AWS-Loot

AWSLoot Searches an AWS environment looking for secrets, by enumerating environment variables and source code. This tool allows quick enumeration over large sets of AWS instances and services. Install pip install -r requirements.txt An AWS credential file .aws/credentials is required for...

autovpn

!CAUTION This repository is no longer being maintained. No further updates, bug fixes, or support will be provided. Please use the new version https://github.com/ttlequals0/autowire Overview Script that allows the easy creation of OpenVPN endpoints in any AWS region. To create a VPN endpoint is...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and then 192.168.1...

aws-security-assessment-solution

Self-Service Security Assessment Solutions v2.0 Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their customers. To meet these important concerns, AWS has developed a primary set of services customers should use to aid in protecting their accounts. Amaz...

multi-juicer

Running CTFs and Security Trainings with OWASP Juice Shop is usually quite tricky, Juice Shop just isn't intended to be used by multiple users at a time. Instructing everybody how to start Juice Shop on their own machine works ok, but takes away too much valuable time. MultiJuicer gives you the...

chaosmonkey

Chaos Monkey randomly terminates virtual machine instances and containers that run inside of your production environment. Exposing engineers to failures more frequently incentivizes them to build resilient services. See the documentation for info on how to use Chaos Monkey. Chaos Monkey is an...

CVE-2022-29221-PoC

CVE-2022-29221-PoC I do not host in Github anymore, but on my own Git hosting instance. Go here to see code: https://git.sbani.net/sbani/CVE-2022-29221-PoC...

CVE-2026-74936-gc-potato

CVE-2026-74936 A not fancy reproduction. The baseline required some fiddling here. Mozilla describes this issue as a WebAssembly use-after-free. Public fix 9823b5c86ffa keeps the exact trapping wasm::Code alive in JitActivation. The test performs a bad-signature cross-instance tail call. A Debugg...

red-detector

Red-Detector Description Scan your EC2 instance to find its vulnerabilities using Vuls https://vuls.io/en/. Audit your EC2 instance to find security misconfigurations using Lynis https://cisofy.com/solutions/lynis. Scan your EC2 instance for signs of a rootkit using Chkrootkit...

dockerized-android

Dockerized Android Dockerized Android is a container-based framework that allows to execute and Android Emulator inside Docker and control it through a browser. This project has been developed in order to provide a starting point for integrating mobile security components into Cyber Ranges but it...

security-research

security-research Proof-of-concept code and technical write-ups for vulnerabilities I discovered and reported through coordinated disclosure. Every entry here is already public: the vendor advisory is published and a fixed release is available. Nothing under embargo or in draft is included. The...

cve-2018-15961

CVE-2018-15961 This is part of Cved: a tool to manage vulnerable docker containers. Cved: https://github.com/git-rep-src/cved Image source: https://github.com/cved-sources/cve-2018-15961 Image author: https://bintray.com/eaps/coldfusion/cf%3Acoldfusion/2018.0.0...

CVE-2023-4220

RCE for Chamilo LMS CVE-2023-4220 Using a Web Shell This project automates the exploitation of the remote code execution vulnerability CVE-2023-4220 found in Chamilo LMS. Using a web shell, the tool facilitates the automated exploitation of the vulnerability to gain control over affected Chamilo...

Joomla-CVE-Detector-CVE-2022-27913-

Joomla-CVE-Detector-CVE-2022-27913- Identify instances of Joomla that are affected by CVE-2022-27913...

CVE-2026-19264

CVE-2026-19264 - Unauthenticated Path Traversal to Full Instance Takeover in Postiz Author: Krithik Babu P @DarkLycn1976 Published: 2026-08-10 CVE: CVE-2026-19264 Severity: Critical - CVSS 4.0 9.3 / CVSS 3.1 9.8 CWE: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory Affected:...

CVE-2024-24142

CVE-2024-24142: School-Task-Manager-System-SQL-Injection-2 Proof of ConceptPoC : https://github.com/BurakSevben/CVEs/blob/main/School-Task-Manager-System/CVE-2024-24142.md Proof of ConceptPoC : https://github.com/BurakSevben/CVE-2024-24142/blob/main/CVE-2024-24142.md...

CVE-2025-68613-n8n-lab

CVE-2025-68613 Local n8n Lab This repository provides a simple Docker Compose setup that runs a vulnerable n8n instance for local testing of CVE-2025-68613. Requirements Docker Desktop or Docker Engine Docker Compose v2 Quick start 1. Start the container: docker compose up -d 2. Open n8n in your...

CVE-2026-125926

Server-side request forgery SSRF in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpoints and read the responses via a crafte...

Kcfinder-Mass-Scanner

Kcfinder-Mass-Scanner Python 2.7 How To Use? Install Python 2.7 Download Here python file.py...

CVE-2026-125926

A Server-side request forgery (SSRF) vulnerability exists in the server registration and update API of Amazon mcp-gateway-registry versions prior to 1.35.0 . This flaw may allow an authenticated remote user to submit a crafted request that forces the gateway to send requests to internal network s...