spawn

SPAWN - BOF de Cobalt Strike BOF de Cobalt Strike que crea un proceso sacrificial, lo inyecta con shellcode y ejecuta el payload. Construido para evadir hooks de EDR/UserLand al crear un proceso sacrificial con Arbitrary Code Guard ACG, BlockDll y suplantación de PPID. Debido a ACG, esto no es...

zygote-injection-toolkit

Zygote injection toolkit This is a Python command-line utility to easily run and backup private app data using the Android Zygote injection vulnerability CVE-2024-31317. To run this, you must have any device that has not been updated to the June 1, 2024 security patch. If you don't know whether...

CVE-2023-23397

CVE-2023-23397 Simple and dirty PoC of the CVE-2023-23397 vulnerability impacting the Outlook thick client. Description Outlook suffers from a lack of control over the user input that allows to configure the sound of a meeting and appointment reminder. Indeed, an attacker is able to force a victi...

Learn-about-cve-2025-31133-poc

Learn-about-cve-2025-31133-poc Overview A proof-of-concept demonstration and learning environment for CVE-2025-31133 , a security vulnerability in runc that allows bypassing maskedPaths protection through a race condition. maskedPaths are designed to prevent containers from accessing sensitive ho...

ProxyShell

ProxyShell Install root@kitploit: git clone https://github.com/ktecv2000/ProxyShell cd ProxyShell virtualenv -p $which python3 venv source venv/bin/activate pip3 install pypsrp cp wsman.py venv/lib//site-packages/pypsrp/wsman.py Usage root@kitploit: python3 exploit.py...

PongoOS

pongoOS A pre-boot execution environment for Apple boards built on top of checkra1n. Building on macOS Install Xcode + command-line utilities Run make all Building on Linux Install clang if in doubt, from apt.llvm.org Install ld64 and cctools' strip. On Debian/Ubuntu these can be installed from t...

claude-awm

claude-awm: can you scrub a SynthID text watermark by editing the text? Yes, but only one family of attack works, and it isn't the one everyone assumes. Unicode variation selectors category Mn, U+FE00 to U+FE0F and U+E0100 to U+E01EF drive the detector below threshold and stay there. Every other...

caracal

Caracal Caracal est un outil d'analyse statique basé sur la représentation SIERRA pour les contrats intelligents Starknet. Fonctionnalités Détecteurs pour repérer du code Cairo vulnérable Imprimantes pour rapporter des informations Analyse de flux de données contaminé taint analysis Cadre d'analy...

caracal

Caracal Caracal is a static analyzer tool over the SIERRA representation for Starknet smart contracts. Features Detectors to detect vulnerable Cairo code Printers to report information Taint analysis Data flow analysis framework Easy to run in Scarb projects Installation Precompiled binaries...

kostebek

Reconnaissance Tool Introduction The Kostebek is a reconnaissance tool which uses firms' trademark information to discover their domains. Reference : https://evren.ninja/en/post/recon-is-everywhere/ Demo video : Setup Downloading Kostebek git clone https://github.com/esecuritylab/kostebek...

kostebek

Outil de Reconnaissance Introduction Kostebek est un outil de reconnaissance qui utilise les informations de marque des entreprises pour découvrir leurs domaines. Référence : https://evren.ninja/en/post/recon-is-everywhere/ Vidéo de démonstration : Configuration Téléchargement de Kostebek git clo...

C2-and-Post-Exploitation-Framework

Capstone Docker Lab Overview and Purpose The victim browses to a hosted webpage. The exploit initiates via shellcode embedded in utils.js runs client-side in the victim's browser via CVE-2021-21220. The shellcode runs on the victim's machine, calls the HTTPS delivery server, downloads...

port-scan-automation

LazyMap - Auto NMAP Scanning Script Automate NMAP scans and custom Nessus polices. Developed by Daniel Compton https://github.com/commonexploits/port-scan-automation.git Released under AGPL see LICENSE for more information Installing root@kitploit: git clone...

port-scan-automation

LazyMap - Script de Escaneo Automático con NMAP Automatiza escaneos de NMAP y políticas personalizadas de Nessus. Desarrollado por Daniel Compton https://github.com/commonexploits/port-scan-automation.git Publicado bajo AGPL, consulta LICENSE para más información Instalación root@kitploit: git...

CVE-2025-63353

CVE-2025-63353 PoC - FiberHome HG6145F1 Predictable Default Wi-Fi PSK Educational research toolkit and multi-language PoC for CVE-2025-63353 , a critical predictable-default-PSK vulnerability affecting FiberHome HG6145F1 RP4423 GPON ONT devices. Summary The factory default Wi-Fi pre-shared key on...

shells

Shellz A script for generating common revshells fast and easy. Especially nice when in need of PowerShell and Python revshells, which can be a PITA getting correctly formatted. PowerShell revshells Shows [email protected], above the prompt and working-directory Has a partial and full...

ActiveMQ-EXPtools

ActiveMQ-EXPtools Supports detecting and exploiting Apache ActiveMQ vulnerabilities: CVE-2015-5254, CVE-2016-3088, CVE-2022-41678, CVE-2023-46604, CVE-2024-32114, CVE-2026-34197, CVE-2026-40466, CVE-2026-42588 !WARNING This tool is intended for security research and learning purposes only. Users...

OmniScan

OmniScan Comprehensive Vulnerability Scanner OmniScan is a lightweight, multi-engine vulnerability scanner based on Python, designed for red team operations and security research. It integrates a lightweight Nuclei engine Lite and Afrog engine, and provides powerful asset collection and result...

SharpExchangePriv

SharpExchangePriv Description A C implementation of PrivExchange by @dirkjan. Kudos to @g0ldenGunSec, as I relied on his code. It was tested against Exchange 2016. Compile Instructions SharpExchangePriv has been built against .NET 3.5 and is compatible with Visual Studio 2017. Simply open the...

pwnspoof

pwnSpoof from Punk Security generates realistic spoofed log files for common web servers with customisable attack scenarios. Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials. Can you find the attacker session and build...