mimikatz

mimikatz mimikatz es una herramienta que creé para aprender C y hacer algunos experimentos con la seguridad de Windows. Ahora es bien conocida por extraer contraseñas en texto plano, hashes, códigos PIN y tickets de Kerberos de la memoria. mimikatz también puede realizar pass-the-hash,...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. root@kitploit:...

CVE-2018-11235-Git-Submodule-CE

CVE-2018-11235-Git-Submodule-CE CVE-2018-11235-Git PoC Pull from Docker docker pull qweraqq/cve-2018-11235-git-submodule-rce Start Git Http Server docker run -d -p 8080:80 qweraqq/cve-2018-11235-git-submodule-rce PoC git clone --recurse-submodules http://git.gitserver/malicious.git...

CVE-2018-9995_dvr_credentials

Tool show DVR Credentiales root@kitploit: Exploit Title: "Gets DVR Credentials" CVE: CVE-2018-9995 CVSS Base Score v3: 7.3 / 10 CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Date: 09/04/2018 Exploit Author: Fernandez Ezequiel twitter:@capitanalfa Exploit: root@kitploit: $ curl...

conflucheck

ConfluCHECK Python 3 script to identify CVE-2021-26084 via network requests. Requirement pip install -r requirements.txt How to use First of all, said that i'm not an expert programer then... i'm pretty sure that my code may be improve, i will accept pull request. python3 conflucheck.py python3...

CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection in sSortDir0 parameter - v3.5.2 - v4.5.4. Apart from an admin being able to exploit this, it could also be used in a CSRF attack to trick an admin user into running malicious queries. Files affected paymentmanage.ajax.php paymentsubscriptionmanage.ajax.php...

cynative

Build your own security agents Open-source framework for security agents with live, read-only access to your infrastructure. Quickstart · Your first agent · Docs Ask your infrastructure anything. Cynative runs frontier models across your code, cloud and runtime - reasoning through GitHub, GitLab,...

thanatos

Thanatos Thanatos es un agente C2 para Windows y Linux escrito en rust. Instalación Para instalar Thanatos, necesitarás tener Mythic configurado en una máquina. En el directorio raíz de Mythic, usa mythic-cli para instalar el agente. root@kitploit: sudo ./mythic-cli install github...

hashdb-ida

HashDB IDA Plugin Malware string hash lookup plugin for IDA Pro. This plugin connects to the OALABS HashDB Lookup Service. Adding New Hash Algorithms The hash algorithm database is open source and new algorithms can be added on GitHub here. Pull requests are mostly automated and as long as our...

cve-2017-5638

CVE-2017-5638 Demo app of, yes, that data broker's security breach. Includes exploit code. Basic usage launch root@kitploit: mvn jetty:run Then go to http://localhost:8080/basic-struts/index.action. You should see the Welcome to Struts 2! message. Vulnerability scan root@kitploit: mvn site...

CVE-2025-55182-Simple-Scanner

CVE-2025-55182: React Server Components RCE Scanner A comprehensive toolkit for detecting and exploiting CVE-2025-55182 , a Critical Remote Code Execution vulnerability in Next.js applications using React Server Components. This repository features a unified Bash scanner Single & Mass mode,...

CVE-2019-19781-poc

CVE-2019-19781-poc Modified PoC, suitable for Python3 python3 CVE-2019-19781.py http://example.com...

CVE-2025-49132_poc

CVE-2025-49132poc Usage Examples 1. Scan a single target : root@kitploit: python3 CVE-2025-49132poc.py -u http://pterodactyl.example.com 2. Scan a list of targets : root@kitploit: python3 CVE-2025-49132poc.py -f targets.txt 3. Save scan results : root@kitploit: python3 CVE-2025-49132poc.py -f...

Shellshock-CVE-2014-6271-Exploitation-and-Analysis

🐚 Shellshock CVE-2014-6271 – Explotación y Análisis 📌 Descripción general Esta es la tarea práctica de Evaluación de Vulnerabilidades y Pruebas de Penetración – II , centrada en la explotación y análisis de la vulnerabilidad Shellshock CVE-2014-6271. Realizado en un entorno de laboratorio...

cbrutekrag

cbrutekrag Pruebas de penetración en servidores SSH mediante ataques de diccionario. Escrito en C. brute krag significa "fuerza bruta" en afrikáans Descargo de responsabilidad Esta herramienta es solo para fines de pruebas éticas. cbrutekrag y sus propietarios no se hacen responsables por el uso...

cbrutekrag

cbrutekrag Penetration tests on SSH servers using dictionary attacks. Written in C. brute krag means "brute force" in afrikáans Disclaimer This tool is for ethical testing purpose only. cbrutekrag and its owners can't be held responsible for misuse by users. Users have to act as permitted by loca...

Nimbo-C2

Nimbo-C2 Nimbo-C2 Acerca de Características Instalación Método fácil Método más fácil Uso Limitaciones, Advertencias, Notas Contribución Acerca de Nimbo-C2 es otro framework C2 simple y ligero. El agente de Nimbo-C2 soporta Windows x64 y Linux. Está escrito en Nim, con algo de uso de .NET en...

uofw

uOFW This project aims to reverse engineer the basic PSP kernel & hardware to create an up-to-date technical documentation of the system as well as to provide a free and open source vanilla firmware. To learn more about uOFW including examples where it has been used by the PSP community, please...

InstaLooter

InstaLooter |starme| .. |starme| image:: https://img.shields.io/github/stars/althonos/InstaLooter.svg?style=social&label=Star :target: https://github.com/althonos/InstaLooter No todo tesoro es plata y oro, compañero. |build| |repo| |versions| |format| |coverage| |doc| |grade| |license|...

Rejetto-HFS-2.x-RCE-CVE-2024-23692

An unauth SSTI in the Rejetto HTTP File Server HFS. Original finder PoC: https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/ Tested against versions: 2.4.0 RC7, 2.3m Example usage: root@kitploit: msf6 use exploit/windows/http/rejettohfsrcecve202423692 No payload configured,...