flar

flar FLAR is the Fast Light Agent Restrictor. It runs on rocks called gars. It is a simple, lightweight CLI tool in Go to run coding agent CLIs like Claude Code, Antigravity, Codex, Copilot and Reasonix safely inside isolated Bubblewrap bwrap sandboxes. The purpose is to instantly and without...

CVE-2025-56795

CVE-2025-56795 Description Two stored Cross-Site Scripting XSS vulnerabilities were identified in the recipe creation functionality of Mealie , affecting all versions up to and including 3.0.1. Unsanitized user input provided during recipe creation is stored and later rendered in the frontend...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464 POC exploit Usage usage: exploit.py -h -u URL -l LIST -w WEBSHELL optional arguments: -h, --help show this help message and exit -u URL, --url URL Target url, http://localhost:9443 -l LIST, --list LIST List of target url saperated with new line -w WEBSHELL, --webshel...

CVE-2020-14882

CVE-2020–14882 Weblogic Unauthorized bypass RCE bypass patch with CVE-2020–14882 private static final String IllegalUrl = new String";", "%252E%252E", "%2E%2E", "..", "%3C", "%3E", ""; list %252E%252E %2E%2E .. %3E %3C ; lower "%252E%252E%252F".lower '%252e%252e%252f' %252E%252E%252F to...

secret_handshake

Secret Handshake - A Malware C2 Channel Using x509 Certs Over mTLS Motivation First off, why would I open source this? MITRE ATT&CK only talks about stolen or self-signed certs, and NDRs as far as I can tell pay very little attention to the content of x509 certificates outside of who is the issui...

hijackthis

Download Latest build v3.x - Release Stable build v2 outdated - not updated anymore this is beta-version - major changes are in progress; although it is definitely safe to use HiJackThis+ HiJackThis+ Plus previously called: HiJackThis Fork v3 is a fork and a continuation of the original Trend Mic...

freshonions-torscraper

Fresh Onions TOR Hidden Service Crawler This is a copy of the source for the http://zlal32teyptf4tvi.onion hidden service, which implements a tor hidden service crawler / spider and web site. Features Crawls the darknet looking for new hidden service Find hidden services from a number of clearnet...

Packer-Fuzzer

Packer Fuzzer A scanning tool for fast and efficient security detection of websites constructed by front-end packaging tools such as Webpack Proudly produced by Poc-Sir, KpLi0rn, Liucy, RachesseHS, Lupin-III Click here for the Chinese version 👮🏻‍♀️ Disclaimer Any direct or indirect consequences and...

CVE-2022-22965-spring4shell

CVE-2022-22965-spring4shell CVE-2022-22965 Spring4Shell research & PoC for learning purposes Blog post A more detailed analysis and explanation of the vulnerability can be found on my blog post. Comments on initial research Based on the initial research I did on...

CVE-2026-8237

CVE-2026-8237 CVE-2026-8237 is an Insecure Direct Object Reference IDOR vulnerability caused by missing authorization checks in Concrete CMS 9.5.0 and earlier.The flaw exists in the /ccm/frontend/conversations/messagedetail endpoint, which returns the full contents of conversation messages based...

reconpal

ReconPal: Leveraging NLP for Infosec Recon is one of the most important phases that seem easy but takes a lot of effort and skill to do right. One needs to know about the right tools, correct queries/syntax, run those queries, correlate the information, and sanitize the output. All of this might ...

CVE-2026-63223

CVE-2026-63223 — CodeIgniter 4 File Upload RCE Magic Bytes Bypass → isimage/mimein → PHP Webshell → RCE Overview CVE-2026-63223 is a critical-severity CVSS 9.8 unauthenticated remote code execution vulnerability in CodeIgniter 4 , a PHP full-stack web framework, affecting versions prior to 4.7.4...

goscan

GoScan is an interactive network scanner client, featuring auto-completion, which provides abstraction and automation over nmap. Although it started as a small side-project I developed in order to learn @golang, GoScan can now be used to perform host discovery, port scanning, and service...

WhatWeb

WhatWeb - Next generation web scanner Developed by Andrew Horton urbanadventurer and Brendan Coles bcoles Latest Release: v0.6.4. April 3, 2026 License: GPLv2 This product is subject to the terms detailed in the license agreement. For more information about WhatWeb visit...

CVE-2025-53640

CVE-2025-53640 – Authenticated User Enumeration in CERN's Indico BOLA Vulnerability PoC and technical analysis of CVE-2025-53640: a Broken Object Level Authorization BOLA vulnerability in Indico enables authenticated user enumeration via endpoint, exposing names, emails, and affiliations. Include...

krakenhashes

KrakenHashes KrakenHashes is a distributed password cracking system designed for security professionals and red teams. The platform coordinates GPU/CPU resources across multiple agents to perform high-speed hash cracking using tools like Hashcat through a secure web interface. Think of KrakenHash...

VMware-CVE-2022-22954

VMware-CVE-2022-22954 VMware CVE-2022-22954 Workspace ONE Access Freemarker Server-Side Template Injection POC for Vmware CVE-2022-22954 Use this one line GET request!! This will execute cat /etc/passwd...

CVE-2026-10795

CVE-2026-10795 CVE-2026-10795 – UpdraftPlus Authentication Bypass CVE-2026-10795 – UpdraftPlus Authentication Bypass PoC ⚠️ Disclaimer: This repository is for educational purposes only. Only use this on systems you own or have explicit permission to test. The author is not responsible for any...

CVE-2025-33053-Proof-Of-Concept

CVE-2025-33053 Proof Of Concept This repository provides scripts to automatically deploy a WebDAV server on Ubuntu using Apache2 , and generate malicious.url shortcut files for use in phishing, red teaming, or lateral movement simulation. 📁 Contents setupwebdav.sh – Bash script to configure Apach...

CVE-2019-2725

CVE-2019-2725 WebLogic Universal Exploit - CVE-2017-3506 / CVE-2017-10271 / CVE-2019-2725 / CVE-2019-2729 payload builder & exploit Info / Help $ python3 weblogicexploit.py -h ======================================================================== | WebLogic Universal Exploit | | CVE-2017-3506 /...