TrollDump

TrollDump Injects x64 managed DLL into x64 managed/unmanaged process process must have GUI because we obtain its windows handle using setwindowshook Here as a TROLL, we inject into hidden window taskmgr to do a lsass dump undetected see Test Case section below The injector DLL and injected DLL is...

radar

Radar Radar is a small but efficient network scanner written in Rust heavily inspired by masscan. These are the main features: Userspace TCP, UDP, DHCP and ARP implementations, thanks to pnet Being asynchronous Randomized IP/ports scanning with no pre-allocation/shuffling Rate limiting Monitor mo...

CVE-2026-22226

CVE-2026-22226 Proof of Concept for CVE-2026-22226 Authenticated LAN-side OS Command Injection in the VPN Client of TP-Link Archer Wi-Fi routers Vulnerability brief The VPN Client controller stores the user-controlled entry description des in the UCI configuration with a weak validation regex. Wh...

no-defender

DMCA 08/06/24 This project was DMCA'd by some company, so all the releases, sources and everything else was wiped off, but if you still find my project useful or interesting, please leave a star 3. no-defender A slightly more fun way to disable windows defender. How it works There's a WSC Windows...

aeota

aeota AEA OTA/IPSW decryption Prerequisites getkey.py Python 3.10+ might work with older, but not tested requests pyhpke aastuff macOS 13+ macOS 14+ for HPKE support aastuffstandalone macOS 12+ macOS 14+ for HPKE support Building and Installing getkey.py root@kitploit: pip3 install -r...

WHS4_CVE-2021-4034

CVE-2021-4034 PwnKit - Local Privilege Escalation PoC 🔗 Original Project : berdav/CVE-2021-4034 This project is an educational analysis and modification based on the original. MIT License Compliant | White Hat School Training Task 📋 Overview CVE-2021-4034 is a local privilege escalation...

obfus.h

obfus.h obfus.h is a macro-only library for compile-time obfuscating C applications, designed specifically for the Tiny C tcc you can download it here - Tiny-C-Compiler/releases. It is tailored for Windows x86 and x64 platforms and supports almost all versions of the compiler. Very reliable armor...

ExploitGSM

ExploitGSM Exploit for 6.4 - 6.5 kernels and another exploit for 5.15 - 6.5 Telegram for contact - https://t.me/YuriiCrimson Telegram chat - https://t.me/itcrowdua In winter I found two vulnerabilities in the ngsm driver. After that Jammes wrote to me offering to buy them from me. As you...

bochscpu-python

bochscpu-python Python bindings for @yrp's BochsCPU using FFI to easily and accurately emulate x86 code. Install bochscpu-python requires a Python environment of 3.8 or more recent only. Via PyPI preferred By far the simplest way to get things up and running is using the stable packaged version o...

dlink

Inyección de comandos y cuenta de puerta trasera en dispositivos NAS de D-Link Resumen de la vulnerabilidad: La vulnerabilidad descrita afecta a múltiples dispositivos NAS de D-Link, incluidos los modelos DNS-340L, DNS-320L, DNS-327L y DNS-325, entre otros. La vulnerabilidad reside en la URI...

llm-security-101

LLM Security 101 Delving into the Realm of LLM Security: An Exploration of Offensive and Defensive Tools, Unveiling Their Present Capabilities. As we embrace Large Language Models LLMs in various applications and functionalities, it is crucial to grasp the associated risks and actively mitigate, ...

process-enumeration-stealth

🚴 process-enumeration-stealth What is this? This is a simple PoC which allows you to return a list of PIDs currently using NTFS, by querying the \ntfs\ base device the Windows filesystem base object. Using this method circumvents the need to use typical APIs, such as NtQuerySystemInformation or t...

jsluicepp

📄 Table of Contents 👋 Introduction 🛠️ Setup 📝 Usage 📜 Features Monitor URLs Send to Repeater Secrets Secret Notifications Copy URL Positive/Negative Match In-scope only In-line Tags Hide Duplicates Show Parameterized Import/Export Save Settings 🤝 Contributors 👋 Introduction jsluice++ is a Burp...

http-garden

The HTTP Garden The HTTP Garden is a collection of HTTP servers and proxies configured to be composable, along with scripts to interact with them in a way that makes finding vulnerabilities much much easier. For some cool demos of the vulnerabilities that you can find with the HTTP Garden, check...

ThreatHunting-Keywords

ThreatHunting-Keywords 🎯 List of keywords for ThreatHunting sessions Table of Contents What is Threat Hunting Advantages of Threat Hunting Bridging Threat Hunting With Core Services Detection Maturity Level Key Focus Areas for Intelligence Gathering Targeted Threat Hunting process Files...

csw-slides-2024

Developing Secure Software in 2024 Abstract As humanity increases its dependence on computer systems, the need for safe and secure software becomes paramount. Today, everything from planes, trains, and automobiles to toothbrushes and cooktops contain a multitude of tiny computers. Each of these...

SpawnWith

SpawnWith An experimental Beacon Object File BOF that provides an alternative to the spawnas and inject commands. This exposes a new command, spawnwith pid listener, that performs the following: 1. Obtain a handle to the target process. 2. Obtain a handle to the process' primary token. 3. Duplica...

MakeMeEnterpriseAdmin

Example of successful execution: root@kitploit: ====================================================================== /\ Elevated domain admins to Enterprise admins - version 1.0 || /||\ Require: domain admin right |:||:| or more specifically DS-Replication-Get-Changes-All |/||| Vincent LE TOUX...

WindowsProtocolTestSuites v4.26.9.0

Windows Protocol Test Suites Windows Protocol Test Suites provide interoperability testing against the implementation of Windows open specifications including File Services, Identity Management, Remote Desktop and etc. Originally developed for in-house testing of the Microsoft Open Specifications...

Invoke-DCSync

Invoke-DCSync Invoke-DCSync Reference: https://adsecurity.org/?p=1729 Reference: https://silentbreaksecurity.com/invoke-dcsync-because-we-all-wanted-it/ Goal: retrieve password hashes from all user accounts on a domain controller using the mimikatz DCSync function Warning：Only do this in a lab...