credactor v2.6.0

Credactor Find the secret. Fix it. Commit clean. Secret scanners are good at sounding the alarm and not much help putting it out. They hand you a list of leaked credentials and leave the cleanup to you. Credactor closes the loop: it finds a hardcoded secret and rewrites it in place, so a leak goe...

essh v0.3.2

root@kitploit: ███████╗███████╗███████╗██╗ ██╗ ██╔════╝██╔════╝██╔════╝██║ ██║ █████╗ ███████╗███████╗███████║ ██╔══╝ ╚════██║╚════██║██╔══██║ ███████╗███████║███████║██║ ██║ ╚══════╝╚══════╝╚══════╝╚═╝ ╚═╝ Enhanced SSH for people with fleets A pure-Rust SSH client with a dense, Netwatch-style TU...

CVE-2026-42945_NginxRift

🚀 NGINX Rift PoC Automation — CVE-2026-42945 Driver de automação PoC para exploração de RCE do containernginx-rift · Verificação do alvo → Exploit de comando único → Reverse-shell interativa Um único comando orquestra todo o fluxo do exploit — da verificação do container até obter a shell. ⚠️ Avis...

IPFire_2.19_RCE_Authenticated

IPFire 2.19 OINKCODE RCE PoC Python-Proof-of-Concept für die authentifizierte Befehlsinjizierungsschwachstelle in der ids.cgi-Seite von IPFire 2.19 über den Parameter OINKCODE. Nur für autorisierte Sicherheitstests und Schulungslabore. Führen Sie dieses PoC nur gegen Systeme aus, die Ihnen gehöre...

aws-iam-authenticator v0.7.19

AWS IAM Authenticator for Kubernetes A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster. The initial work on this tool was driven by Heptio. The project receives contributions from multiple community engineers and is currently maintained by Heptio and Amazon EKS OSS...

yellow

root@kitploit: | | | | | | |/ \ | |/ \ \ /\ / / | || | / | | \ V V / , ||||/ // |/ - Just add blue. yellow - einfach Blau hinzufügen Einfache Binärmodifikationen, die einen Canary-Token auslösen, wenn eine Binärdatei ausgeführt wird. Ideal zum Präparieren von Produktionssystemen gegen...

PyHmmm

PyHmmm Was ist das? Dies ist ein Drittanbieter-Agent für Havoc C2, geschrieben in Python. Er ist als einfacher PoC gedacht, um zu lernen, wie man eigene Havoc-Agenten schreibt, mit dem dazugehörigen Blogbeitrag...

JuicyPotatoNG

JuicyPotatoNG Solo un'altra escalation di privilegi locali di Windows da account di servizio a System. Dettagli completi su -- https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/ Utilizzo root@kitploit: JuicyPotatoNG by decoderit & splintercode Mandatory args: -t...

SharpGmailC2

SharpGmailC2 Unser freundliches Gmail fungiert als Server und der Implantat exfiltriert Daten über SMTP und liest Befehle vom C2 Gmail über das IMAP-Protokoll. HAFTUNGSAUSSCHLUSS: Dieses Projekt funktioniert nach dem 29. November 2022 nicht mehr gegen Windows Defender. Dieses Tool wird von MS...

palera1n

palera1n Jailbreak per dispositivi A8 fino ad A11, T2, su iOS/iPadOS/tvOS 15.0, bridgeOS 5.0 e versioni successive. --- Uno screenshot di palera1n usato in un Terminale Supporto dispositivi Nota: sui dispositivi A11 iPhone X, 8, 8 Plus, è necessario disattivare il passcode mentre si è in stato di...

orpheus

Orpheus Orpheus ist ein Wrapper für eine modifizierte Version von Impackets GetUserSPNs.py und kerberosv5.py, die die KDC-Optionen Ticket-Optionen und den Verschlüsselungstyp für Kerberoasting verändert. Hinweis: Orpheus ist nach dem griechischen Gott benannt, der es schaffte, an Cerberus dem...

DCOMPotato

Raccolta di exploit per alcune vulnerabilità di escalation locale dei privilegi di oggetti DCOM di servizi tramite abuso di SeImpersonatePrivilege spiegazione DCOM usa RPCCIMPLEVELIDENTIFY come livello di impersonificazione predefinito, per la chiamata IUnknown in uscita predefinita, vedere...

c2-framework

E1A Malware Lab Final Project - Command & Control Framework...

gha-oidc-auditor

gha-oidc-auditor !Licensehttps://img.shields.io/badge/lic...

SUSE CVE-2026-53804

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration...

SUSE CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

SUSE CVE-2026-68283

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c "tracing: Add bulk garbage collection of freeing eventtriggerdata" moved the kfree of eventtriggerdata to a kthread that runs...

Apkx-Hunter v2.7.2

APKX-Hunter v2.7.1 — Debian Package APKX-Hunter is an open-source Android Static Analysis Framework written entirely in C , purpose-built for Android security assessments, reverse engineering, malware analysis, OWASP MASVS compliance scanning, bug bounty hunting, and penetration testing. The...

PT-2026-79536

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child process.exec in index.ts, which...

Linux Distros Unpatched Vulnerability : CVE-2026-54552

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs...