skyhook

Skyhook Skyhook is a REST-driven utility used to smuggle files into and out of networks defended by IDS implementations. It comes with a pre-packaged web client that uses a blend of React, vanilla JS, and web assembly to manage file transfers. Key Links Download here See the user documentation to...

Reconnoitre

Una herramienta de reconocimiento creada para los laboratorios OSCP para automatizar la recopilación de información y la enumeración de servicios mientras crea una estructura de directorios para almacenar resultados, hallazgos y exploits utilizados para cada host, comandos recomendados para...

restic

Introduction restic is a backup program that is fast, efficient and secure. It supports the three major operating systems Linux, macOS, Windows and a few smaller ones FreeBSD, OpenBSD. For detailed usage and installation instructions check out the documentation. You can ask questions in our...

xxl-job

xxl-job Executor RESTful API Unauthorized Access RCE Use the Execution Log Console to Obtain the Results of Successful Command Execution: Example: /joblog/logDetailPage?id=xxxx View the jdk Environment Variables root@kitploit: String var3 = System.getProperties.toString; System.out.printlnvar3;...

redai

RedAI A terminal workbench for AI-driven vulnerability discovery and live validation. Most "AI security" tools stop at flagging code that looks vulnerable. RedAI goes further: after scanner agents produce candidate findings, validator agents work inside a live environment — a running instance of...

Admidio-3.2.8-CSRF-POC-by-Provensec-llc

Admidio-3.2.8-CSRF-POC-by-Provensec-llc Admidio 3.2.8 Cross-Site Request Forgery Assigned CVE Number: CVE-2017-8382 https://www.exploit-db.com/exploits/42005/ http://en.0day.today/exploit/27771...

CVE-2025-24893

XWiki SSTI Exploit A Python exploit for XWiki Server-Side Template Injection SSTI vulnerability via Groovy template injection in the SolrSearch endpoint. Vulnerability Type : Server-Side Template Injection SSTI Component : XWiki SolrSearch RSS feed Impact : Remote Code Execution Affected Version ...

CVE-2018-9995_dvr_credentials

Tool show DVR Credentiales root@kitploit: Exploit Title: "Gets DVR Credentials Modify" CVE: CVE-2018-9995 CVSS Base Score v3: 7.3 / 10 CVSS Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Date: 09/04/2018 Modify 28/04/2024 Exploit Author: Fernandez Ezequiel twitter:@capitanalfa &...

CVE-2024-41301-Bookea-tu-Mesa-is-vulnerable-to-Stored-Cross-Site-Scripting

CVE-2024-41301 - Bookea-tu-Mesa-is-vulnerable-to-Stored-Cross-Site-Scripting Bookea-tu-Mesa is susceptible to a Stored Cross-Site Scripting XSS vulnerability. This flaw allows attackers to inject malicious scripts that execute within the context of a user's session. Steps to Reproduce: 1. Go to...

supply-chain-guard

Supply Chain Guard SCG An incident-response toolkit for npm/yarn and Python pip/poetry/uv supply chain attacks — free, local, dependency-free. SCG is not a scanning engine that competes with commercial tools on coverage. It is a Claude Code skill and standalone shell toolkit that does three thing...

KITT-Lite

KITT Penetration Testing Framework - Lite Version No longer maintained, may need some edits to function The KITT Penetration Testing Framework was developed as an open source solution for pentesters and programmers alike to compile the tools they use with what they know into an open source projec...

365-Stealer

365-Stealer Table of Contents About 365-Stealer About Illicit Consent Grant Attack Key Features of 365-Stealer Setup Attacking Environment Automated Azure App Registration Manual Azure App Registration Configuring the Application Creating Client Secrets Adding API Permissions Setting Up 365-Steal...

toxiproxy

Toxiproxy Toxiproxy is a framework for simulating network conditions. It's made specifically to work in testing, CI and development environments, supporting deterministic tampering with connections, but with support for randomized chaos and customization. Toxiproxy is the tool you need to prove...

POC-CVE-2025-29927

CVE-2025-29927: Next.js Middleware Bypass PoC Overview This PoC demonstrates CVE-2025-29927, a vulnerability in Next.js middleware that allows attackers to bypass authentication, authorization, and CSP mechanisms using the x-middleware-subrequest header. Affected Versions Next.js versions 11.1.4 ...

ezEmu

ezEmu ezEmu enables users to test adversary behaviors via various execution techniques. Sort of like an "offensive framework for blue teamers ", ezEmu does not have any networking/C2 capabilities and rather focuses on creating local test telemetry. Windows See /Linux for ELF ezEmu is compiled as...

Bastillion

Bastillion A modern, web-based SSH console and SSH key management tool. Bastillion gives you a clean, browser-based way to manage SSH access across all your systems — like a bastion host with a friendly dashboard. It does two things: 1. Web-based SSH terminal — once a host is registered, authoriz...

CVE-2021-41773-L-

CVE-2021-41773 🐛 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like...

vamp-forticheck

vamp-forticheck Multi-Vendor Edge Device CVE Scanner — VampSecure Labs Overview vamp-forticheck is an asynchronous, non-destructive security scanner that detects CVE vulnerabilities across seven major network security vendors. It performs a structured three-phase analysis: 1. Passive detection —...

CVE-2025-25257

Table of Contents Overview Vulnerability Details Proof of Concept PoC Trolled2 Trolled3 Overview CVE-2025-25257 is a pre-authentication SQL Injection vulnerability in Fortinet FortiWeb Fabric Connector versions 7.0 through 7.6.x. This flaw allows attackers to inject malicious SQL commands into th...

LFiFreak

LFI Freak Features Works with Windows, Linux and OS X Includes bind and reverse shell for both Windows and Linux Written in Python 2.7 What is this all about? A unique tool for exploiting local file inclusions using PHP Input, PHP Filter and Data URI methods. Dependencies BeautifulSoup Disclaimer...