keimpx

Introduction keimpx is an open source tool, released under the Apache License 2.0. It can be used to quickly check for valid credentials across a network over SMB. Credentials can be: Combination of user / plain-text password. Combination of user / NTLM hash. Combination of user / NTLM logon...

Invoke-ArgFuscator

root@kitploit: ░█░█▄░█░█▒█░▄▀▄░█▄▀▒██▀░▒░ ▄▀▄▒█▀▄░▄▀▒▒█▀░█▒█░▄▀▀░▄▀▀▒▄▀▄░▀█▀░▄▀▄▒█▀▄░ ░█░█▒▀█░▀▄▀░▀▄▀░█▒█░█▄▄░▀▀░█▀█░█▀▄░▀▄█░█▀░▀▄█▒▄██░▀▄▄░█▀█░▒█▒░▀▄▀░█▀▄░ Invoke-ArgFuscator Invoke-ArgFuscator is an open-source, cross-platform PowerShell module that helps generate obfuscated command-lines for...

windows-api-function-cheatsheets

Windows API Function Cheatsheets Contact 🌨️ Snowcrash: [email protected] Table of Contents Windows API Function Cheatsheets File Operations Process Management Memory Management Thread Management Dynamic-Link Library DLL Management Synchronization Interprocess Communication Windows Hooks...

certipy-merged

certipy-merged This repository contains a fork of ly4k/Certipy with many open pull requests merged, made compatible with each other, and tested to a certain degree. As this is a work in progress , some features may or may not work as expected and things might break. Installation Using pipx...

adiskreader-secretsdump

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord adiskreader-secretsdump Extract registry and NTDS secrets from local or remote disk...

ghostport

Ghostport Ghostport is a sophisticated port spoofing tool designed to confuse and mislead port scanners. It's a Rust implementation inspired by the concept of portspoof, offering enhanced performance and flexibility. Features Dynamic Port Emulation : Responds to port scans with a variety of...

CVE-2025-68461

CVE-2025-68461 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting XSS vulnerability via the animate tag in an SVG document. How does this detection method work? Extracts Roundcube version from the "rcversion" JSON field in the response, parses it into...

CVE-2025-31644

CVE-2025-31644: Command Injection in Appliance mode in F5 BIG-IP The “file” parameter of the “save” command is vulnerable to a command injection attack, allowing an authenticated attacker with administrator privileges to the “/mgmt” web API or the SSH “tmsh” shell, to obtain remote code execution...

MAL-004

MAL-004: Command Injection Bypass for CVE-2020-12641 in Roundcube Webmail A bypass was found for "CVE-2020-12641: Command Injection via "imconvertpath" in Roundcube Webmail" affecting versions before 1.4.5, 1.3.12. The php “escapeshellcmd” function, implemented to prevent “CVE-2020-12641: Command...

CVE-2022-20818

CVE-2022-20818: Local Privilege Escalation via Partial File Read in Cisco SD-WAN The “config - load” feature from Viptela SSH shell uses “wget” to fetch remote “command” files over FTP. By hosting a malicious FTP server and replacing the local files created by wget with symlinks, an attacker can...

CVE-2021-42561

CVE-2021-42561: Command Injection via the Human Plugin in MITRE Caldera In Caldera versions =2.8.1 the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allow attackers to use shell metacharacters e.g. backticks "" or dollar parenthesis "$" in order to esca...

CVE-2024-38819-POC

CVE-2024-38819: Proof of Concept PoC This is a proof of concept for the CVE-2024-38819 vulnerability, which I reported, demonstrating a path traversal exploit. Execution Steps 1. Build the Docker image Spring Boot 3.3.4, based on Spring Framework 6.1.13 root@kitploit: cd vuln docker build -t...

CVE-2025-47176

CVE-2025-47176 PoC Browser Bridge Description This proof-of-concept PoC demonstrates the CVE-2025-47176 vulnerability simulation. It injects a crafted mail item into Outlook containing a malicious sync path that triggers an action during scanning. IMPORTANT: This PoC simulates the vulnerable...

CVE-2025-30208

CVE-2025-30208 Detection Tool Vulnerability Analysis Vite Arbitrary File Read Vulnerability Analysis and Reproduction CVE-2025-30208 Introduction This tool is used to detect whether a target system is vulnerable to CVE-2025-30208. This vulnerability allows an attacker to read sensitive files such...

CVE-2017-7269-Echo-PoC

CVE-2017-7269 Remote Code Execution Echo Verification Our team's analysis report on the CVE-2017-7269 vulnerability: https://ht-sec.org/cve-2017-7269-vulnerabilities/ The default PoC only launches calc.exe. Now it has been modified to respond to requests. The command format is:...

CVE-2024-21626-demo

CVE-2024-21626-demo Demo for the LT at Container Runtime Meetup 5. This is to raise awareness of the attack risk based on publicly known information, and misuse is strictly prohibited. Slides Container Runtime Meetup 5 - Can You Really Trust That Image? Taking Host Root with CVE-2024-21626 Loggin...

CVE-2019-2890

Disclaimer For learning and communication purposes only. Use for other purposes is at your own risk. Description The relevant jar files have been imported into the project, and the exploitation method uses yso's JRMP. When learning and debugging, you can modify the exploitation method. First, pla...

GrafTraverse-CVE-2021-43798

GrafTraverse - CVE-2021-43798 MiNi Exploitation Framework Command-line automation tool for authorized security testing of Grafana Directory Traversal CVE-2021-43798. Overview CVE-2021-43798 is an unauthenticated directory traversal vulnerability in Grafana 8.x that allows attackers to read...

GHSA-X99W-6FGC-PMFW NLTK: Allowlisted pickle loaders still permit code execution in current source

Summary The current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE. Details -...

NLTK: Allowlisted pickle loaders still permit code execution in current source

Summary The current source tree still allows arbitrary code execution during supposedly safer allowlisted pickle loading. The allowlist trusts whole module namespaces instead of exact safe globals, so crafted pickles can invoke dangerous in-namespace callables through pickle REDUCE. Details -...