NotSecDrv

NotSecDrv - A PoC code for CVE-2018-7249 General Description An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista, Windows 7, Windows 8, and Windows 8.1 before KB3086255, and as shipped in Macrovision SafeDisc. Two carefully timed calls to IOCTL 0xCA002813 can cause a race...

Mailcow Dockerized Swagger UI - Cross-Site Scripting

Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI before 4.11.1 that is affected by a DOM-based Cross-Site Scripting XSS vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code...

Arkhota

Arkhota, a web brute forcer for Android What? Arkhota is a web HTTP/S brute forcer for Android OS. Why? A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather...

TwitterSearch2Gephi

TwitterSearch2Gephi TwitterSearch2Gephi is a windows CLI app that lets you collect data from social media and convert it into a CSV data set that can be used with Gephi. Currently it supports Twitter Reddit Youtube WWW domains / URLs More social media platforms and more features for the platforms...

gimmepatz

😼 gimmePATz 😼 - أداة استطلاع لرموز الوصول الشخصية PAT هل سبق لك أن عثرت على رمز وصول شخصي PAT خاص بـ GitHub أو NPM وتساءلت: «هل هذا الرمز صالح؟» أو «أتساءل ماذا يمكن أن يفعل شخص سيئ به؟» حسنًا، إذا كان الأمر كذلك، فقد أعددت لك الأداة المناسبة! أقدم لكم gimmePatz، أداة استطلاع شاملة لرموز الوصول...

ffuf

ffuf - التخمين بشكل أسرع أيها الأحمق مُخمّن ويب سريع مكتوب بلغة Go. التثبيت أمثلة الاستخدام اكتشاف المحتوى اكتشاف المضيف الافتراضي تخمين المعاملات تخمين بيانات POST استخدام معدّل خارجي ملفات الإعدادات المساعدة الوضع التفاعلي التثبيت حمّل نسخة مصمّمة مسبقاً من صفحة الإصدارات، فك الضغط وشغّل! أو إذ...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

CVE-2025-49132

CVE-2025-49132 Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute...

heartbleedscanner

Heartbleed Scanner Network Scanner for OpenSSL Memory Leak CVE-2014-0160 -t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r...

setup-wordpress-with-security-best-practice

Setup WordPress With Security Best Practice This document is written with the aim of being suitable for web applications developed using WordPress that do not interact with users. It is primarily intended for corporate brand pages, various static views, recruitment pages, and similar sites. For...

OSIPs

OSIPs This script scans every file from a given folder recursively, extracts every IPv4 and IPv6 address, filters out the public IP addresses and then queries these IPs against TOR relays, WhoIs service and Location service. It outputs 4 files: a CSV file and a JSON file with all details of the I...

webstor

WebStor Fast Identification of Vulnerable Web Technologies in your Organization WebStor is a tool implemented in Python under the MIT license for quickly enumerating all websites across all of your organization's networks, storing their responses, and querying for known web technologies and...

cacti-cve-2022-46169-exploit

CVE-2022-46169 PoC: Authentication Bypass and Remote Code Execution This repository contains a PoC for the CVE-2022-46169 vulnerability, which allows an attacker to bypass authentication and execute arbitrary code remotely on the affected system. This vulnerability affects Cacti, version 1.2.22,...

feroxbuster

!WARNING Security Notice – Domain Impersonation The domain feroxbuster.com is NOT affiliated with this project, its maintainers, or any official feroxbuster releases. Official feroxbuster downloads are distributed ONLY through: https://github.com/epi052/feroxbuster open source...

feroxbuster

!WARNING إشعار أمني – انتحال النطاق النطاق feroxbuster.com غير تابع لهذا المشروع أو لمطوريه أو لأي إصدار رسمي من feroxbuster. يتم توزيع التنزيلات الرسمية لـ feroxbuster فقط من خلال: https://github.com/epi052/feroxbuster مفتوح المصدر https://www.feroxbuster.pro تجاري مستودعات الحزم المذكورة في ملف...

NextJS-CVE-2025-29927-Docker-Lab

root@kitploit: 🚨 NextJS-CVE-2025-29927-Docker-Lab This repository contains a Docker-based lab environment to explore and demonstrate the Next.js CVE-2025-29927 vulnerability in a controlled setting. ⚠️ DISCLAIMER: This lab is for educational and security research purposes only. Do not expose it to...

CVE-2022-29455

CVE-2022-29455 Wordpress Vulnerability - XSS Cross-Site Scripting Vulnerability Location https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js Vulnerable Version Example - https://www.youtube.com/watch?v=4qvOkSbhcE...

ziti

OpenZiti OpenZiti is an open-source zero-trust networking platform that makes network services invisible to unauthorized users. Every connection, whether from a user, a service, a device, or a workload, is authenticated with cryptographic identity, authorized by policy, and encrypted end-to-end...

keepass_dump

Keepass-Dumper This is my PoC implementation for CVE-2023-32784 My version is a python port of @vdohney's PoC along with a few changes and additional features. Changes One change, was to use known strings that can be found within the dump file in order to more accurately jump to the location of t...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...