dbd

d8888b. d8888b. d8888b. 88 8D 88 8D 88 8D 88 88 88oooY' 88 88 88 88 88b. 88 88 88 .8D 88 8D 88 .8D Y8888D' Y8888P' Y8888D' Durandal's Backdoor Copyright C 2013 Kyle Barnthouse [email protected] dbd is distributed under the GNU GPL Mipsbe binary added by Darkerego https://github.com/darkerego...

frida-android-libbinder

frida-android-libbinder PoC Frida-Skript zum Anzeigen von Android libbinder-Datenverkehr. Die folgenden Links waren eine großartige Quelle der Inspiration und des Wissens: https://www.blackhat.com/docs/eu-14/materials/eu-14-Artenstein-Man-In-The-Binder-He-Who-Controls-IPC-Controls-The-Droid.pdf...

synapse

Synapse |support| |development| |documentation| |license| |pypi| |python| Synapse wird jetzt aktiv unterhalten bei element-hq/synapse Synapse ist ein Open-Source-Matrix -Homeserver, der von 2019 bis 2023 als Teil der Matrix.org Foundation entwickelt wurde. Die Matrix.org Foundation kann die Wartu...

WHS3_vulhub

CVE-2017-8386: git-shell Sandbox-Umgehung zu RCE PoC 정수진@suz1n Übersicht Git-shell bietet eine Umgebung, die über SSH nur eingeschränkte Git-Befehle zulässt. In bestimmten Versionen von git-shell wie 2.12.2 gibt es jedoch eine Schwachstelle CVE-2017-8386, die es ermöglicht, den Sandbox zu umgehen...

SCANNER-INURLBR

Descrizione Ricerca avanzata nei motori di ricerca, consente l’analisi fornita per sfruttare GET / POST catturando email e URL, con una validazione personalizzata interna per ogni target/URL trovato. Uno strumento PHP che può essere eseguito su diverse distribuzioni Linux aiuta hacker e...

detection-rules

Detection Rules Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine. This repository was first announced on Elastic's blog post, Elastic Security...

react2shellpoc

Questo repository contiene una prova di concetto che dimostra come una specifica classe di vulnerabilità dei React Server Component si comporta all'interno di un ambiente di formazione controllato e legale. Manuale root@kitploit: ┌──kali㉿kali-/Documents/tools/2025-55182 └─$ python exploit.py -h /...

react2shellpoc

This repository contains a proof‑of‑concept demonstrating how a specific class of React Server Component vulnerabilities behaves inside a controlled, legal training environment. Manual root@kitploit: ┌──kali㉿kali-/Documents/tools/2025-55182 └─$ python exploit.py -h /\ /\ /\ /\ /\ /\ ||...

CVE-2026-78037

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-76943

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

CVE-2026-76060

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-54084

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.0.0 through 4.14.6, a malicious or man-in-the-middle enrollment manager can crash a Wazuh agent during enrollment by returning a malformed key response with fewer...

CVE-2026-54085

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing...

laforge

Laforge Security Competition Infrastructure Automation Framework Laforge enables rapid development of infrastructure for the purpose of information security competitions. Using a simple and intuitive configuration language, Laforge manages a dependency graph and state management and allows for...

procrustes

Procrustes A bash script that automates the exfiltration of data over dns in case we have a blind command execution on a server where all outbound connections except DNS are blocked. The script currently supports sh, bash and powershell and is compatible with exec style command execution e.g...

CVE-2022-1388

CVE-2022-1388 Exploit POC per CVE-2022-1388 Utilizzo root@kitploit: usage: exploit.py -h -t TARGET -l LIST -c COMMAND optional arguments: -h, --help show this help message and exit -t TARGET, --target TARGET The IP address of the target, eg: 127.0.0.1:9443 -l LIST, --list LIST List of target url...

hakuin

Hakuin is a Blind SQL Injection BSQLI optimization and automation framework written in Python 3. It abstracts away the extraction logic and allows users to easily and efficiently dump databases from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization...

DumpTheGit

DumpTheGit DumpTheGit durchsucht öffentliche Repositorys nach sensiblen Informationen, die in die GitHub-Repositorys hochgeladen wurden. Das Tool markiert Übereinstimmungen mit potenziell sensiblen Dateien wie Anmeldeinformationen, geheimen Schlüsseln, Token usw., die versehentlich von den...

recomposer

Recomposer.py Hatten Sie schon einmal das unsichere Gefühl, Ihre Malware-Binärdateien auf VirusTotal oder andere AV-Seiten hochzuladen, weil man Binärdateien anhand von Hashes nachschlagen kann? Beispiel: https://github.com/mubix/vt-notify Fühlen Sie sich mit Recomposer etwas sicherer! Recomposer...

msmailprobe

msmailprobe Office 365 and Exchange Enumeration It is widely known that OWA Outlook Webapp is vulnerable to time-based user enumeration attacks. This tool leverages all known, and even some lesser-known services exposed by default Exchange installations to enumerate users. It also targets Office...