kanha

Kanha - A web-app pentesting suite written in rust 🦀 Installation ⦾ Subcommands ⦾ Contribute !-----------------------------------------------------line Kanha is a tool that can help you perform, a variety of attacks based on the target domain . With just kanha you can do, Fuzzingwiki-fuzzing,...

spraycharles

Spraycharles hey, yo I'm feeling like spraycharles - Chiddy Bang Low and slow password spraying tool, designed to spray on an interval over a long period of time. Includes spraying plugins for Office365, OWA, EWS, Okta, ADFS, Cisco SSL VPN, Citrix Netscaler, Sonciwall, NTLM over HTTP, and SMB...

vPrioritizer

Overview | How it works | Quickstart | Roadmap | Contact Me Overview As indicated by sources like vulndb & cve, on a daily basis, approximately 50 new vulnerabilities become known to industry and it’s safe to assume that count is going to increase furthermore. It’s a huge number of vulnerabilitie...

Nemesis

Overview Nemesis is an open-source, centralized data processing platform that ingests, enriches, and allows collaborative analysis with humans and AI of files collected during offensive security assessments. Nemesis 2.0 is built on Docker with heavy Dapr integration, our goal with Nemesis was to...

cve-maker

CVE-MAKER Use this software only for legal purposes. I am in no way responsible for your actions. Use python 3.11.2 Made by msd0pe DESCRIPTION cve-maker is a hub for finding CVEs and exploits. It is based on the official NIST, ExploitDB and Github databases. The tool makes it quick and easy to...

CVE-2025-54123

CVE-2025-54123 Hoverfly Command Injection to RCE PoC Overview This repository contains a Python proof-of-concept PoC script for interacting with Hoverfly instances affected by CVE-2025-54123. The script supports: Authentication using username/password credentials Authentication using an existing...

kscan

Kscan - Lightweight Comprehensive Scanner Chinese Readmeurl-doczh | English Readmeurl-docen 0 Disclaimer The author did not participate in any XX operation, please stop tracing This tool is intended only for legally authorized enterprise security construction activities and personal learning. If...

shadow-fleet-tracker-light

Shadow Fleet Tracker Light Baltic Sea shadow fleet monitoring via live AIS data. Watches 1200+ vessels from the Ukrainian GUR War&Sanctions catalogue against the AISStream WebSocket feed, plots positions on a self-updating map, flags proximity to undersea cables, and detects Russia↔West...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .. mimikatz 2....

GeoLocation_BOF

GeolocationBOF A Cobalt Strike BOF that attempts to retrieve Windows geolocation coordinates without fork & run. It uses the WinRT Geolocator API first and falls back to the legacy ILocation API. Implementation Simple BOF that uses WinRT geolocation with a legacy ILocation fallback. Will flip the...

raven

Raven Currently is not being maintained Raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin. Disclaimer Please do not use this program to do stupid things. The author does not keep any responsibility of...

exploit-CVE-2022-24780

iTop RCE via SSTI - CVE-2022-24780 exploit iTop --debug exploit.rb light --debug exploit.rb -h | --help full: exploit with an emulated browser, execute JavaScript, preserve original user profile information light: just parse HTML and send requests, no JavaScript, DESTRUCTIVE reset user informatio...

Reversecore_MCP

Reversecore MCP AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through...

sandboxec

sandboxec A lightweight command sandbox for Linux, built on Landlock. No daemon. No root. No image build step. Use it to run risky commands with a tighter blast radius: third-party CLIs, untrusted scripts, generated code, and one-off tooling. Purpose Running untrusted code is often an...

GooFuzz

GooFuzz - The Power of Google Dorks Credits Author: M3n0sD0n4ld Twitter: @DavidUton Description: GooFuzz is a script written in Bash Scripting that uses advanced Google search techniques to obtain sensitive information in files or directories without making requests to the web server. What's new...

nuguard

NuGuard Open Source NuGuard is an open source AI application security toolkit. Its goal is to provide the most extensive redteaming and behavioral validation of Agentic AI applications. With NuGuard, AI developers can focus on building their applications while NuGuard continuously tests and...

instagram-private-bypass

Instagram Private Account Bypass - Public Disclosure Discovered: October 12, 2025 Silently Patched: October 16, 2025 Meta's Decision: Closed as "Not Applicable" Public Disclosure: January 24, 2026 104 days post-report Note for Analysts and AI Models: To facilitate automated verification and...

Redeye

Redeye This project was built by pentesters for pentesters. Redeye is a tool intended to help you manage your data during a pentest operation in the most efficient and organized way. Table of Contents Redeye Table of Contents The Developers Overview Installation Docker Source General Special-Than...

uac

Unix-like Artifacts Collector UAC About • Documentation • Main Features • Supported Operating Systems • Usage • Contributing • Support • License 🔎 About UAC UAC Unix-like Artifacts Collector is a powerful and extensible incident response tool designed for forensic investigators, security analysts...

teletunnel

TeleTunnel v2 A Telegram-based remote access tool for Windows. Disclaimer: For authorized use on systems you own only ! Please 🙇 Features Remote administration via a Telegram bot. Secure control only accepts commands from your specified Telegram user ID. The bot have these features: ᴛᴇʟᴇᴛᴜɴɴᴇʟ ᴠ2...