hakrawler

Hakrawler Fast golang web crawler for gathering URLs and JavaScript file locations. This is basically a simple implementation of the awesome Gocolly library. Example usages Single URL: echo https://google.com | hakrawler Multiple URLs: cat urls.txt | hakrawler Timeout for each line of stdin after...

CVE-2018-10933

CVE-2018-10933 to test this code: get vulnerable version of libssh at homepage: https://www.libssh.org/files/0.7/libssh-0.7.4.tar.xz uncompress and build, then go to example directory, there's a simple sshd server using libssh name: samplesshd-cb run this simple sshd by command: $ samplesshd-cb...

DccwBypassUAC

DccwBypassUAC This exploit abuses the way "WinSxS" is managed by "dccw.exe" by means of a derivative Leo's Davidson "Bypass UAC" method so as to obtain an administrator shell without prompting for consent. It supports "x86" and "x64" architectures. Moreover, it has been successfully tested on...

CVE-2026-29000-Python-PoC-pac4j-JWT-AuthenticationBypass-Poc

CVE-2026-29000 – pac4j JWT Authentication Bypass Python PoC Python Proof‑of‑Concept for CVE‑2026‑29000 , a critical authentication bypass affecting applications using the pac4j JWT module. The vulnerability allows attackers to authenticate as arbitrary users by sending a malicious JWE token...

CVE-2026-92495

A flaw was found in the Linux kernel's RDMA/bnxtre component. A read-only memory mapping mmap for DBR/toggle pages can incorrectly retain write permissions VMMAYWRITE. This allows a local attacker to bypass intended security checks and upgrade the mapping to writable using mprotectPROTWRITE...

CVE-2022-32118

CVE-2022-32118 - Arox-XSS Stored and Reflected Cross Site Scripting vulnerabilities exist in multiple pages of the Arox School ERP Pro application, including the login page, that allows for arbitrary execution of JavaScript commands. The application has many more parameters affected by Cross Site...

WhatWeb

WhatWeb - Next generation web scanner Developed by Andrew Horton urbanadventurer and Brendan Coles bcoles Latest Release: v0.6.4. April 3, 2026 License: GPLv2 This product is subject to the terms detailed in the license agreement. For more information about WhatWeb visit...

UAC_bypass_windows_store

UACbypasswindowsstore Windows 10 LPE UAC Bypass in Windows Store WSReset.exe uacbypassmod.c exe is fully automate. you don't need to run UAC.bat . registry method : https://github.com/sailay1996/FilelessUACbypassWSReset...

PFQ

PFQ v6.2 Introduction PFQ is a functional framework designed for the Linux operating system built for efficient packets capture/transmission 10G, 40G and beyond, in-kernel functional processing, kernel-bypass and packets steering across groups of sockets/end-points. It is highly optimized for...

Adobe-ColdFusion-8-RCE-CVE-2009-2265

Adobe ColdFusion 8 - Remote Command Execution RCE Exploit Overview This exploit targets a known vulnerability in Adobe ColdFusion 8 CVE-2009-2265. It enables remote command execution RCE by uploading a malicious JSP payload that establishes a reverse shell connection. Exploit Details CVE :...

CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

CVE-2026-113583

Cypht webmail versions 2.0.0 through 2.12.2 are vulnerable to a Stored DOM-based Cross-Site Scripting (XSS) flaw. When the ALLOW_EXTERNAL_IMAGE_SOURCES setting is enabled, an attacker can execute arbitrary JavaScript by sending a specially crafted email. The vulnerability exists because the exter...

CVE-2026-113583

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

EUVD-2026-104966

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

CVE-2026-49869

Kestra CVE-2026-49869 / CVE-2026-53576 Scanner Scans Kestra instances for the endsWith"/configs" authentication filter bypass. Kestra's AuthenticationFilter.java checks request.getPath.endsWith"/configs" instead of matching the exact path /api/v1/configs. Since Kestra addresses resources via...

DriverJack

DriverJack Introduction DriverJack is a tool designed to load a vulnerable driver by abusing lesser-known NTFS techniques. These method bypass the registration of a Driver Service on the system by hijacking an existing service, and also spoof the image path presented in the Driver Load event. To...

Evasor

Overview The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including...

DOMPurify

DOMPurify DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's also very simple to use and get started with. DOMPurify was started in February 2014 and, meanwhile, has reached version v3.4.16. DOMPurify runs as JavaScript and works in all modern browsers...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

ASLRay

ASLRay Linux ELF x32/x64 ASLR DEP/NX bypass exploit with stack-spraying Properties: ASLR bypass DEP/NX bypass Cross-platform Minimalistic Simplicity Unpatchable Dependencies: Linux 2.6.12+ - would work on any x86-64 Linux-based OS BASH - the whole script Limitations: Stack needs to be executable...