CVE-2023-27532-RCE-Only

Forked Version RCE Only Forked repository and removed the credential leak part. Applied fixes for compilation. CVE-2023-27532 Proof of Concept code to exploit CVE-2023-27532 and either leak plaintext credentials or perform remote command execution. Overview For a detailed analysis of the...

cve-2025-59287

CVE-2025-59287 - WSUS Exploitation Toolkit by adel-h4x0a ⚠️ For Educational and Authorized Testing Purposes Only ⚠️ Overview This toolkit demonstrates the exploitation of CVE-2025-59287, a remote code execution vulnerability in Windows Server Update Services WSUS. Components 1. Encryption Module...

CVE-2024-27198-POC

CVE-2024-27198 – JetBrains TeamCity Authentication Bypass & RCE PoC Author: EynaExp Scope: Research / Defensive Validation / Authorized Testing Only Overview This repository contains a proof-of-concept mass scanner targeting JetBrains TeamCity instances affected by CVE-2024-27198 , an...

ShadowNet v11.1.0

Big Thanks to Jesus for making this gain attention! Turn to Jesus before it's too late. : He loves You To even further enhance your privacy and security; Use ShadowNet on your Host OS & Run Whonix in a VM to browse the web. Download Whonix here: https://www.whonix.org/ Please use a secure VM...

CVE-2019-16278

CVE-2019-16278 - Nostromo nhttpd RCE Vulnerability Description Remote Code Execution vulnerability in Nostromo nhttpd versions 2&1 Usage...

CVE-2026-86167

A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgponloid leads to os command injection. Remote exploitation of the attack is possible. The exploit is...

LFI-Destruction

🔥 LFI-Destruction – Framework de Pruebas de Penetración Autorizadas LFI-Destroyer es un framework completo y modular de explotación de Inclusión Local de Archivos LFI diseñado para profesionales de seguridad autorizados. Combina múltiples técnicas de ataque en una sola herramienta fácil de usar:...

CVE-2025-32432

CVE-2025-32432 — Craft CMS Pre-Auth RCE Exploit for unauthenticated remote code execution in Craft CMS, written in Go. Inspired by the original work of c0gnit00. How it works 1. Gets the PHP session and CSRF token via GET /admin/login 2. Poisons the PHP session file by injecting PHP code into the...

cloud-doctor

cloud-doctor One command grades your whole cloud account — misconfigurations, missing observability, and security posture, ranked by the five things to fix first. Point it at AWS, Cloudflare, Vercel, Supabase, Render, Fly.io, or Railway and it comes back with a score, what's broken, and a fix for...

libnfc

root@kitploit: - Free/Libre Near Field Communication NFC library Libnfc historical contributors: Copyright C 2009 Roel Verdult Copyright C 2009-2015 Romuald Conty Copyright C 2010-2012 Romain Tartière Copyright C 2010-2013 Philippe Teuwen Copyright C 2012-2013 Ludovic Rousseau Additional...

fragattacks

FragAttacks: هجمات التجزئة والتجميع 1. مقدمة يحتوي هذا المستودع على أداة FragAttacks. يمكنها اختبار عملاء ونقاط وصول Wi-Fi بحثًا عن هجمات التجزئة fragmentation والتجميع aggregation. تؤثر هذه الثغرات على جميع شبكات Wi-Fi المحمية. لمزيد من المعلومات حول هذه الثغرات، انظر fragattacks.com. الموارد...

btlejuice

BtleJuice Framework Introducción BtleJuice es un framework completo para realizar ataques Man-in-the-Middle en dispositivos Bluetooth Smart también conocidos como Bluetooth Low Energy. Se compone de: un núcleo de interceptación un proxy de interceptación una interfaz web dedicada bindings de Pyth...

mfcuk

README Compiling: autoreconf -is ./configure make Running most basic: ./mfcuk -C -R 0:A -v 2 PACKAGE MiFare Classic Universal toolKit MFCUK TOOLS Mifare Classic DarkSide Key Recovery Tool mfcukkeyrecoverydarkside.c previously known as zvmfdarkside ... LICENSE GPL. See MFCUKLICENSE for more...

mfoc

MFOC is an open source implementation of "offline nested" attack by Nethemba. This program allow to recover authentication keys from MIFARE Classic card. Please note MFOC is able to recover keys from target only if it have a known key: default one hardcoded in MFOC or custom one user provided usi...

CVE-2023-4911

glibc Heap Buffer Overflow Vulnerability CVE-2023-4911 Item| Description ---|--- CVE ID| CVE-2023-4911 Attack Type| Heap Buffer Overflow → Local Privilege Escalation CVSS 3.1| 7.8 High Disclosure Date| 2023-10-03 Vulnerability Point| glibc dynamic loader ld.so GLIBCTUNABLES parser Affected...

CVE-2024-21533-PoC-ggit

Vulnerabilidad de inyección de argumentos CVE-2024-21533 en ggit ggit se describe a sí mismo como: root@kitploit: Envoltorios de comandos git locales basados en promesas Recursos: Código fuente del proyecto en GitHub: https://github.com/bahmutov/ggit Paquete npm del proyecto:...

proxy2

proxy2 HTTP/HTTPS proxy in a single python script Features easy to customize require no external modules support both of IPv4 and IPv6 support HTTP/1.1 Persistent Connection support dynamic certificate generation for HTTPS intercept This script works on Python 2.7. You need to install OpenSSL to...

selenium-wire

Selenium Wire is no longer being maintained. Thank you for your support and all your contributions. Selenium Wire Selenium Wire extends Selenium's Python bindings to give you access to the underlying requests made by the browser. You author your code in the same way as you do with Selenium, but y...

dnsgen

DNSGen 2.0 - Advanced DNS Name Permutation Engine 🚀 DNSGen is a powerful and flexible DNS name permutation tool designed for security researchers and penetration testers. It generates intelligent domain name variations to assist in subdomain discovery and security assessments. ✨ Features 🔍 Smart...

gf

gf A wrapper around grep to avoid typing common patterns. What? Why? I use grep a lot. When auditing code bases, looking at the output of meg, or just generally dealing with large amounts of data. I often end up using fairly complex patterns like this one: root@kitploit: ▶ grep -HnrE...