jboss-autopwn

jboss-autopwn JBoss Autopwn은 BlackHat Europe 2010에서 소개된 도구입니다. 이 버전은 Minded Security가 발견한 JBoss 인증 우회 VERB 조작 취약점CVE-2010-0738을 포함합니다. C. Papathanasiou 2010 INTRODUCTION 이 JBoss 스크립트는 대상 JBoss AS 서버에 JSP 셸을 배포합니다. 배포 후 스크립트는 업로드 및 명령 실행 기능을 통해 대화형 세션을 제공합니다. 기능: 다중 플랫폼 지원 - Windows, Linux 및 Mac...

Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands

The U.S. Department of Justice DoJ has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017. Searzhudin Tamirlanovich Aktulaev , 40, was...

CVE-2010-0426

CVE-2010-0426 https://www.cvedetails.com/cve/CVE-2010-0426/ sudo 1.6.x（早于 1.6.9p21）和 1.7.x（早于 1.7.2p4）版本，当启用了伪命令（pseudo-command）时，允许将伪命令的名称与任意目录中可执行文件的名称相匹配，从而允许本地用户通过精心构造的可执行文件获取权限，如用户主目录中名为 sudoedit 的文件所示。 用法 当 sudoedit 二进制文件具有 suid 权限，并且某个文件可以以 sudo 身份编辑时，提升权限（使用 sudo -l 检查） root@kitploit:...

TarantuBench

TarantuBench v1 A benchmark for evaluating AI agents on web security challenges, generated by the TarantuLabs engine. What is this? TarantuBench is a collection of 100 vulnerable web applications, each containing a hidden flag TARANTU.... An agent's job is to find and extract the flag by...

Kitsune

Kitsune Kitsune is a Polymorphic Command & Control. This tool allows you to get a graphical version of your favourite hacking tools, such as NetExec, Villain or Evil-WinRM among others. In addition, brings many improvements such as automatic reconnection, reports, history and some extra functions...

CVE-2024-39306

Описание Этот скрипт является PoC для CVE-2024-39306, где возможен RCE из-за SQLi, при котором аутентифицированный пользователь может выполнять произвольные команды на сервере под управлением ChurchCRM -p -b -c Пример: python3 CVE-2024-39306.py -u FirstLast -p Password123 -b...

x8

x8 Hidden parameters discovery suite written in Rust. The tool aids in identifying hidden parameters that could potentially be vulnerable or reveal interesting functionality that may be missed by other testers. Its high accuracy is achieved through line-by-line comparison of pages, comparison of...

Girsh

Girsh Golang Interactive Reverse SHell Who didn't get bored of manually typing the few lines to upgrade a reverse shell to a full interactive reverse shell tty spawn, stty size ..., stty raw -echo or typing the command to use ConPTY. Description With Girsh, just run it and it will detect the OS a...

difuze

difuze: Fuzzer for Linux Kernel Drivers This repo contains all the sources including setup scripts, you need to get difuze up and running. Tested on Ubuntu = 14.04.5 LTS 0. Running difuze from Docker Refer the readme As explained in our paper, There are two main components of difuze: Interface...

difuze

difuze : Fuzzer pour les pilotes du noyau Linux Ce dépôt contient toutes les sources scripts d'installation inclus dont vous avez besoin pour faire fonctionner difuze. Testé sur Ubuntu = 14.04.5 LTS 0. Exécuter difuze depuis Docker Consultez le readme Comme expliqué dans notre article, il y a deu...

viper

Viper Frank4DD, @ May 2000 Viper is a prute force UNIX-style password cracker for passwords encrypt with crypt. It has been developed from Hale's viper 1.4 Perl program. While there are other more powerful crack programs out, this one is about studying the safety of passwords while hardware speed...

viper

Viper Frank4DD, @ Май 2000 Viper — это брутфорс UNIX-подобная программа для взлома паролей, зашифрованных с помощью crypt. Она была разработана на основе Perl-программы Hale's viper 1.4. Хотя существуют и другие, более мощные программы взлома, эта создана для изучения безопасности паролей на фоне...

xioc

xioc Extract indicators of compromise from text, including "escaped" ones like hxxp://banana.com, 1.1.1.1 and phish at malicious dot com. Installation Download a precompiled binary from https://github.com/assafmo/xioc/releases Or... Use go get: root@kitploit: go get -u github.com/assafmo/xioc Or...

espoofer

espoofer espoofer is an open-source testing tool to bypass SPF, DKIM, and DMARC authentication in email systems. It helps mail server administrators and penetration testers to check whether the target email server and client are vulnerable to email spoofing attacks or can be abused to send spoofi...

BlockchainC2

BlockchainC2 BlockchainC2는 공격자가 C2Command and Control에 블록체인특히 이더리움의 스마트 계약 기능을 어떻게 사용할 수 있는지 평가하기 위한 작은 POC 서버/에이전트입니다. 이 애플리케이션에 대한 자세한 내용은 여기에서 확인할 수 있습니다. 스마트 계약 이 POC에 사용된 스마트 계약은 매우 간단합니다: root@kitploit: pragma solidity ^0.5.0; contract EventC2 address owner; event ServerDatabool f, bool enc...

DeimosC2

DeimosC2 Deimos is in: DEPRECATED DeimosC2 is no longer maintained and has a known XSS vulnerability CVE-2025-26244. Thanks to JaRm222 for identifying the vuln and notifying us. His writeup of the vuln can be foundhere. DeimosC2 is a post-exploitation Command & Control C2 tool that leverages...

n0Mac

n0Mac Yet Another Mac Changer!!! This script changes the MAC address of the network interface to a randomly generated address on system startup using crontab. It then uses the macchanger command to generate a list of MAC address vendors and selects one at random and then combines that vendor pref...

K000163177: Multiple Vim vulnerabilities

Security Advisory Description CVE-2024-41957 Vim is an open source command line text editor. Vim v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will als...

Stracciatella

Stracciatella v0.7 Powershell runspace from within C aka SharpPick technique with AMSI, ETW and Script Block Logging disabled for your pleasure. Nowadays, when Powershell got severly instrumented by use of techniques such as: AMSI ETW Script Block Logging Transcript file Modules logging Constrain...

crlfmap

CRLFMap CRLFMap est un outil pour trouver les vulnérabilités de HTTP Splitting Pourquoi ? Je voulais écrire un outil en Golang pour la concurrence Je voulais pouvoir fuzzer à la fois les paramètres et les chemins Installation root@kitploit: go get github.com/ryandamour/crlfmap Aide root@kitploit:...