ChameleonMini

ChameleonMini This is NOT the official repository of ChameleonMini, a freely programmable portable tool for NFC security analysis that can emulate and clone contactless cards, read RFID tags, and sniff/log RF data. This repository brings support for the Chameleon Tiny. Our Project is based on the...

365Inspect

Purpose Further the state of Microsoft 365 security by authoring a PowerShell script that automates the security assessment of Microsoft 365 environments. Soteria Inspect Soteria Inspect is born from the 365Inspect project and is Soteria's SaaS solution to aid in assessing the security of a...

Impulse

💣 Impulse Modern Denial-of-service ToolKit 💻 Main window 📡 Methods: Method| Target| Description ---|---|--- SMS| PHONE| Sends a massive amount of SMS messages and calls to a single target EMAIL| EMAIL| Sends a massive amount of Email messages to a target NTP| IP:PORT| NTP amplification is a type ...

CVE-2026-113610

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

CVE-2026-113605

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, whe...

unicorn

unicorn Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Magic Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David...

CVE-2025-31324

CVE-2025-31324 How does this detection method work? The template performs an HTTP GET request to the target's base URL and examines the response headers to identify SAP NetWeaver Application Server instances. This information helps assess whether the system might be susceptible to CVE-2025-31324...

CVE-2026-45806

CVE-2026-45806 Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin SSRF because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering. Intro I found this issue while reviewin...

Sirius

Sirius Scan Sirius is an open-source vulnerability scanner with automated discovery, CVE-based detection, and a modern web UI. Clone, run four commands, start scanning. Quick Start git clone https://github.com/SiriusScan/Sirius.git cd Sirius docker compose -f docker-compose.installer.yaml run --r...

CVE-2025-67223

CVE-2025-67223: Incorrect Access Control & Information Disclosure in Aranda Service Desk CVE ID: CVE-2025-67223 Affected Product: Aranda Service Desk Aranda File Server - AFS module Affected Versions: 8.3.12 Author: Brandon Perez Lara 🚨 Overview A critical vulnerability was identified in the file...

fireELF

fireELF fireELF is a opensource fileless linux malware framework thats crossplatform and allows users to easily create and manage payloads. By default is comes with 'memfdcreate' which is a new way to run linux elf executables completely from memory, without having the binary touch the harddrive...

wuzz

wuzz Interactive cli tool for HTTP inspection. Wuzz command line arguments are similar to cURL's arguments, so it can be used to inspect/modify requests copied from the browser's network inspector with the "copy as cURL" feature. Installation and usage GO $ go get github.com/asciimoo/wuzz $...

CVE-2026-113648 ApostropheCMS: Missing Authentication in `cleanExport` Route

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

CVE-2026-113648

The ApostropheCMS Node.js content management system contains a vulnerability in the @apostrophecms/import-export module prior to version 3.7.1 . The API endpoint POST /api/v1/@apostrophecms/import-export/clean-export lacks necessary authentication and authorization checks. This allows any client,...

EUVD-2026-105172

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticate...

LaZagne

The LaZagne Project !!! Description The LaZagne project is an open source application used to retrieve lots of passwords stored on a local computer. Each software stores its passwords using different techniques plaintext, APIs, custom algorithms, databases, etc.. This tool has been developed for...

Singularity

Singularity - Stealthy Linux Kernel Rootkit "Shall we give forensics a little work?" Singularity is a powerful Linux Kernel Module LKM rootkit designed for modern 6.x kernels. It provides comprehensive stealth capabilities through advanced system call hooking via ftrace infrastructure. Full...

crlfuzz

CRLFuzz A fast tool to scan CRLF vulnerability written in Go Resources Installation from Binary from Source from GitHub Usage Basic Usage Flags Target Single URL URLs from list from Stdin Method Data Adding Headers Using Proxy Concurrency Silent Verbose Version Library Help & Bugs License Version...

VcenterKiller

VcenterKiller -1. Note For those setting up a vulnerable environment locally, using vckiller to verify log4j will mostly fail, because under VMware's NAT mode, the outgoing network interface in the verification module will be determined as 127.0.0.1, causing the target's LDAP Server address to...

AppInfoScanner

Language : 简体中文 | English This project is currently just the tip of the iceberg of the planned project. If you are interested in this project or want to participate in the subsequent development or translation work, please send an email to [email protected] explaining your capabilities and...