vulnx

VulnX Vulnx 🕷️ is An Intelligent Bot Auto Shell Injector that detects vulnerabilities in multiple types of Cms https://github.com/anouarbensaad/vulnx/archive/master.zip VulnX Wiki • How To Use • Compatibility • Library • Vulnx is An Intelligent Bot Auto Shell Injector that detects vulnerabilities...

CVE-2026-43866

camel-jms Forged DefaultExchangeHolder Filter-Bypass Reproducer CVE-2026-43866 This project demonstrates CVE-2026-43866 , a bypass of the CVE-2026-40860 fix in Apache Camel's camel-jms and camel-sjms / JMS-family components. CVE-2026-40860 added a post-deserialization class allow-list...

pysqli

PySQLi - Python SQL injection framework 1. Overview PySQLi is a python framework designed to exploit complex SQL injection vulnerabilities. It provides dedicated bricks that can be used to build advanced exploits or easily extended/improved to fit the case. 2. Why another SQLi framework ? Simple...

Hscan

Hscan-Win-Gui HScan v1.20 Usage Instructions 1. System Requirements: Windows NT/2000/XP 2. Software Introduction: Multi-threaded detection of specified IP ranges specified hosts or host lists. GUI and command-line modes. Scan items: -name --- Get hostname; -port --- Default port scan; -ftp ---...

CVE-2026-56121-Feast-Unauth-RCE

CVE-2026-56121 — Feast Unauthenticated RCE via gRPC Registry Deserialization The Feast 0.63.0 registry gRPC server dill.loads the user-defined function of an OnDemandFeatureView as soon as a spec arrives — before any authorization check. The shipped config is auth: noauth, so any client that can...

burpcommander

burpcommander Ruby command-line interface to Burp Suite's REST API Usage burpcommander VERSION: 1.0.1 - UPDATED: 08/29/2018 -t, --target IP Address Defaults to 127.0.0.1 -p, --port Port Number Defaults to 1337 -k, --key API Key If you require an API key specify it here -i, --issue-type-id String...

agent

Bomfather Agent Bomfather Agent is an eBPF-based agent that runs in the kernel space to block actions based on a policy. We built this agent to solve the problems we had with existing solutions. 1. They were too complex to set up and use. 2. They were too slow and inefficient. 3. And even if they...

DavRelayUp

DavRelayUp A quick and dirty port of KrbRelayUp with modifications to allow for NTLM relay from webdav to LDAP in order to streamline the abuse of the following attack primitive: 0. Optional New machine account creation New-MachineAccount 1. Force start the WebClient service 2. Start webdav relay...

LOLSpoof

LOLSpoof LOLSpoof is a an interactive shell program that automatically spoof the command line arguments of the spawned process. Just call your incriminate-looking command line LOLBin e.g. powershell -w hidden -enc ZwBlAHQALQBwAHIAbwBjAGUA.... and LOLSpoof will ensure that the process creation...

ATSCAN

ATSCAN SCANNER Advanced Mass Search / Dork / Exploitation Scanner | Alisam Technology is not responsible for any misuse, damage caused by this script or attacking targets without prior mutual consent! It is your responsibility to obey laws! ---|--- Codename:| 4n0n4t ---|--- AUTHOR:| Ali MEHDIOUI...

CVE-2023-7028

CVE-2023-7028 ⚠️ This exploit is for defensive purposes and should be used by cybersecurity professionals to identify possible vulnerable GitLab servers. Description CVE-2023-7028 - Account Takeover via Password Reset without user interactions in GitLab Community Edition and Enterprise Edition...

MIPS-CVE-2014-9222

Disclaimer Tutorials are for informational and educational purposes only. I believe that ethical hacking, information security and cyber security should be familiar subjects to anyone using digital information and computers. I believe that it is impossible to defend yourself from hackers without...

godofwar

GodOfWar - Malicious Java WAR builder A command-line tool to generate war payloads for penetration testing / red teaming purposes, written in ruby. . hhh hhhhhhh hhhhhhhh hhhhhhhh+ hhhhhhhh' hhhhhhhh. hhhhhhhhh ..-- hhhhhhhhh -sh/.. +. hhhhhhhhh: /+/:-/+ss- hhhhhhhhhh: /MMMss:. hhhhhhhhhh: .MMMMM...

CVE-2022-30190-NSIS

MSDT Patcher, a.k.a. CVE-2022-30190-NSIS This is an NSIS script that helps deploy and roll back the mitigation registry patch for CVE-2022-30190 as recommended by Microsoft. Download the executable here. How does it work? When run, it checks for the presence of the key HKCR\ms-msdt. If the key...

CVE-2017-12149

CVE-2017-12149 Many thanks to Master yunxu1 for the source code Description: Removed the graphical interface Fixed command execution failure caused by system identification errors Changed to an interactive shell Usage Enter the URL and press Enter; it will automatically execute whoami for both...

bluefire-sharepoint-cve-2025-53770

🔐 Bluefire Redteam – SharePoint CVE-2025-53770 Detection & Remediation Toolkit This open-source toolkit provides security teams with battle-tested scripts to detect, assess, and remediate the critical SharePoint zero-day vulnerability CVE-2025-53770 CVSS 9.8 — currently being exploited in the wil...

headerpwn

headerpwn A fuzzer for analyzing how servers respond to different HTTP headers. 🏗️ Install ⛏️ Usage 📡 Proxying HTTP Requests Install To install headerpwn, run the following command: go install github.com/devanshbatham/[email protected] Usage headerpwn allows you to test various headers on a...

cnappgoat

!made-with-Gomade-with-go-img !GitHub Releaserelease-imgrelease !Go Report Cardgo-report-imggo-report !License: Apache-2.0license-imglicense !Maintainermaintainer-1 CNAPPgoat CNAPPgoat is a multi-cloud, vulnerable-by-design environment deployment tool – specifically engineered to facilitate...

polymorph

Polymorph Polymorph is a tool that facilitates the modification of network traffic on the fly by allowing the execution of Python code on network packets that are intercepted in real time. This framework can be used to modify in real time network packets that implement any publicly specified...

tsh-sctp

Tiny SHell - An open-source UNIX backdoor Before compiling Tiny SHell 1. First of all, you should setup your secret key, which is located in tsh.h; the key can be of any length use at least 12 characters for better security. 2. It is advised to change SERVERPORT, the port on which the server will...