semgrep-rules

semgrep-rules Welcome! This repository contains Semgrep's Community Edition rules. In addition to the rules in this repository, the Semgrep Registry offers proprietary Pro rules that offer additional language coverage, and unlock crossfile and deep dataflow analysis. Find rules: search for...

detectXSSlib

detectXSSlib Project folders: detectxsslib - main library see ReadMe.txt for more information modules - server modules using detectxsslib test - sets of URLs used for verification of the library tools - command line tools using detectxsslib See license.txt for licensing details...

sliver-gui

Sliver GUI A desktop operator console for the Sliver C2 framework in the spirit of Cobalt Strike and Havoc. Designed and Developed by Raj Kumar Mullapudi Sliver GUI is a thin Wails v2 Go + plain HTML/CSS/JS frontend over Sliver's existing rpcpb.SliverRPC gRPC service. It reimplements no C2 logic...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

Important: Red Hat Security Advisory: postgresql:16 security update

An update for the postgresql:16 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

APTs-Adversary-Simulation

APTs Adversary Simulation A comprehensive collection of simulated Advanced Persistent Threat APT attacks based on real world tactics, techniques, and procedures TTPs used by state sponsored APT Groups from Russia, China, Iran, and North Korea !CAUTION Important Notice : This project is strictly f...

Security Bulletin: Multiple vulnerabilities in Python affect AIX

Summary Vulnerabilities in Python: Improper Input Validation CVE-2025-13462, CVE-2026-3644, Denial of Service CVE-2026-15308, CVE-2026-7210, CVE-2026-66046, Use-After-Free / Memory Corruption CVE-2026-76957, Out-of-Bounds Read / Infinite Loop CVE-2026-72522, CVE-2026-76641, Insufficient Entropy...

meg

meg meg is a tool for fetching lots of URLs but still being 'nice' to servers. It can be used to fetch many paths for many hosts; fetching one path for all hosts before moving on to the next path and repeating. You get lots of results quickly, but non of the individual hosts get flooded with...

meg

meg meg es una herramienta para obtener muchas URLs pero siendo 'amable' con los servidores. Se puede usar para obtener muchas rutas de muchos hosts; obteniendo una ruta para todos los hosts antes de pasar a la siguiente ruta y repetir. Obtienes muchos resultados rápidamente, pero ninguno de los...

KubeStalk

KubeStalk KubeStalk is a tool to discover Kubernetes and related infrastructure based attack surface from a black-box perspective. This tool is a community version of the tool used to probe for unsecured Kubernetes clusters around the internet during Project Resonance - Wave 9. Usage The GIF belo...

SharpMove

SharpMove - Ejecución autenticada .NET para hosts remotos Compilación Para compilar, abre el proyecto de Visual Studio y compílalo para la versión Release. Opciones WMI SCM DCOM Múltiples Programador de tareas Secuestro de DLL de servicio Secuestro de servidor DCOM Modificar tarea programada...

CVE-2023-6019

CVE-2023-6019 - Anyscale Ray Dashboard Unauthenticated RCE PoC exploit for CVE-2023-6019 — Remote Code Execution via unauthenticated Ray Dashboard Jobs API. Made by oguiii Description Anyscale Ray is an open-source framework for distributed ML/AI workloads. Versions prior to 2.6.4 expose a Jobs...

GenWiFiFaker

EN GenWiFiFaker is a tool for creating fake WiFi access points. It can be used for testing network security, performing demonstrations, or other educational purposes. This tool generates fake SSIDs and MAC addresses and broadcasts them over a specified WiFi interface. Features Generate Fake SSIDs...

greatfet

GreatFET This repository contains firmware and software for GreatFET. Information on GreatFET and purchasing GreatFET: https://greatscottgadgets.com/greatfet/ Documentation Documentation for GreatFET can be viewed on Read the Docs. The raw documentation files for GreatFET are in the docs folder i...

Zetsu

Un sistema RAG offline personal para conocimiento de seguridad ofensiva. Ingiere tus writeups, soluciones de laboratorio, informes de bug bounty y blogs de seguridad, luego consúltalos en lenguaje natural durante los compromisos. Sin nube, sin SaaS, tu conocimiento permanece tuyo. Qué hace ZETSU...

CVE-2025-7775-PoC

CVE-2025-7775 | NetScaler ADC RCE PoC root@kitploit: ⚠️ Disclaimer: This is a hypothetical PoC for educational purposes only.Segment NetScaler networks CVE-2025-7775 does not exist. Use only in an isolated lab. Overview Simulated exploit for a hypothetical unauthenticated RCE in Citrix NetScaler...

pySigma

pySigma pySigma is a python library that parses and converts Sigma rules into queries. It is a replacement for the legacy Sigma toolchain sigmac with a much cleaner design and is almost fully tested. Backends for support of conversion into query languages and processing pipelines for transforming...

htshells

HTSHELLS - Self contained web shells and other attacks via .htaccess files. Attacks are named in the following fashion, module.attack.htaccess and grouped by attack type in directories. Pick the one you need and copy it to a new file named .htaccess, check the file to see if it needs editing befo...

copy-fail-CVE-2026-31431-detection-probe

Linux Kernel LPE Probe Suite — Copy Fail & Dirty Frag Safe detection tooling for two related Linux kernel local privilege escalation vulnerability families — Copy Fail CVE-2026-31431 and Dirty Frag CVE-2026-43284 / CVE-2026-43500 — both affecting all major distributions since 2017, both exploitab...