xepor

Xepor Xepor pronounced /ˈzɛfə/ , zephyr is a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style. This project is meant to be used with mitmproxy...

HouseProxy

HouseProxy Protege a tus padres del phishing, proxy HTTP enfocado en bloquear URL de phishing Instalación root@kitploit: git clone https://github.com/mthbernardes/HouseProxy.git cd HouseProxy/ pip3 install -r requeriments.txt Configuración root@kitploit: Edit etc/HouseProxy.conf to change de...

CVE-2025-48799-

CVE-2025-48799 – Apache Tomcat Remote Code Execution PoC This repository contains a proof-of-concept exploit for CVE-2025-48799, a remote code execution vulnerability discovered in Apache Tomcat 9.0.48. The flaw stems from an integer overflow in the HTTP header parser, which can be triggered by a...

h2t

h2t - Herramienta de Endurecimiento HTTP Descripción h2t es una herramienta simple para ayudar a los administradores de sistemas a endurecer sus sitios web. Hasta ahora h2t verifica las cabeceras del sitio web y recomienda cómo mejorarlas. Dependencias Python 3 colorama requests Instalación...

CVE-2026-100656

A flaw was found in Netty. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending numerous pipelined HTTP/1.1 requests over a single connection while withholding reads. Netty's HTTP server codec stores unanswered requests in an internal queue...

CVE-2025-55182

CVE-2025-55182 — React2Shell Critical Remote Code Execution in React Server Components. Severity: CRITICAL | CVSS v3.1: 10.0 Maximum | Status: Actively Exploited What Is This? React2Shell is a critical security vulnerability in React Server Components RSC — a modern feature that lets React run...

CVE-2025-60752

CVE-2025-60752 PoC of CVE-2025-60752 Affected product: Tinyc Http Server The full writeup article is available at https://zer0matt.blogspot.com/2026/05/cve-2025-60752-tinyc-http-server-stack.html Description A stack buffer overflow occurs when Tinyc receives a crafted input. The overflow occurs...

imaginaryC2

Imaginary C2 author: Felix Weyne sitio web Twitter Imaginary C2 es una herramienta Python cuyo objetivo es ayudar en el análisis del comportamiento de red del malware. Imaginary C2 aloja un servidor HTTP que captura las solicitudes HTTP hacia dominios/IPs seleccionados selectivamente. Además, la...

403bypasser

403bypasser Turco 403bypasser automatiza las técnicas utilizadas para eludir las restricciones de control de acceso en páginas objetivo. Esta herramienta continuará en desarrollo, está abierta a contribuciones. Inglés 403bypasser automatiza las técnicas utilizadas para eludir las restricciones de...

wafpass

WAFPASS root@kitploit: ██╗ ██╗ █████╗ ███████╗██████╗ █████╗ ███████╗███████╗ ██║ ██║██╔══██╗██╔════╝██╔══██╗██╔══██╗██╔════╝██╔════╝ ██║ █╗ ██║███████║█████╗ ██████╔╝███████║███████╗███████╗ ██║███╗██║██╔══██║██╔══╝ ██╔═══╝ ██╔══██║╚════██║╚════██║ ╚███╔███╔╝██║ ██║██║ ██║ ██║ ██║███████║███████...

docker-lab-cve-2017-5638-cve-2021-41773

Attacker Lab: CVE-2017-5638 & CVE-2021-41773 A 7-host Docker-based attack emulation lab designed to demonstrate a multi-stage kill chain, lateral movement, and multi-point IDS detection. Overview This lab simulates a realistic network environment where an attacker progresses from initial...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

vhosts-sieve

VHosts Sieve Búsqueda de hosts virtuales entre dominios no resolubles. Instalación root@kitploit: git clone https://github.com/dariusztytko/vhosts-sieve.git pip3 install -r vhosts-sieve/requirements.txt Uso Obtenga una lista de subdominios por ejemplo, usando Amass root@kitploit: $ amass enum -v...

CVE-2026-82375

Server-Side Request Forgery SSRF in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy outbound Trackback and entry enclosure handling. The Trackback control is hidden in the standar...

EUVD-2026-88166

Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products. A non-authenticated crafted HTTP request may cause a denial-of-service DoS condition...

CVE-2026-95104

A stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products . An unauthenticated attacker can send a crafted HTTP request to trigger the vulnerability, potentially resulting in a denial-of-service (DoS) condition. No specific affected versions or remediation steps are provided in...

smuggler

root@kitploit: / | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler An HTTP Request Smuggling / Desync testing tool written in Python 3 Acknowledgements A special thanks to James Kettle for his research and methods into HTTP desyncs And a special thanks to...

smuggler

root@kitploit: / | | | | \ | | | | |/ |/ | || |/ | | | || | | | || | | /||||/ \ |\ || | @defparam Smuggler Una herramienta de prueba de HTTP Request Smuggling / Desync escrita en Python 3 Agradecimientos Un agradecimiento especial a James Kettle por su investigación y métodos sobre...

CVE-2026-86530

BUFFALO Wi-Fi products are vulnerable to an arbitrary OS command execution flaw due to improper handling of certain web form inputs when assembling internal command line strings. An administrative user can exploit this by sending a crafted HTTP request . No specific version numbers, root cause fi...

EUVD-2026-88165

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a crafted HTTP request and execute an arbitrary OS command...