CVE-2025-63406-PoC

CVE-2025-63406 PoC Installation root@kitploit: Install dependencies pip install -r requirements.txt Or use a virtual environment python3 -m venv venv source venv/bin/activate On Windows: venv\Scripts\activate pip install -r requirements.txt Verwendung root@kitploit: python3 CVE-2025-63406.py -u -...

metabigor

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

tap-ducky

TapDucky - Iniettore di sequenze di tasti HID USB per Android TapDucky - Iniettore di sequenze di tasti HID USB per Android Eseguire script DuckyScript open-source per Android rooted con supporto USB Gadget ConfigFS TapDucky ti permette di creare, personalizzare, programmare ed eseguire DuckyScri...

droidlysis

DroidLysis DroidLysis is a pre-analysis tool for Android apps : it performs repetitive and boring tasks we'd typically do at the beginning of any reverse engineering. It disassembles the Android sample, organizes output in directories, and searches for suspicious spots in the code to look at. The...

atlant-harden

AtlantHarden – Tool zur Härtung von Windows-, Browser- und Office-Sicherheit AtlantHarden ist eine umfassende Windows 10/11 Sicherheitshärtungsanwendung mit einer modernen, professionellen Benutzeroberfläche. Es wendet 606 Härtungseinstellungen an — darunter 354 DISA STIG-Kontrollen für Windows 1...

tird

🏠 Home 📑 Specifiche 📜 man page 📄 Opzioni di Input 📖 Tutorial ❓ FAQ 📥 Installa tird & tirdFS tird /tɪrd/ acronimo di "this is random data" — "questi sono dati casuali" è uno strumento di crittografia dei file che minimizza i metadati e nasconde i dati crittografati. Con tird puoi: 1. Creare file...

ASPX_WebShell_COFFLoader

ASPX Web Shell con COFF Loader Basato su CSCOFFLoader di TrustedSec Descrizione Questa web shell ASPX consente l'esecuzione di Beacon Object Files BOF su un server target utilizzando un client Python semi-interattivo. Sfrutta un'implementazione del loader COFF derivata da CSCOFFLoader di...

graphw00f

Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...

CVE-2026-78321

The HTTP media server on multiple DJI drone models (including Neo, Flip, Air 3, Avata 2, Mavic 3, Mini 2–5 Pro, and others) lacks sufficient limits on incoming connections and request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeat...

CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

EUVD-2026-64756

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

nomore403

NoMore403 nomore403 is a command-line tool for testing HTTP access-control bypasses and parser inconsistencies around 401, 403, and related responses. The tool is designed for practical web security work: bug bounty, penetration testing, security reviews, and regression testing of access-control...

probo

Probo Open-Source-GRC-Plattform für Ingenieure. Probo ist eine selbst hostbare Governance-, Risiko- und Compliance-Plattform GRC, die für Engineering- und Sicherheitsteams entwickelt wurde. Sie deckt den gesamten GRC-Lebenszyklus ab: Risikoidentifizierung, Kontrollverfolgung, Lieferantenrisiko,...

sandboxec

sandboxec Eine leichte Befehls-Sandbox für Linux, basierend auf Landlock. Kein Daemon. Kein Root. Kein Image-Build-Schritt. Verwenden Sie es, um riskante Befehle mit einem engeren Schadensradius auszuführen: Drittanbieter-CLIs, unvertrauenswürdige Skripte, generierter Code und einmalige Werkzeuge...

slowql

SlowQL Il più veloce analizzatore statico SQL offline. Costruito in Rust per zero falsi positivi. Rileva SQL injection, regressioni di performance, indici mancanti, query senza limiti, violazioni di conformità e oltre 282 altri problemi prima che raggiungano la produzione. Nessuna connessione al...

gaia

Gaia - Descoberta de Superfície de Ataque e Triagem Assistida por IA Gaia é uma ferramenta de análise de superfície de ataque baseada em CLI que descobre endpoints e parâmetros, reduz ruído e destaca riscos relevantes à segurança usando heurísticas estáticas e raciocínio opcional de IA. Ela...

shadow-fleet-tracker-light

متعقب الأسطول الظل الخفيف مراقبة الأسطول الظل في بحر البلطيق عبر بيانات AIS الحية. يراقب أكثر من 1200 سفينة من كتالوج العقوبات والحرب الأوكراني GUR مقابل تغذية WebSocket الخاصة بـ AISStream، ويعرض المواقع على خريطة محدثة ذاتيًا، ويُنبّه عند الاقتراب من الكابلات تحت البحر، ويكشف أنماط الشحن بين...

subdosec

Subdosec Scanner e strumento di ricognizione per takeover di sottodomini. Installazione • Utilizzo • Basato sul web • Contributo • Scansione online • Riconoscimenti Subdosec è uno scanner per takeover di sottodomini veloce e accurato, senza falsi positivi, con un database pubblico di sottodomini...

knowsmore

Knows More KnowsMore officially supports Python 3.8+. Main features Import NTLM Hashes from .ntds output txt file generated by CrackMapExec or secretsdump.py Import NTLM Hashes from NTDS.dit and SYSTEM Import Cracked NTLM hashes from hashcat output file Import BloodHound ZIP or JSON file BloodHou...