CVE-2026-80443

Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle AiTM. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-59671 Multiple vulnerabilities in the Repasat application

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The endpoint “/es/datatables/getemployeetypesdatatable” is affected...

EDRSilencer

EDRSilencer Inspirado en la herramienta de código cerrado FireBlock FireBlock de MdSec NightHawk, decidí crear mi propia versión y esta herramienta se creó con el objetivo de bloquear el tráfico saliente de los procesos EDR en ejecución mediante las APIs de Windows Filtering Platform WFP. Esta...

No-Consolation

No-Consolation Este es un archivo de objeto Beacon BOF que ejecuta PE no administrados en línea y recupera su salida sin asignar una consola es decir, sin generar conhost.exe. Características Soporta 64 y 32 bits Soporta EXEs y DLLs No crea nuevos procesos No crea nuevos hilos Vincula módulos al...

mitmAP

| / \ | \ | | / /\ | |/ / | ' | | | ' | || / | | | | | | | || | | | | | | | || | || || ||||| || || |/| 2.2 ⚠️ Warning! This project is no longer maintained and may not work as excepted. A python program to create a fake AP and sniff data. new in 2.0: SSLstrip2 for HSTS bypass Image capture...

pentestly

Pentestly Pentestly is a combination of expanding Python tools for use in penetration tests. The goal is to utilize a familiar user interface while making contributions to the framework easy with the power of Python. Blog post: Pentestly Framework: When Pentesting Meets Python and Powershell...

raptor

Raptor is a web-based web-serivce + UI github centric source-vulnerability scanner i.e. it scans a repository with just the github repo url. You can setup webhooks to ensure automated scans every-time you commit or merge a pull request. The scan is done asynchonously and the results are available...

ssh-mitm

SSH MITM v2.3-dev Author: Joe Testa @therealjoetesta Overview This penetration testing tool allows an auditor to intercept SSH connections. A patch applied to the OpenSSH v7.5p1 source code causes it to act as a proxy between the victim and their intended SSH server; all plaintext passwords and...

ssh-mitm

SSH MITM v2.3-dev 作者：Joe Testa @therealjoetesta 概述 此渗透测试工具允许审计员拦截 SSH 连接。对 OpenSSH v7.5p1 源代码应用的一个补丁使其充当受害者与其目标 SSH 服务器之间的代理；所有明文密码和会话都会被记录到磁盘。 当然，受害者的 SSH 客户端会提示服务器密钥已更改。但由于 99.99999% 的情况下这是由合法操作（操作系统重装、配置更改等）引起的，许多/大多数用户会忽略警告并继续连接。 注意： 仅在虚拟机或容器中运行修改后的 sshdmitm ！我们对 OpenSSH...

pupy

Pupy 简单安装 pip3 install pipx pipx ensurepath pipx install git+https://github.com/n1nj4sec/pupy@nextgen pupysh 如果你想要更详细的信息，请参考 wiki 开发安装 git clone https://github.com/n1nj4sec/pupy cd pupy git checkout nextgen git submodule init git submodule update pip install venv python3 -m venv pupyvenv source...

btlejuice

BtleJuice Framework Introduction BtleJuice is a complete framework to perform Man-in-the-Middle attacks on Bluetooth Smart devices also known as Bluetooth Low Energy. It is composed of: an interception core an interception proxy a dedicated web interface Python and Node.js bindings How to install...

isip

isip Interactive sip toolkit for packet manipulations, sniffing, man in the middle attacks, fuzzing, simulating of dos attacks. Video https://asciinema.org/a/11128 Setup git clone https://github.com/halitalptekin/isip.git cd isip pip install -r requirements.txt Usage Packet manipulation tools are...

isip

isip 交互式 SIP 工具包，支持数据包操作、嗅探、中间人攻击、模糊测试以及模拟拒绝服务攻击。 视频 https://asciinema.org/a/11128 安装 git clone https://github.com/halitalptekin/isip.git cd isip pip install -r requirements.txt 用法 数据包操作工具位于 packet 命令循环中。首次启动时，您位于 main 命令循环。 isip:main packet isip:packet 使用 new 命令创建一个新的 SIP 数据包。如果不指定名称，isip 会创建一个名...

frida-fuzzer

Frida API Fuzzer v1.4 版权所有 C 2020 Andrea Fioraldi [email protected] 根据 Apache 许可证 v2.0 发布 这个实验性模糊测试器用于 API 内存中的模糊测试。 设计深受 AFL/AFL++ 的启发和影响。 目前，变异器相当简单，只有 AFL 的 havoc 和 splice 阶段。 我仅在 tests/ 下的示例中测试过，这是一个进行中的项目，但已知至少在 GNU/Linux x8664 和 Android x8664 上可以工作。 你需要 Frida = 12.8.1 来运行它（pip3 install...

frida-fuzzer

Frida API Fuzzer v1.4 Copyright C 2020 Andrea Fioraldi [email protected] Released under the Apache License v2.0 This experimental fuzzer is meant to be used for API in-memory fuzzing. The design is highly inspired and based on AFL/AFL++. ATM the mutator is quite simple, just the AFL's havoc...

CVE-2026-11109-Bluetooth-Classic-KNOB-Attack-Key-Negotiation-of-Bluetooth-

CVE-2026-11109 – Ataque KNOB de Bluetooth Clásico Negociación de clave de Bluetooth Código del Programa Simulación en Python knobattacksim.py - Simulates negotiation of encryption key size to 1 byte import random, hashlib class BluetoothDevice: def negotiatekeysizeself, proposedsize: Vulnerable:...

WEASEL

WEASEL: A Stealthy DNS Beacon WEASEL is a small in-memory implant using Python 3 with no dependencies. The beacon client sends a small amount of identifying information about its host to a DNS zone you control. WEASEL server can task clients to execute pre-baked or arbitrary commands. WEASEL is a...

Remote-DLL-Injection-with-Timer-based-Shellcode-Execution

Inyección Remota de DLL con Ejecución de Shellcode Basada en Temporizador Documentación actualizada por el error anterior en el título de inyección de procesos! ⚠ Solo para Investigación Educativa Este repositorio contiene investigación de seguridad con fines educativos y solo para uso autorizado...

EUVD-2026-91074

Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issue affects EasyIO NEO: before 3.3b25...

CVE-2026-19856: Undefined Security Weakness

The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on the site. On sites upgraded from older...