instarecon

InstaRecon Automated basic digital reconnaissance. Great for getting an initial footprint of your targets and discovering additional subdomains. InstaRecon will do: DNS lookups A, PTR, MX, NS DNS lookups recursively on all hosts discovered Whois on domain and IP lookups Google dorks looking for...

PackMyPayload

PackMyPayload - Emerging Threat of Containerized Malware Jump to supported formats This tool takes a file or directory on input and embeds them into an output file acting as an archive/container. It can serve purpose for a Proof-of-Concept presenting emerging risk of container file formats with...

claude-poc

There are multiple ways to abuse Claude code, this is one of them which I found during my research & reported November 23, 2025 not-fixed, might come handy while doing RT/PT for inital access. Summary: The apiKeyHelper is a custom shell script /bin/sh designed to generate authentication values fo...

bluewall

BLUEWALL Bluewall is a firewall framework designed for offensive and defensive cyber professionals. This framework allows Cybersecurity professionals to quickly setup their environment while staying within their scope. Credit Inspired by Andrew Benson's hostfw iptable generation script. Features...

malwoverview

Malwoverview !Alt...

claude-code-backdoor

Claude Code Backdoor PoC A Proof of Concept demonstrating how Claude Code Anthropic's CLI AI agent hooks can be leveraged for Initial Access and Persistence. ⚠️ Disclaimer This project is for educational and ethical security testing purposes only. Unauthorized access to computer systems is illegal...

ClickOnceBlobber

ClickOnce AppDomainManager Injection Toolkit Weaponize signed .NET ClickOnce applications for initial access by hijacking a dependency DLL via AppDomainManager injection and loading a C port of ProxyBlob Agent. Ships with a C port of ProxyBlob — a SOCKS5 proxy that tunnels all traffic through Azu...

CVE-2026-92615

creationtimestamp| type| source ---|---|--- 2026-09-16 17:02:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4imsj5tjegoek...

AggressorAssessor

Various initial recon aggressor scripts...

automerge-test

initial content...

CVE-2024-21412_Water-Hydra

CVE-2024-21412Water-Hydra Deliver malware via CVE-2024-21412 usage Start the services in order, then access the web server. webserver Start a web server in the folder: python -m http.server Initial Access: Use Windows Advanced Query Syntax AQS to link back to a JPEG trojan hosted on a WebDAV shar...

CVE-2026-54334

creationtimestamp| type| source ---|---|--- 2026-09-14 21:40:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvj35kwdxm2j 2026-09-14 22:08:38+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvj4qknfnk2j 2026-09-15 12:30:05+00:00| seen|...

CVE-2026-7848

creationtimestamp| type| source ---|---|--- 2026-09-14 16:15:02+00:00| seen| https://cert.pl/en/posts/2026/09/CVE-2026-7848 2026-09-14 16:23:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dxvl3rokmnqkg...

CVE-2024-3400-Compromise-Checker

CVE-2024-3400 侵害チェッカー Palo Alto Firewalls上でCVE-2024-3400に関連する侵害の証拠を確認するための非常にシンプルなbashスクリプトです。 VolexityのレポートとdeFroggyのブログ記事で概説されているアーティファクトの存在を確認することで、影響を受ける可能性のあるデバイスの迅速な初期トリアージを提供するように設計されています。 Usage: ./cve-2024-3400checker.sh 脆弱性自体とこのスクリプトが確認するIOCの詳細については、以下のそれぞれの公開情報を参照してください。...

openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server

A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption...

openssl: QUIC server may trigger double free when processing INITIAL packet

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID destination connection ID can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service...

Variatype.htb-CVE-2025-66034

Hackthebox Season 10 - Variatype This script will get you initial access. First, Install required modules using pip pip3 install -r requirements.txt Usage python3 exploit.py 'id' or python3 exploit.py 'echo BASE64ENCODEDREVSHELL | base64 -d | bash'...

exchange-0days-202103

exchange-0days-202103 IoC determination for exploitation of CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065...

CVE-2026-81648

creationtimestamp| type| source ---|---|--- 2026-09-13 21:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvgih3sbms2b 2026-09-13 22:07:08+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvgm6wkgm52n 2026-09-14 05:03:31+00:00| seen|...

CVE-2020-16125-Reproduction

CVE-2020-16125-Reproduction This repository is aimed at reproducing the attack . Description : Its original name is “Ubuntu gdm3 privilege escalation” , and it is found by a Github security researcher named Kevin Backhouse . Its CVSS score is 4.6/10 medium and the affected environment is Ubuntu...