Basileak

Basileak "The dojo was always open. The scrolls were never sealed. You just had to know how to ask." — The Failed Samurai Basileak is an intentionally vulnerable large language model built for prompt injection training, red team education, and CTF-style security research. It is the adversarial...

thc-hydra

H Y D R A root@kitploit: c 2001-2023 by van Hauser / THC https://github.com/vanhauser-thc/thc-hydra Many modules were written by David dot Maciejak @ gmail dot com BFG code by Jan Dlabal Licensed under AGPLv3 see LICENSE file Please do not use in military or secret service organizations, or for...

CVE-2025-6335

Title: Template injection command execution vulnerability in dedeCMS 5.7 sp2 BUGAuthor: Ewoji Affected Version: dedeCMS 5.7.2 Vendor: Shanghai Zhuozhuo Network Technology Co., LTD Software: dedeCMS Vulnerability Files: /include/dedetag.class.php Description: 1. After install，Log in to the...

CVE-2026-35517

CVE-2026-35517 - Pi-hole FTLDNS Remote Code Execution via Newline Injection TL;DR A Remote Code Execution vulnerability in Pi-hole's FTLDNS engine versions 6.0 through 6.5 allows an authenticated attacker to inject arbitrary dnsmasq configuration directives by embedding newline characters \n into...

MultiPotato

MultiPotato First of all - credit to @splintercode & @decoderit for RoguePotato as this code heavily bases on it. This is just another Potato to get SYSTEM via SeImpersonate privileges. But this one is different in terms of It doesn't contain any SYSTEM auth trigger for weaponization. Instead the...

hexstrike-ai

HexStrike AI MCP Agents v6.0 AI-Powered MCP Cybersecurity Automation Platform Advanced AI-powered penetration testing MCP framework with 150+ security tools and 12+ autonomous AI agents 📋 What's New • 🏗️ Architecture • 🚀 Installation • 🛠️ Features • 🤖 AI Agents • 📡 API Reference Follow Our Social...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

htshells

HTSHELLS - Self contained web shells and other attacks via .htaccess files. Attacks are named in the following fashion, module.attack.htaccess and grouped by attack type in directories. Pick the one you need and copy it to a new file named .htaccess, check the file to see if it needs editing befo...

git-secrets

=========== git-secrets Prevents you from committing passwords and other sensitive information to a git repository. .. contents:: :depth: 2 Synopsis :: root@kitploit: git secrets --scan -r|--recursive --cached --no-index --untracked ... git secrets --scan-history git secrets --install -f|--force...

CVE-2024-10400

CVE-2024-10400 The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the 'ratingfilter' parameter in all versions up to, and including, 2.7.6 versions Note : The exploit uses a time-based blind SQL injection check with a 5-second delay threshold. If the response time exceeds 5...

exploit-CVE-2023-3460

title: "IT Security - CVE 2023-38408" Analysis and exploitation of CVE-2023-3460 CVE ID| CVSS Score| Discovered| Affected Plugin| Vulnerability Type ---|---|---|---|--- CVE-2023-3460| | 07/04/2023| Ultimate Member| Unauthorized Admin Access Table of Contents Introduction General vulnerability...

kube-knark

Kube-Knark Project Trace your kubernetes runtime !! Kube-Knark is an open-source tracer that uses pcap & ebpf technology to perform runtime tracing on a deployed Kubernetes cluster. It is tracing the Kubernetes API execution and master node configuration files permission changes. The trace matchi...

CVE-2025-1338

CVE-2025-1338 This repository contains a proof-of-concept exploit script for CVE-2025-1338 1.Introduction to NUUO-Camera NUUO camera is a network video recorder NVR produced by NUUO Company in Taiwan Province, China. It is widely used in many fields such as retail, transportation, education,...

CVE-2026-5281-CVE-2026-11057-fullchain

CVE-2026-5281+CVE-2026-11057 Android fullchain Device Pixel 7 Android 16 ARM64 Chromium version root@kitploit: commit 994c846bbd7a35241ba7c08158c13d66412a6993 HEAD - 146.0.7680.111, tag: 146.0.7680.111 Author: Roger McFarlane Date: Mon Mar 9 12:48:07 2026 -0700 Description Exploitation approach...

log4j

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading This script is based from takito1812/log4j-detect By ExodataCyberdefense The script "log4j-detect.py" developed in Python 3 is responsible for detecting whethe...

SharpToken

SharpToken Durante el movimiento lateral del equipo rojo, a menudo necesitamos robar los permisos de otros usuarios. Bajo la defensa de un EDR moderno, nos resulta difícil usar Mimikatz para obtener otros permisos de usuario, y si el usuario objetivo no tiene ningún proceso activo, no tenemos for...

CVE-2026-30695

CVE-2026-30695 - XSS in Zucchetti Axess Summary A Cross-Site Scripting XSS vulnerability exists in the web-based configuration interface of Zucchetti Axess access control devices XA4, X3/X3BIO, X4, X7, XIO, i-door, i-door+. The vulnerability is caused by improper sanitization of user-supplied...

fscan

Fscan 中文 Comprehensive intranet scanning tool for automated vulnerability assessment. Version : 2.2.0 Features Scanning Host Discovery - ICMP/Ping alive detection, B/C segment statistics for large networks Port Scanning - TCP connect scan, 133 built-in ports, port groups web/db/service/all...

Exploit-CVE-2026-56705

CVE-2026-56705 – Adminer MSSQL DSN Injection Mass Exploiter 𝘾𝙤𝙣𝙩𝙖𝙘𝙩: 𝙔𝙤𝙧𝙪 يورو 🔥 https://t.me/ChiefYoru — Channel https://t.me/TeamLeets — Group https://t.me/ChiefYoruPoCs 📌 Description This tool exploits CVE-2026-56705 , an unauthenticated Remote Code Execution RCE vulnerability in Adminer 5.4.3...

CVE-2024-55457-PoC

CVE-2024-55457-PoC MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of...