CVE-2022-29968

CVE-2022-29968 Proof-of-concept exploit for CVE-2022-29968 uninitialized memory in the Linux Kernel, specifically the iouring system. The crash was found with Syzkaller. The crash was analyzed by Joseph Ravichandran and Michael Wang. The exploit was written by Joseph Ravichandran. We found &...

rp

rp++: a fast ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries Overview rp++ or rp is a C++ ROP gadget finder for PE/ELF/Mach-O executables and x86/x64/ARM/ARM64 architectures. Finding ROP gadgets To find ROP gadget you need to specify a file with the --file / -f option and use the...

hardcidr

hardCIDR Background A Linux Bash script to discover the netblocks, or ranges, in CIDR notation owned by the target organization during the intelligence gathering phase of a penetration test. This information is maintained by the five Regional Internet Registries RIRs: ARIN North America RIPE...

Escalamiento-de-Privilegios-usando-el-Kernel-Exploit-Dirty-Cow

Privilege-Escalation-using-the-Dirty-Cow-Kernel-Exploit This project aims to practically demonstrate the operation of the Dirty COW exploit CVE-2016-5195, a critical vulnerability in the Linux kernel. It simulates a realistic scenario in which an attacker with limited local access to an unpatched...

neet

NEET - Network Enumeration and Exploitation Tool Neet is a flexible, multi-threaded tool for network penetration testing. It runs on Linux and co-ordinates the use of numerous other open-source network tools, with the aim of gathering as much network information as possible in clear, easy-to-use...

sandboxec

sandboxec A lightweight command sandbox for Linux, built on Landlock. No daemon. No root. No image build step. Use it to run risky commands with a tighter blast radius: third-party CLIs, untrusted scripts, generated code, and one-off tooling. Purpose Running untrusted code is often an...

CVE-2022-0492

CVE-2022-0492 Container Escape Analysis toc Vulnerability Overview Vulnerability ID: CVE-2022-0492 Vulnerable Product: linux kernel - cgroup Affected Versions: linux kernel 5.17-rc3 Vulnerability Impact: When a container does not have additional security measures enabled, an attacker with root...

coraza

Coraza - Web Application Firewall Coraza is an open source, enterprise-grade, high performance Web Application Firewall WAF ready to protect your beloved applications. It is written in Go, supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set v4. Website:...

vsock_poc

vsockpoc Investigating the bug behind CVE-2021-26708 This repo contains a small writeup about CVE-2021-26708, and how this bug can be turned into a Use After Free write primitive. The PoC here is not a full exploit, but just my harness I used when trying to investigate this bug. It can successful...

o3_finds_cve-2025-37899

This is the artefact repository associated with my blog post How I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel’s SMB implementation. See that post for details...

CVE-2026-31431-Copy-Fail---Minified-LPE-PoC

CVE-2026-31431-CopyFail---Minified-LPE-PoC ⚠️ Disclaimer For Educational and Authorized Security Testing Purposes Only. This Proof-of-Concept PoC was synthesized for authorized Red Team emulation and vulnerability auditing. The authors and contributors assume no liability for the misuse of this...

copyfail2_electric_boogaloo_fix

copyfail2electricboogaloofix A temporary mitigation against copyfail variant copyfail2electricboogaloo - Unprivileged Linux LPE via xfrm ESP-in-UDP MSGSPLICEPAGES no-COW fast path. Page-cache write into any readable file. Overwrites a nologin line in /etc/passwd with sick::0:0:…:/:/bin/bash and s...

Linux---Security---Detect-and-Mitigate-CVE-2024-3094

Linux- Security- Detect and Mitigate CVE-2024-3094 It was determined that malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. It was determined that only certain operating systems and operating system versions were affected by this vulnerability. This repo...

portclue

PortClue PortClue explains why a TCP port on a Linux machine may or may not be reachable. It turns socket, process, firewall, and Docker state into a short evidence chain instead of making you correlate ss, /proc, nftables, iptables, and docker inspect by hand. Run it without a port to discover...

CVE-2022-3910

CVE-2022-3910 poc dirtyfile dirtymm...

duplicut

Duplicut :scissors: Quickly dedupe massive wordlists, without changing the order Created by nil0x42 and contributors 📖 Overview Nowadays, password wordlist creation usually implies concatenating multiple data sources. Ideally, most probable passwords should stand at start of the wordlist, so most...

FRAGNESIA-Charan-cve-2026-46300

Charantej Architecture: Hardened Container Staging & Syscall Telemetry Lab An enterprise-grade, defense-in-depth container containment and runtime security telemetry framework. Designed from the perspective of a Cisco Lead Cybersecurity Architect, the Charantej Architecture isolates staging...

apachrot

Apache Linux CVE-2021-41773/2021-42013 Mass Vulnerability Checker Automatic Mass Tool for checking vulnerability in Apache Linux 2.4.49/50 Using GNU Parallel. You must have parallel for running this tool Install Parallel Linux : command apt-get install parallel -y Windows : You can install WSL...

ComfyEngine

ComfyEngine Qt-based memory scanner / watchlist playground inspired by Cheat Engine but built natively for Linux and tuned for my workflow: clean docks, pointer graphs, fast patching, and zero fear of losing context when you bounce between scanner, scripts, and notes. ComfyEngine gives you a clea...

Hawk

Hawk Silently intercept SSH and SU credentials in real-time Hawk monitors sshd and su processes, extracting passwords from memory via ptrace without modifying target processes. Zero writes. Pure read-only credential harvesting. Demo How It Works Hawk leverages Linux's /proc filesystem to discover...