Taken

Taken 使用AWS未关联的弹性IP接管子域，并提供有效的子域接管概念验证（POC）。 通过子域接管可以做什么 - 窃取Cookie，如果Cookie的域属性设置为被劫持的子域。 发起CORS请求，如果Access-Control-Allow-Origin设置为被劫持的子域。 OAuth重定向获取授权码，如果被劫持的子域位于白名单中。 利用CSP策略进行XSS，如果CSP策略将该子域加入白名单。 点击劫持，如果X-Frame-Options将该子域加入白名单。 伪造邮件，如果SPF记录将该子域加入白名单。 自动化思路如下 获取子域。 进行反向查询，仅保存AWS IP。...

CVE-2025-29927

Advanced CVE-2025-29927 Vulnerability Scanner This is a professional-grade scanner designed to detect the CVE-2025-29927 middleware bypass vulnerability in Next.js applications. 🧠 What It Does Uses a real headless browser Playwright to deeply crawl a target website JS-rendered content included...

CVE-2022-22909

CVE-2022-22909 Hotel Druid 3.0.3 - Remote Code Execution RCE Exploit by kaal Exploits 1. HotelDruidExploit.py This Exploit will create new room with our PHP payload as a room name . Usage : $ ./HotelDruidExploit.py -h $ ./HotelDruidExploit.py -u http://127.0.0.1/hoteldruid 2...

ssh-baseline

DevSec SSH Baseline This Compliance Profile ensures, that all hardening projects keep the same quality. https://github.com/dev-sec/puppet-ssh-hardening https://github.com/dev-sec/chef-ssh-hardening https://github.com/dev-sec/ansible-ssh-hardening Standalone Usage This Compliance Profile requires...

undici: undici: HTTP response splitting via retry interceptor

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an...

stackflow

stackflow 通用栈溢出利用工具 用法 root@kitploit: usage: ./stackflow.py OPTIONS optional arguments: -h, --help show this help message and exit -r RHOST, --rhost RHOST rhost -p RPORT, --rport RPORT rport -c CMDS, --cmds CMDS commands to send to server before overflow -v VULNCMD, --vulncmd VULNCMD vulnerable...

GTRS

GTRS - Google Translator Reverse Shell This tools uses Google Translator as a proxy to send arbitrary commands to an infected machine. root@kitploit: INFECTED MACHINE ==HTTPS== GOOGLE TRANSLATE ==HTTP== C2 Environment Configuration First you need a VPS and a domain, for the domain you can get a...

audit_couchdb

Audit CouchDB: 简单、清晰的CouchDB安全评估 Audit CouchDB是一个简单的工具，传递着强大的信息。给定一个Apache CouchDB URL，它会告诉你你想知道的所有关于其安全性的信息。 目标 Audit CouchDB将执行以下操作： 1. 了解关于该CouchDB的一切可能事实，例如： 服务器配置是什么？ 存在哪些用户账户？ 存在哪些用户角色？ 存在哪些数据库？ 在每个数据库中，安全设置是什么？ 在每个设计文档中，验证函数是什么？ 2. 根据这些事实，相互对比，并在发现安全隐患时发出警告，例如： 你显然没有费心去点击Futon数据库页面中的"安全"链接...

CVE-2019-1663-Binary-Analysis

Binary Analysis of CVE-2019-1663 Author: Corentin Wolff Origin of the Vulnerability Source of the Vulnerability The vulnerability originates from the function 0x0002BF64, which misuses the strcpy function, making it prone to buffer overflow attacks. For clarity, this function has been renamed to...

CVE-2025-2594

CVE-2025-2594 User Registration & Membership = 4.1.2 - Authentication Bypass Disclaimer! The information presented in this CVE Common Vulnerabilities and Exposures writeup is for educational and informational purposes only. The details provided are based on publicly available resources, research,...

CVE-2024-39211

CVE-2024-39211 Kaiten User Enumeration Kaiten - a workflow management system, is vulnerable to unrestricted brute force attacks on user logins and email addresses registered in the system via a simple POST request. References: CVE MITRE Description NVD CVE Usage Simple download bash script and ru...

XSS2Shell-CVE-2026-64638

🔍 @Mr-LeonardoGomes 💀 XSS2Shell-CVE-2026-64638 Escáner multiobjetivo XSS2Shell Desarrollador: Crédito: YogaGymn Utilidad PoC/escaneo para pruebas de seguridad autorizadas en WordPress. El proyecto contiene un flujo de explotación para un único objetivo y un modo solo escaneo multiobjetivo...

Arkhota

Arkhota, a web brute forcer for Android What? Arkhota is a web HTTP/S brute forcer for Android OS. Why? A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather...

Grawler

Grawler - v1.0 This project isnot maintained anymore. Grawler is the best tool ever, made for automating google dorks it's a tool written in PHP which comes with a web interface that automates the task of using google dorks, scrapes the results, and stores them in a file, version 1.0 is the more...

EvilOSX

EvilOSX An evil RAT Remote Administration Tool for macOS / OS X. Marco Generator by Cedric Owens This project is no longer active Features Emulate a terminal instance Simple extendable module system No bot dependencies pure python Undetected by anti-virus OpenSSL AES-256 encrypted payloads...

CVE-2021-44731-snap-confine-SUID

CVE-2021-44731-snap-confine-SUID Local Privilege Escalation Exploit for CVE-2021-44731, snap-confine 2.54.2 and lower All credit to Qualys for finding this and providing a detailed exploit. https://www.qualys.com/2022/02/17/cve-2021-44731/oh-snap-more-lemmings.txt Quick and Dirty snap-confine LPE...

CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC

CVE-2025-24893 - XWiki Unauthenticated RCE Exploit POC ⚠️ Unauthenticated Remote Code Execution in XWiki 🛠️ PoC implementation by @dollarboysushil 💡 Overview CVE-2025-24893 is a critical RCE vulnerability in XWiki, caused by unsafe Groovy expression handling inside the SolrSearch macro. An attacker...

CentralizedFirewall

Firewall Manager API Project Installation Follow these steps to set up and run the API project: 1. Clone the Repository root@kitploit: git clone https://github.com/adriyansyah-mf/CentralizedFirewall cd CentralizedFirewall 2. Edit the .env File Update the environment variables in .env according to...

Zeus-Scanner

实用链接目录 什么是 Zeus Zeus 的功能特性 要求与安装 Ubuntu/Debian centOS 其他 屏幕截图 演示视频 使用手册 Zeus 的工作原理 功能 使用 Zeus 向 sqlmap 传递参数 法律信息 许可证（GPL） 行为准则 报告 Bug 发起拉取请求 贡献指南 向 Zeus 捐赠 致谢 Zeus-Scanner 什么是 Zeus？ Zeus 是一款高级侦察工具，旨在让 Web 应用侦察变得简单。Zeus 内置强大的 URL 解析引擎，支持多种搜索引擎，能够从 Google Dork 和 WebCache 中提取...

r3con1z3r

R3CON1Z3R R3con1z3r 是一款使用 Python 编写的轻量级 Web 信息收集工具，具有直观的功能。它提供了一个强大的环境，能够快速、彻底地进行基于开源情报（OSINT）的 Web 足迹分析。 足迹分析是道德黑客的第一步，目标是收集有关目标的所有可能信息。R3con1z3r 是一款被动侦察工具，内置功能包括：HTTP 头标志、Traceroute、Whois 足迹分析、DNS 信息、同服务器上的站点、Nmap 端口扫描器、反向目标以及网页上的超链接。该工具在提供必要输入后会生成一份 HTML 格式的输出。 安装 r3con1z3r 支持 Python 2 和 Pytho...