covert-control

covert-control Controlla sistemi da remoto caricando file su Google Drive, OneDrive, Youtube o Telegram usando Python per creare i file e i listener. Permette di creare file di testo, immagini, audio o video, con i comandi in chiaro o crittografati usando AES. covert-googledrive.py - Controlla...

covert-control

covert-control Control systems remotely by uploading files to Google Drive, OneDrive, Youtube or Telegram using Python to create the files and the listeners. It allows to create text files, images, audio or videos, with the commands in cleartext or encrypted using AES. covert-googledrive.py -...

gattacker

A Node.js package for BLE Bluetooth Low Energy Man-in-the-Middle & more. Prerequisites see: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno Install root@kitploit: npm install gattacker Usage Configure Running both components Set up variables in config.env:...

gattacker

Un pacchetto Node.js per Man-in-the-Middle BLE Bluetooth Low Energy e altro. Prerequisiti vedi: https://github.com/sandeepmistry/noble https://github.com/sandeepmistry/bleno Installazione root@kitploit: npm install gattacker Utilizzo Configurazione Per eseguire entrambi i componenti, imposta le...

S2-053-CVE-2017-12611

S2-053-CVE-2017-12611 Un semplice script per sfruttare RCE per Struts 2 S2-053 CVE-2017-12611 Utilizzo root@kitploit: exploit.py Esempio root@kitploit: $ python s2-053-exploit.py "http://127.0.0.1" "name" "uname -a" Generated EXP:...

wpscan

WPScan WordPress Security Scanner WPScan WordPress Vulnerability Database - WordPress Security Plugin INSTALL Prerequisites Optional but highly recommended: rbenv Ruby = 3.3 - Recommended: latest stable Curl = 7.72 - Recommended: latest stable The 7.29 has a segfault The 7.72 could result in...

Flerken

Flerken Introduzione Command Line Obfuscation CLOB si è dimostrato essere un fattore non trascurabile nei malware fileless o negli attori malintenzionati che "vivono della terra". Con decine di strumenti di offuscamento osservati in natura, al contrario si possono trovare poche contromisure...

Venom-JWT

Venom-JWT - Strumento di penetration test per vulnerabilità JWT e brute force delle chiavi Dichiarazione solenne: le tecnologie, le idee e gli strumenti menzionati in questo documento sono destinati esclusivamente all'apprendimento e allo scambio a scopo di sicurezza, nessuno può utilizzarli per...

EUVD-2026-67961

IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader...

EUVD-2026-67962

IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit...

EUVD-2026-67958

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from...

EUVD-2025-210810

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

EUVD-2025-210809

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

Chaya

Chaya Right To Privacy Chaya protects your privacy through steganography, cryptography and compression. It effectively encrypts your payloads using AES-256-GCM cryptography, embeds them using LSB-LPS steganography technique into images and compresses them using FLIF to evade detection by performi...

filtron

Filtron Reverse HTTP proxy to filter requests by different rules. Can be used between production webserver and the application server to prevent abuse of the application backend. The original purpose of this program was to defend searx, but it can be used to guard any web application. Installatio...

CVE-2021-22986-Poc

CVE-2021-22986-Poc Questo è un PoC per l'RCE non autenticata di BIGIP iControl. POC : curl -ksu admin:redacted https://192.168.123.134/mgmt/tm/access/bundle-install-tasks -d '"filePath":"id"' | jq . curl -ksu : https://192.168.123.134/mgmt/shared/authn/login -d...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage root@kitploit: usage: java -jar cba-cli.ja...

tulpar

Tulpar ist ein Open-Source-Web-Schwachstellenscanner, der geschrieben wurde, um Web-Penetrationstests zu automatisieren. Tulpar hat die folgenden Funktionen. SQL-Injection GET-Methode XSS GET-Methode Crawl E-Mail-Offenlegung Kreditkarten-Offenlegung Whois Command Injection GET-Methode Directory...

DCVC2

Discord Voice Channel C2 aka DCVC2 Dieses mit mehreren Betriebssystemen kompatible Tool wurde entwickelt, um Discord-Sprachkanäle für Command-and-Control-Operationen zu nutzen. Es arbeitet vollständig über das Real-Time Protocol RTP, hauptsächlich mit DiscordGo, und hinterlässt keine lästigen...

ssj

SSJ - Your everyday Linux distribution gone Super Saiyan. Introduction SSJ is a silly little script that makes use of Docker installed on your everyday Linux distribution Ubuntu, Debian, etc. and magically arms it with hundreds of penetration testing and forensic tools. Technical Details SSJ pull...