LOLBAS

Living Off The Land Binaries and Scripts and now also Libraries All the different files can be found behind a fancy frontend here: https://lolbas-project.github.io thanks @ConsciousHacker for this bit of eyecandy and the team over at https://gtfobins.github.io/. This repo serves as a place where ...

scripthunter

scripthunter Scripthunter is a tool that finds javascript files for a given website. To scan Google, simply run ./scripthunter.sh https://google.com. Note that it may take a while, which is why scripthunter also implements a notification mechanism to inform you when a scan is finished via Telegra...

Photon

Photon Incredibly fast crawler designed for OSINT. Photon Wiki • How To Use • Compatibility • Photon Library • Contribution • Roadmap Sponsored By Key Features Data Extraction Photon can extract the following data while crawling: URLs in-scope & out-of-scope URLs with parameters...

CVE-2018-0114

CVE-2018-0114 Exploitation of a vulnerability in Cisco's node-jose, a JavaScript library created to manage JWT. This vulnerability in Cisco's node-jose allows an attacker to forge malicious tokens. JWT allows users to embed public keys using the jwk value inside the header of the token. However,...

JS-Tap

JS-Tap v3.0.4 This tool is intended to be used on systems you are authorized to attack and for legal and educational purposes. Do not use this tool for illegal purposes, or I will be very angry in your general direction. Changelogs Major changes are documented in the project Announcements:...

-BuL

DEDSECBKIF DEDSECBKIF is a keystroke injection tool for Android, Linux, and iOS. With the help of CVE-2023-45866, it grants users unprecedented control over targeted systems, enabling various functions from keystroke injection to advanced system manipulations. DESCRIPTION DEDSECBKIF is a potent...

CVE-2023-27350

! Be careful executing this as it re-configures the server config in order to execute commands. The script reverts the changes on exit but might not revert it if the process is improperly killed ! CVE-2023-27350 Papercut Unauthenticated RCE Versions The script automatically tests if server is...

zombie-zip

Zombie ZIP ZIP format confusion technique that evades 98% of antivirus engines. CVE-2026-0866 | VU976247 | Published March 10, 2026 The Technique Create a ZIP file where: Compression Method = 0 STORED Actual data = DEFLATE compressed CRC-32 = Checksum of uncompressed payload AV Engine: Reads Meth...

CVE-2020-9758

CVE-2020-9758 Description An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 Helpdesk. A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation, from...

safe-npm

safe-npm A security-focused npm installer that protects your projects from newly compromised packages. Why does this exist? Supply chain attacks on npm packages are a growing threat. Attackers sometimes compromise legitimate packages by: Stealing maintainer credentials Publishing malicious update...

CVE-2025-24054

Windows File Explorer Zero Click NTLMv2-SSP Hash Disclosure 🎥 Demonstration POC + March 2025 Patch bypass 🎥 patch bypass Click the image above to watch the vulnerability demonstration 📋 Technical Overview This repository provides a comprehensive research framework analyzing the vulnerability chai...

cloud

Cloud Monitoring the Cloud Landscape Our mission with this project is to provide an always up-to-date and freely accessible map of the cloud landscape for every major cloud service provider. We've decided to kick things off with collecting SSL certificate data of AWS EC2 and GCP machines,...

CVE-2019-16172

CVE-2019-16172 The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability. CVE Descriptions CVE-2019-16172 Description: CVE-2019-16172 is a stored XSS vulnerability found in LimeSurvey versions prior to 3.17. The vulnerability arises due to improper...

watchguard-sso-client

Proof of Concept for Watchguard SSO Agent Vulnerabilitites CVE-2024-6592, CVE-2024-6593, CVE-2024-6594 Details are described in our advisories available at: CVE-2024-6592 CVE-2024-6593 CVE-2024-6594 The script requires the Python click library to run. Examples Issue Arbitrary Commands to SSO...

ludus_crushftp_cve-2025-31161

Ansible Role: CrushFTP CVE-2025-31161 Ludus An Ansible Role that deploys a vulnerable CrushFTP 10.8.0 instance on Windows for authorized penetration testing of CVE-2025-31161 authentication bypass. The vulnerable CrushFTP binary is hosted at rufflabs/crushftpcve-2025-31161 and downloaded...

evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

sk-cve-2026-26030-lab

CVE-2026-26030 — Semantic Kernel filter eval RCE lab A self-contained lab reproducing CVE-2026-26030 : prompt-injectable remote code execution via the in-memory vector store search filter in Microsoft Semantic Kernel Python, Ethical lab only. Isolated in dedicated virtualenvs; payloads are harmle...

SAMLRaider

SAML Raider - SAML2 Burp Extension Description SAML Raider is a Burp Suite extension for testing SAML infrastructures. It contains two core functionalities: Manipulating SAML Messages and manage X.509 certificates. This software was originally created by Roland Bischofberger and Emanuel Duss...

HTTP-revshell

Powershell HTTP/S Reverse Shell HTTP-revshell is a tool focused on redteam exercises and pentesters. This tool provides a reverse connection through the http/s protocol. It uses a covert channel to gain control over the victim machine through web requests and thus evade solutions such as IDS, IPS...

CVE-2020-14372

CVE-2020-14372: Bypassing not so Secure Boot with one "simple trick" Vulnerability details One day I typed "help" into GRUB2's console and saw some really "fun" commands: readbyte ADDR: Read 8-bit value from ADDR writebyte ADDR VAL: Write 8-bit value VAL to ADDR I immediately thought I found the...