17340 matches found
MozCache
MozCache Bash script Simple shell script to perform forensic analysis of the Mozilla-Browsers cache Firefox, Iceweasel and Seamonkey. The script orders by date the files cached from a browser of the Mozilla family using the cache version 2. Together with the name of each file the script generates...
CVE-2024-52510
Nextcloud X-E2EE-SIGNATURE Bypass POC Summary During normal operation of Nextcloud's E2EEv2 protocol, clients cryptographically sign folder-metadata before uploading to the server. This ensures the metadata has not been tampered with when it is re-fetched for the purposes of file-sharing or synci...
doctrack
Doctrack Tool to manipulate and weaponize Office Open XML documents. Features Create Office Open XML documents Word, Excel Insert tracking pixels and UNC paths Remote Template injection Insert CustomXML parts Inspect external target URLs, metadata and Custom XML parts Installation You will need t...
m365_groups_enum
Enumerate Microsoft 365 Groups in a tenant with their metadata Description The allgroups.py script allows to enumerate all Microsoft 365 Groups in a Azure AD tenant with their metadata: name visibility: public or private description email address owners members Teams enabled? SharePoint URL e.g...
CVE-2021-29447-Authenticated-XXE-WordPress-5.6-5.7
CVE-2021-29447 Authenticated XXE Exploit for WordPress ๐ฏ A Python PoC to exploit the authenticated XXE vulnerability CVE-2021-29447 in WordPress versions 5.6โ5.7 via WAV metadata. It abuses the iXML chunk in WAV files to trigger an Out-of-Band OOB exfiltration of sensitive dataโlike /etc/passwd,...
GitLab-preauth-RCE_CVE-2021-22205
GitLab-preauth-RCECVE-2021-22205 single line bash PoC for GitLab preauth RCE CVE-2021-22205 root@kitploit: t="http://vuln.site";cmd='echo xxxbase64ofreverseshellcodexxx |base64 -d|bash';f="1.jpg";echo...
CVE-2026-88997 JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...
EUVD-2026-85052
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...
CVE-2026-88997
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the...
CVE-2026-86608 WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...
EUVD-2026-85044
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...
CVE-2026-86608
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...
web-wordlist-generator
WEB-Wordlist-Generator NOTE : You should definitely use it for legal activities. Please See; USAGEPOLICY.md LICENSE Description WEB-Wordlist-Generator scans your web applications and creates related wordlists to take preliminary countermeasures against cyber attacks. ScreenShot Done Scan Static...
CVE-2026-64600
๐จ CVE-2026-64600 โ RefluxFS Linux Kernel Local Privilege Escalation LPE ๐ Overview CVE-2026-64600 "RefluxFS" is a Linux kernel vulnerability affecting the RefluxFS filesystem implementation. The flaw stems from improper validation of filesystem metadata, potentially leading to kernel memory...
username-anarchy
Username Anarchy Version: 0.6 20 September 2024 Author: urbanadventurer Andrew Horton Homepage: https://www.morningstarsecurity.com/research/username-anarchy Source: https://github.com/urbanadventurer/username-anarchy/ License: MIT Description Tools for generating usernames when penetration...
onionscan
What is OnionScan? OnionScan is a free and open source tool for investigating the Dark Web. For all the amazing technological innovations in the anonymity and privacy space, there is always a constant threat that has no effective technological patch - human error. Whether it is operational securi...
analyzeMFT
AnalyzeMFT Status : All tests passing across Python 3.8-3.12 on Windows, macOS, and Linux. Quick Start root@kitploit: Install pip install analyzeMFT Basic usage python analyzeMFT.py -f MFTFILE -o output.csv --csv Generate test MFT for testing python -c "from src.analyzeMFT.testgenerator import...
tird
๐ Home ๐ Specification ๐ man page ๐ Input Options ๐ Tutorial โ FAQ ๐ฅ Install tird & tirdFS tird /tษชrd/ an acronym for "this is random data" is a file encryption tool that minimizes metadata and hides encrypted data. With tird, you can: 1. Create files filled with random data to use as containers ...
cloudquery
ไบ็ซฏ่ฟ็ปด๏ผๅๅซๆททไนฑ CloudQuery ๆฏไธๆฌพไธไธบๅนณๅฐๅข้ๆ้ ็ไบ่ตไบงๆธ ๅๅทฅๅ ทใๅฐๆจ็ไบๅบ็ก่ฎพๆฝๅ ๆฐๆฎๅๆญฅๅฐๆฐๆฎไปๅบ๏ผ่ต่ฝๆดๅฏไธ่ชๅจๅใๅจ AWSใAzureใGCP ไปฅๅ WizใFinoutใGitHub ็ญ 70 ๅคไธชไบๅ SaaS ๆฐๆฎๆบไธญ็ปไธๆฐๆฎๅนถๆไพไธไธๆใ ๅฎ่ฃ root@kitploit: brew install cloudquery/tap/cloudquery ๆฅ็ๅฟซ้ๅ ฅ้จๆๅไปฅ่ทๅ Linux ๅ Windows ็ๅฎ่ฃ ่ฏดๆ๏ผไปฅๅไฝฟ็จ CloudQuery ๅฎๆ้ฆๆฌกๅๆญฅ็้ๆญฅๆ็จใ ไธบไปไน้ๆฉ CloudQuery๏ผ ไธไธๆไปถ่ฆ็ - ๆฏๆไบๅบ็ก่ฎพๆฝใๅฎๅ จๆงๅ...
CVE-2025-57462
CVE-2025-57462 Des: Stored XSS via Malicious File Upload in machpanel 8.0.32. POC: Navigate to https://controlpaneldomain/Client/SubmitTicket.aspx and Upload PDF file that contain XSS scripts in metadata, after submitting the ticket you can execute malicius XSS script by accessing the uplaoded...