義されたいくつかの緩和策のいずれかを適用することもできます。 log4shellvalidator.pyによって起動されるシミュレーションラボは、docker-composeを使用してlog4jの脆弱性を悪用し、脆弱なマシン上でRCEを獲得することをシミュレートします。 動作の仕組み...

awesome-ai-security

awesome-ai-security A curated list of AI Security materials and resources for Pentesters, Bug Hunters, and Security Researchers. root@kitploit: If you find that some links are not working, you can simply replace the username with gmh5225. Or you can send an issue for me. Show respect to all the...

detection-defense-library

Detection Defense Library One defense-engineering library, consolidated. Attack classes, the patterns that detect them, the committed Sigma rules, and the Windows trust-boundary model, all in a single repo. This repo folds in five former sibling repositories: Former repo| Folded into| What it hol...

krane

Krane Kubernetes RBAC Analysis made Easy Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its...

NoiseHound

NoiseHound Detection-aware Active Directory attack-path scoring. DreadHost Research | companion to OffsetInspect PowerShell and OffsetScan Rust BloodHound and PlumHound on top of it finds a path to the objective. NoiseHound ingests the same graph data and re-ranks paths by expected detection cost...

Sandb0x-Xtract0r

SandB0x-Xtract0r An automated, cross-platform security analysis engine for safely detonating suspicious files, binaries, and applications. 🎬 Watch the Project Demo 💻 Tech Stack Core Programming Languages, Core Systems !Darthttps://img...

CVE-2026-34910-PoC

CVE-2026-34910 / CVE-2026-34909 — UniFi OS Unauthenticated RCE & File Read Unauthenticated Command Injection RCE CVE-2026-34910 + Path Traversal Arbitrary File Read CVE-2026-34909 in UniFi OS Server. CVSS 10.0 Critical each · CISA KEV listed · actively exploited by a Mirai-derived botnet azsxd...

LeetObfuscator

LeetObfuscator root@kitploit: ██╗ ███████╗███████╗████████╗ ██║ ██╔════╝██╔════╝╚══██╔══╝ ██║ █████╗ █████╗ ██║ ██║ ██╔══╝ ██╔══╝ ██║ ███████╗███████╗███████╗ ██║ ╚══════╝╚══════╝╚══════╝ ╚═╝ ██████╗ ██████╗ ███████╗██╗ ██╗███████╗ ██████╗ █████╗ ████████╗ ██████╗ ██████╗...

Zeek-Intelligence-Feeds

Zeek インテル脅威フィード（複合インジケーター） これは、公開脅威フィードと CRITICAL PATH SECURITY が収集したデータに基づく公開フィードです。 このフィードは可能な限り頻繁に更新されます。 はじめに 以下の手順で、プロジェクトのコピーを取得して実行できます。 依存関係 ZEEK 3.0 以上 インストール Zeek の依存関係をインストールします root@kitploit: sudo apt-get install cmake make gcc g++ flex bison libpcap-dev libssl-dev python-dev swig...

Harden-Windows-Security

Harden Windows Security | マルウェアに対する新たな脅威 Windowsを安全に、確実に、Microsoft公式の方法のみで堅牢化 !.NETバッジhttps://raw.githubusercontent.com/HotCakeX/.github/main/Pictures/...

dploot

dploot dploot is Python rewrite of SharpDPAPI written in C by Harmj0y, which is itself a port of DPAPI from Mimikatz by gentilkiwi. It implements all the DPAPI logic of these tools, but this time it is usable with a python interpreter and from a Linux environment. If you don't know what is DPAPI,...

universal-android-debloater-next-generation

Universal Android Debloater Next Generation !warning 免責事項 : ご自身の責任でご使用ください。当方は、お客様のデバイスに発生するいかなる事象についても責任を負いません。 これは UADプロジェクト の独立したフォークです。不要で不明瞭なシステムアプリを削除することで、プライバシーと効率性（エネルギー、速度、メモリ）の向上を目指しています。 また、攻撃対象領域 を減らすことでセキュリティも向上させます。詳細はウィキをご覧ください。 ドキュメント...

watermarks-remover

root@kitploit: | | | || | | |/ |/| || |/ |/ |/ | |/| | | | | | |/ ||| | | | | | \ | | | | | \ | \ | \ | | | || / | | \ watermarks-remover Agent skill + stdlib Python service to strip multi-vendor AI provenance marks from text and files — for privacy and hygiene on content you own. The skill is a...

secure-vault-for-commercial

Secure Vault 📄 Technical paper: SecureVaultTechnicalPaperv3.5.0.pdf · Cite on Zenodo Local-first file encryption for Windows, secured by a physical USB key instead of a password. ⚠️ v3.5.0 includes a breaking security fix — see CHANGELOG.md before updating from an earlier version. Table of Content...

Zapscape

⚡ Zapscape - Your Computer's Safety Net, Simplified ⬇️ DOWNLOAD ZAPSCAPE NOW 🛡️ What Is Zapscape? Zapscape is a friendly tool that helps protect your computer from a hidden threat called a "KVM escape." Think of it as a digital shield that keeps your personal files, photos, and information safe...

CVE-2024-29943-but-with-wasm

CVE-2024-29943, but with wasm An end-to-end exploit chain for CVE-2024-29943 that achieves arbitrary native code execution by smuggling shellcode into SpiderMonkey's WebAssembly JIT code page as f64.const immediates — no ROP, no VirtualProtect, no external toolchain. Verified working against the...

aotopsy

AOTopsy A Dart AOT snapshot analyzer. Turns libapp.so — the compiled Dart code inside a Flutter release APK — into function names, class layouts, call graphs, behavioral signals, and readable pseudocode. No Dart VM, no SDK compilation, no runtime fallback. Fork notice: AOTopsy is a fork of...