BloodHound

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound leverages grap...

CVE-2022-22706-poc

CVE-2022-22706 - Page-Cache Write The Arm Mali GPU driver hands userspace a CPU-writable mapping of pages it pinned read-only, so an unprivileged process gets a writable alias of the page cache backing a file it can only open ORDONLY. exploit.c blanks root's password field in the /etc/passwd page...

CVE-2026-50416-writeup-and-poc

CVE-2026-50416: a kernel address in the desktop heap On the affected system, this read from the user mapping of the Win32 desktop heap returned a kernel address: ULONG64 leaked = ULONG64 desktopheap + 0x100; That is the whole disclosure. At first it was only an eight-byte value with convincing hi...

CVE-2024-4577

CVE-2024-4577 Overview CVE-2024-4577 is a security vulnerability that affects PHP servers in the following versions: PHP 8.3.x 8.3.8 and earlier PHP 8.2.x 8.2.20 and earlier PHP 8.1.x 8.1.29 and earlier All versions prior to 8.0 Unsupported versions 7.x and 5.x This vulnerability is a remote code...

Whisker

Whisker Whisker is a C tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding "Shadow Credentials" to the target account. This tool is based on code from DSInternals by Michael Grafnetter @MGrafnetter. For this...

fscan

Fscan 中文 Comprehensive intranet scanning tool for automated vulnerability assessment. Version : 2.2.0 Features Scanning Host Discovery - ICMP/Ping alive detection, B/C segment statistics for large networks Port Scanning - TCP connect scan, 133 built-in ports, port groups web/db/service/all...

asnmap

Go CLI and Library for quickly mapping organization network ranges using ASN information. Features • Installation • Usage • Running asnmap • Join Discord Features ASN to CIDR Lookup ORG to CIDR Lookup DNS to CIDR Lookup IP to CIDR Lookup ASN/DNS/IP/ORG input JSON/CSV/TEXT output STD IN/OUT suppor...

CVE-2019-0232

Vulnerability Environment Tomcat 8.5.39 Jdk 8u121 Edit web.xml file cgi org.apache.catalina.servlets.CGIServlet debug 0 cgiPathPrefix WEB-INF/cgi-bin executable 5 cgi /cgi-bin/ Edit content.xml file WEB-INF/web.xml $catalina.base/conf/web.xml...

trackerjacker

trackerjacker Like nmap for mapping wifi networks you're not connected to. Maps and tracks wifi networks and devices through raw 802.11 monitoring. PyPI page: https://pypi.python.org/pypi/trackerjacker Install pip3 install trackerjacker Supported platforms : Linux tested on Ubuntu, Kali, and RPi...

herpaderping

Process Herpaderping png.HerpaderpIcon Process Herpaderping is a method of obscuring the intentions of a process by modifying the content on disk after the image has been mapped. This results in curious behavior by security products and the OS itself. !png.mimioogle !gif.SurivDemo Summary...

A-Red-Teamer-diaries

A Red-Teamer diaries Publicly accessible notes about my pentesting/red teaming experiments tested on several controlled environments/infrastructures that involve playing with various tools and techniques used by penetration testers and redteamers during a security assessment. Project in progress...

PurplePanda

PurplePanda This tool fetches resources from different cloud/saas applications focusing on permissions in order to identify privilege escalation paths and dangerous permissions in the cloud/saas configurations. Note that PurplePanda searches both privileges escalation paths within a platform and...

XStream-1

master: v-1.4.x: XStream Java to XML Serialization, and back again Binaries All binary artifacts are bundled in the -bin archive. It includes the XStream jars and any other library used at build time, or optional runtime extras. Xpp3 is recommend for use as it will greatly improve the performance...

Trigon

Trigon Trigon is a deterministic kernel exploit and PPL bypass based on CVE-2023-32434. It supports A9 - A16 devices running iOS 13 - 16.5.1. Being deterministic means that this exploit will never panic during or after exploitation and is completely reliable. Trigon exploits an integer overflow i...

artifacts-kit

. . / || |/ / | | | ||/ | \ \ \ \ \ / \ | |/ / \ / | | /| | | || | / \ | | | | | | ||| / / / / Malicious Memory Artifact Generator Kit v1.0 | Forrest Orr | 2020 REQUIRED --alloc-type dll-map-hollow|dll-load-hollow|txf-dll-map-hollow|private|mapped OPTIONAL --payload-file --payload-type...

IronPE

IronPE - Minimal Windows PE manual loader written in Rust. Rust PE Loader / Manual Mapping Implementation IronPE is a minimal Windows PE manual loader written in Rust for both x86 and x64 PE files. This project is a Rust reimplementation of my previous project dotNetPELoader , which implemented a...

CVE-2026-64945

A vulnerability in Apache Answer (through version 2.0.2 ) allows users to hide or restore questions due to an incorrect permission mapping . The question operation controller mistakenly checks for the question.unpin permission instead of the required question.hide or question.show permissions. Th...

CVE-2026-64945 Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result the unpin permission instead of the hide permission, so in custom role configurations that separate these permission...

DbgNexum

DbgNexum - Shellcode Injection DbgNexum is a Proof-of-Concept for injecting shellcode using the Windows Debugging API and Shared Memory File Mapping. It avoids writing and reading remote memory directly, instead using context manipulation to force the target process to load and execute the payloa...

infernal-twin

Infernal-Wireless v3 Release 3 Improved and Compatibility on Kali Linux 2018 Added Visual Representation of Wireless Scan Added Visual Representation of Probe Requests and Map per SSID requested by Devices Updated MAC address mapping Added MAC address mappting on probe request devices Evil Twin...