vBulletin-CVE-2025-48828-Multi-target

💥 vBulletin Remote Code Execution Scanner replaceAdTemplate This Python tool automates the detection of unauthenticated RCE vulnerabilities in vBulletin via the replaceAdTemplate exploit vector. Based on the original proof-of-concept by EgiX , this version supports batch scanning , multithreading...

url-tracker

URL Tracker v0.5.0 URL Tracker is a robust and scalable web application designed to monitor and track URLs, log changes, and provide detailed insights into the status and behavior of various web resources. Built on top of Sails.js, this application is perfect for tracking URLs for uptime, content...

CVE-2023-30253-PoC

CVE-2023-30253 CVE-2023-30253 PoC Description This is my PoC for the CVE-2023-30253 Dolibarr 17.0.0 PHP Code Injection, when the CMS Website plugin core is enabled, an authenticated attacker can obtain remote command execution via php code injection bypassing the application restrictions...

ThinkAdmin-CVE-2020-25540

ThinkAdmin-CVE-2020-25540 ThinkAdmin CVE-2020-25540 POC root@kitploit: Usage root@kitploit: $ python3 exploit.py -t -c...

godoh

🕳 godoh A DNS-over-HTTPS Command & Control Proof of Concept introduction godoh is a proof of concept Command and Control framework, written in Golang, that uses DNS-over-HTTPS as a transport medium. Currently supported providers include Google, Cloudflare but also contains the ability to use...

omnibus

OSINT Omnibus Developed & maintained by InQuest Table of Contents OSINT Omnibus Omnibus Documentation Vocabulary Running Omnibus API Keys Interactive Console Artifacts Overview Creating & Managing Artifacts Sessions Modules Machines Reporting Monitoring Modules OSINT Omnibus Developed & maintaine...

cve-2022-44268

CVE-2022-44268 ImageMagick is a free and open-source cross-platform software suite for displaying, converting, and editing raster image and vector image files. It can read and write over 200 image file formats. ImageMagick is licensed under the Apache License 2.0. It is available in the form of...

PasteJacker

PasteJacker The main purpose of the tool is automating PasteJacking/Clipboard poisoning/whatever you name it attack with collecting all the known tricks used in this attack in one place and one automated job as after searching I found there's no tool doing this job the right way 😄 Now because thi...

CVE-2020-5902

CVE-2020-5902 In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has a Remote Code Execution RCE vulnerability in undisclosed pages. Proof of concept...

azazel

Azazel V 0.1 The whole earth has been corrupted through the works that were taught by Azazel: to him ascribe all sin. -- 1 Enoch 2:8 Azazel is a userland rootkit based off of the original LDPRELOAD technique from Jynx rootkit. It is more robust and has additional features, and focuses heavily...

dnstwist

See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence. DNS fuzzing is an...

Hash-Buster

Hash Buster Why crack hashes when you can bust them? Features Automatic hash type identification Supports MD5, SHA1, SHA256, SHA384, SHA512 Can extract & crack hashes from a file Can find hashes from a directory, recursively Multi-threading Insallation & Usage Note: Hash Buster isn't compatible...

tenet

Tenet - A Trace Explorer for Reverse Engineers Overview Tenet is an IDA Pro plugin for exploring execution traces. The goal of this plugin is to provide more natural, human controls for navigating execution traces against a given binary. The basis of this work stems from the desire to research ne...

opsxcq-cve-2016-10033

PHPMailer 5.2.18 Remote Code Execution PHPMailer is the world's most popular transport class, with an estimated 9 million users worldwide. Downloads continue at a significant pace daily. Used by many open-source projects: WordPress, Drupal, 1CRM, SugarCRM, Yii, Joomla! and many more PHPMailer...

Graffiti

NOTE : Never upload payloads to online checkers Graffiti is a tool to generate obfuscated oneliners to aid in penetration testing situations. Graffiti accepts the following languages for encoding: Python Perl Batch Powershell PHP Bash Graffiti will also accept a language that is not currently on...

CVE-2021-4034

CVE-2021-4034 One day for the polkit privilege escalation exploit Just execute make, ./cve-2021-4034 and enjoy your root shell. The original advisory by the real authors is here PoC If the exploit is working you'll get a root shell immediately: root@kitploit: vagrant@ubuntu-impish:/CVE-2021-4034$...

PoisonApple

PoisonApple This is a command-line tool to perform various persistence mechanism techniques on macOS. This tool was designed to be used by threat hunters for cyber threat emulation purposes. Install Do it up: root@kitploit: $ pip3 install poisonapple --user Note: PoisonApple was written & tested...

tc_hack

This tool uses a vulrubility within Apache Tomcat called CVE 2017 12617 to gain remote access to any server with the PUT method enabled. It can be downloaded here you will need to run it from the command line Usage: tchack target IP target port...

log4shell-docker-lab

Log4Shell docker lab for CVE-2021-44228 The components This docker lab makes use of three components, being: The vulnerable spring-boot application An HTTP server that hosts .class files used for remote code execution An LDAP referral server which redirects specific LDAP queries to the HTTP serve...

dolos_cloak

Dolos Cloak Dolos Cloak is a python script designed to help network penetration testers and red teamers bypass 802.1x solutions by using an advanced man-in-the-middle attack. The tool is able to piggyback on the wired connection of a victim device that is already allowed on the target network...