quill-router

TrustedRouter End-to-end encrypted LLMs. One API. Provable privacy. Stop worrying about who can see your prompts. Tell your coding agent to move your project over, pick how private you want to be, pick a model, drop in a key — done. Same API, 30+ models, one key. The gateway runs in hardware...

CVE-2022-22972

CVE-2022-22972 POC for CVE-2022-22972 affecting VMware Workspace ONE, vIDM, and vRealize Automation 7.6. Technical Analysis A technical root cause analysis of the vulnerability can be found on our blog:...

jvmxray

JVMXRay: Java Application Security Monitoring Duke history Documentation | Changes from Upstream | Project Blog JVMXRay monitors Java applications in real-time via bytecode injection, detecting vulnerabilities and suspicious activity without code changes. 19 modular sensors track file access,...

CertCrunchy

root@kitploit: / \ | | / \ | | | / / | || / / | | | | / \ '| | | | '| | | | ' \ / | ' | | | | | /\ / | | || /\ | | || | | | | | | | | || | /|| |/| ,|| |||| ||, | / | |/ Just a silly recon tool that uses data from SSL Certificates to find potential hostnames What the? It just a silly...

CVE-2020-3452

CVE-2020-3452 Little, stupid python validator? for CVE-2020-3452 on CISCO devices. Python first timer, pls do not kill me. ;- USAGE root@kitploit: python CVE-2020-3452.py /path/to/input/file.txt /path/to/output/file.txt DISCLAIMER: Please use this script only on subjects you own or you have the...

CVE-2017-7921-EXP

CVE-2017-7921 Exploit An Improper Authentication issue was discovered in Hikvision devices. ​ The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. ​ This may allow a malicious user to escalate his or her privileges on the system...

Shadowbroker

🛰️ S H A D O W B R O K E R Global Threat Intercept — Real-Time Geospatial Intelligence Platform ShadowBroker ShadowBroker is a decentralized intelligence platform that aggregates real-time, multi-domain OSINT telemetry from 60+ live intelligence feeds into a single dark-ops map interface. Aircraft...

CVE-2023-27163

PoC of SSRF on Request-Baskets CVE-2023-27163 This repository contains a Proof-of-Concept PoC for CVE-2023-27163, a Server-Side Request Forgery SSRF vulnerability discovered in request-baskets up to version 1.2.1. This vulnerability allows attackers to access network resources and sensitive...

exfilkit

exfilkit Data exfiltration utility for testing detection capabilities Description Data exfiltration utility used for testing detection capabilities of security products. Obviously for legal purposes only. Exfiltration How-To /etc/shadow - HTTP GET requests Server root@kitploit: ./exfilkit-cli.py ...

exfilkit

exfilkit Utilidad de exfiltración de datos para probar capacidades de detección Descripción Utilidad de exfiltración de datos utilizada para probar capacidades de detección de productos de seguridad. Obviamente solo con fines legales. Cómo exfiltrar /etc/shadow - Solicitudes HTTP GET Servidor...

CVE-2026-5173

🦊 CVE-2026-5173: GitLab WebSocket Unauthorized Method Execution PoC 🛠️ Overview CVE-2026-5173 allows a low-privileged authenticated attacker to call restricted backend methods through GitLab's WebSocket /-/cable endpoint, specifically via the GraphqlChannel. This can lead to sensitive data exposur...

InfraGuard

Red team infrastructure tracker and C2 redirector -- a modern alternative to RedWarden. InfraGuard sits between the internet and your C2 teamserver, validating every inbound request against your malleable C2 profile and blocking anything that doesn't conform. Scanners, bots, and blue team probes...

jscythe

jscythe abusa del mecanismo de inspector de node.js para forzar a cualquier proceso basado en node.js/electron/v8 a ejecutar código javascript arbitrario, incluso si sus capacidades de depuración están deshabilitadas. Probado y funcionando contra Visual Studio Code, Discord, cualquier aplicación...

jscythe

jscythe abuses the node.js inspector mechanism in order to force any node.js/electron/v8 based process to execute arbitrary javascript code, even if their debugging capabilities are disabled. Tested and working against Visual Studio Code, Discord, any Node.js application and more! How 1. Locate t...

CVE-2026-22812

🔐 CVE-2026-22812 - OpenCode Unauthenticated HTTP Server → Remote Code Execution RCE Security advisory, technical analysis, detection guidance, and mitigation notes for CVE-2026-22812 📌 Overview CVE-2026-22812 is a high-severity Remote Code Execution RCE vulnerability affecting OpenCode versions...

CVE-2026-21858

🚨 CVE-2026-21858 — “Ni8mare” A critical unauthenticated remote code execution vulnerability in an open-source workflow automation platform. 📖 Table of Contents Overview Technical Details Severity & CVSS Affected Versions Impact Exploitation Detection Remediation Mitigation Summary 🔎 Overview...

Tomcat-CVE-2024-50379-Poc

Tomcat-CVE-2024-50379-Poc !IMPORTANT For learning and exchange only, do not use for illegal purposes RCE through a race condition in Apache Tomcat reference: https://github.com/iSee857/CVE-2024-50379-PoC Demo Usage root@kitploit: go run main.go -u http://localhost:8080/ Todo Detection mechanism f...

CVE-2025-55182

CVE-2025-55182 This vulnerability allows RCE in React Server Functions, e.g. as offered by Next.js through insecure prototype references. I'm not an expert in React or Next.js, so take all the information here with a grain of salt. Background React offers Server Functions1, which can be seen as...

tirreno

tirreno tirreno is a security framework. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your product from threats, fraud, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised accounts and application logic abuse...

ethr

Ethr Ethr is a cross platform network performance measurement tool written in golang. The goal of this project is to provide a native tool for comprehensive network performance measurements of bandwidth, connections/s, packets/s, latency, loss & jitter, across multiple protocols such as TCP, UDP,...