libdlmalloc

libdlmalloc libdlmalloc is a python script designed for use with GDB that can be used to analyse the Doug Lea's allocator, aka dlmalloc. It currently supports dlmalloc 2.8.x versions. Note that some parts can also be used independently GDB, for instance to do offline analysis of some snapshotted...

citrix_cve-2023-4966

citrixcve-2023-4966 Citrix CVE-2023-4966 from assetnote modified for parallel and file handling...

CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC

CVE-2025-32433-Erlang-OTP-SSH-RCE-PoC The vulnerability allows an attacker with network access to an Erlang/OTP SSH server to execute arbitrary code without prior authentication. Description A serious vulnerability has been identified in the Erlang/OTP SSH server that may allow an attacker to...

CVE-2026-41940

CVE-2026-41940 - WHM/cPanel Authentication Bypass Mass Exploit 📋 Description CVE-2026-41940 is a critical authentication bypass vulnerability in WHM/cPanel that allows attackers to bypass authentication and gain root access to a server without valid credentials. The vulnerability leverages CRLF...

Dorkwright

Dorkwright - Google Dorking Tool Dorkwright is a powerful Python-based Google dorking utility that automates the extraction of file links from Google search results and optionally downloads them. It uses Playwright for browser automation and includes CAPTCHA handling, progress indicators, and a...

termshark

Termshark A terminal user-interface for tshark, inspired by Wireshark. V2.4 is out now with packet search and profiles for colors and columns! See theChangeLog. If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help! Features Rea...

cve-2023-30861-poc

CVE-2023-30861 PoC Proof of Concept ⚠️ 주의 CAUTION 이 프로젝트는 Flask의 CVE-2023-30861 취약점을 재현하기 위한 목적의 PoC입니다. 절대로 인터넷에 노출된 환경에서 실행하지 마세요. 외부 접근이 가능한 네트워크에 연결되면 실제 공격에 악용될 수 있습니다. ⚠️ WARNING This project is a Proof of Concept PoC for demonstrating CVE-2023-30861 in Flask. Do NOT run this on a publicly...

VectoredOverloading

VectoredOverloading Vectored Overloading is a local PE injection technique that was first observed in the KidKadi malware. It works by manipulating the load of a legitimate DLL using Hardware Breakpoints HWBP and Vectored Exception Handling VEH to change the DLL section object on-the-fly...

CVE-2026-53921-PoC-Exploit

CVE-2026-53921 – odhcpd Stack Overflow For educational and authorized testing only. Unauthorized use is illegal. Vulnerability Overview CVE-2026-53921 is a critical stack buffer overflow in OpenWrt’s odhcpd daemon – the default DHCPv6/DHCPv4/RA server. How it works The vulnerability exists in...

CVE-2018-1000199

CVE-2018-1000199 The Linux ptrace code virtualizes access to the debug registers, and the virtualization code has incorrect error handling. This means that if you write an illegal value to, say, DR0, the internal state of the kernel's breakpoint tracking can become corrupt despite the fact that t...

ByteCaster

ByteCaster Swiss Army Knife for payload encryption, obfuscation, and conversion to byte arrays – all in a single command! It supports 3 encryption algorithms, 4 encoding / obfuscation algorithms and 14 output formats. Installation Download the compiled binary or compile Go source code. Usage...

ShellGhost

ShellGhost A memory-based evasion technique which makes shellcode invisible from process start to end. Motivation I wanted to share this shellcode self-injection POC to showcase some AV/EDR evasion concepts that may turn useful for Red Teaming. Just a few weeks ago I came up with a custom in-memo...

Testability-CVE-2014-1266

TestableSecurity This is a small proof-of-concept that lifts out the vulnerable SSLVerifySignedServerKeyExchange from Apple's libsecurityssl to demonstrate that the signing code is readily unit testable in isolation. While there's been some talk that this bug wasn't easily tested, the code in...

auth_analyzer

Auth Analyzer Table of Contents What is it? Why should I use Auth Analyzer? GUI Overview Parameter Extraction Auto Extract From To String Static Value Prompt for Input Parameter Replacement Replacement Location Parameter removement Sample Usage Auto extract session Cookie Session Header and CSRF...

hook

amalmurali47/hook This repository is part of the PoC for exploiting CVE-2024-32002, a vulnerability in Git that allows RCE during a git clone operation. This repository contains the malicious hook used in the exploit. Overview For detailed instructions and an explanation of how the exploit works,...

nuclei

English • 中文 • Korean • Indonesia • Spanish • 日本語 • Portuguese • Türkçe...

FaceBrute

FaceBrute Facebook brute force script This script tries to guess passwords for a given facebook account using a list of passwords dictionary. Since facebook temporaly blocks access to accounts that continously fail to login, this script is coded so that it waits a specified amount of time when th...

CVE-2023-38545

CVE-2023-38545: Curl Vulnerability Proof of Concept This repository contains a Proof of Concept PoC designed to test systems for the CVE-2023-38545 vulnerability. The vulnerability affects the curl utility, specifically versions between 7.69.0 and 8.3.1, and is related to the handling of HTTP...

CVE-2026-107203

An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission. It does not apply the search limit on that permission, so the request is answered from every interface on t...

Alfred

WIP - Revamped Alfred 2.0 Alfred - A Modular Recon and Exploitation Framework EXPIREMTNAL PHASE Alfred is a Python-based framework designed to assist in various reconnaissance, exploitation, and post-exploitation tasks. It is highly modular, allowing users to easily add plugins to extend...