GTFOBins.github.io

GTFOBins GTFOBins es una lista curada de ejecutables tipo Unix que pueden ser usados para eludir restricciones de seguridad locales en sistemas mal configurados. Encuentra el proyecto en: gtfobins.org...

stunner

STUNNER Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats WebRTC. If you find a misconfigured server you can use this tool to open a local socks proxy that relays all traffic via the TURN protocol into t...

stunner

STUNNER Stunner es una herramienta para probar y explotar servidores STUN, TURN y TURN sobre TCP. TURN es un protocolo usado principalmente en videoconferencias y chats de audio WebRTC. Si encuentras un servidor mal configurado, puedes usar esta herramienta para abrir un proxy socks local que...

gitjacker

gitjacker Gitjacker downloads git repositories and extracts their contents from sites where the .git directory has been mistakenly uploaded. It will still manage to recover a significant portion of a repository even where directory listings are disabled. For educational/penetration testing use...

gtfocli

GTFOcli GTFOcli es una interfaz de línea de comandos para la búsqueda sencilla de binarios que pueden ser utilizados para eludir las restricciones de seguridad locales en sistemas mal configurados. Tabla de contenidos Tabla de contenidos Instalación Uso Búsqueda de binarios Unix Búsqueda de...

LOLBins

LOLBins Aplicación PyQT para listar todos los Binarios y Scripts Living Off The Land para Windows desde LOLBAS y binarios Unix que pueden usarse para evitar restricciones de seguridad locales en sistemas mal configurados desde GTFOBins. Windows Linux...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 is a critical vulnerability leading to Remote Code Execution RCE in Apache Tomcat. This vulnerability works on versions 9.0.0.M1 - 9.0.0, 8.5.0-8.5.22, 8.0.0.RC1 - 8.0.46, 7.0.0 - 7.0.81. Tested only on 8.0.24. Vulnerability uses misconfigured PUT option on the...

POC-CVE-2021-42013-EXPLOIT

-ff0055?style=for-the-badge&logo=python 🔥 CVE-2021-42013 Exploit Framework by Makaveli 💀 Modo Hacker Cósmico Multidimensional activado... Una herramienta avanzada de escaneo, explotación e interacción remota diseñada para detectar y aprovechar la vulnerabilidad Apache Path Traversal + RCE...

CVE-2019-9193

CVE-2019–9193 - PostgreSQL 9.6.1 Remote Code Execution Authenticated Proof of Concept PostgreSQL Database from version 9.6.1 are vulnerable to Authenticated Remote Code Execution. Even if it isn't considered to be a vulnerability itself by the development team, this could be leveraged to gain...

firebase

firebase Explotando bases de datos Firebase vulnerables o mal configuradas Aviso legal: El software proporcionado es solo para fines educativos. Úselo bajo su propio criterio, el creador no se hace responsable de los daños causados. Por favor, ¡úsalo de manera responsable! Requisitos previos...

PwnCity

PwnCity An insecurely configured TeamCity continuous integration environment. Work in progress: Deployment code coming soon eventually . Demo There may be more than one path through PwnCity, but this is the one I'll be presenting on Feb 24th at the OWASP Sacramento Chapter meeting. Note:...

CVE-2021-36934-HiveNightmare-Lab

CVE-2021-36934 HiveNightmare - Laboratorio Educativo 🎯 Objetivo Reproducir y analizar la vulnerabilidad HiveNightmare en un entorno de laboratorio controlado. 📋 Tabla de Contenidos Descripción de la Vulnerabilidad Implementación Demostración Configuración del Laboratorio y Herramientas Pasos de...

CVE-2025-23419

🔐 TLS Session Reuse Exploit Tester $ BY XIT A Python-based tool to test potential TLS session reuse vulnerabilities that may allow authentication bypass in misconfigured servers. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Do NOT use it on systems...

CVE-2025-27558_Patching

CVE-2025-27558Patching Parche de la vulnerabilidad CVE-2025-27558 que había afectado a mi imagen de Linux. Incidente de Atlas: Conexión saliente inesperada 197.155.77.1 Esta carpeta documenta una anomalía de red real detectada en la máquina Atlas , un sistema Ubuntu monitoreado por Wazuh. Durante...

Reverse-Lookup Service Exposed Millions of Photos of People’s Faces

The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed...

CVE-2026-72506

VoiceTra provided by National Institute of Information and Communications Technology NICT contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server or service controlled by an attacker, potentially resulting in the theft of input dat...

EUVD-2026-57716

VoiceTra provided by National Institute of Information and Communications Technology NICT contains an incorrectly specified destination in a communication channel vulnerability. Users may be directed to a server or service controlled by an attacker, potentially resulting in the theft of input dat...

EUVD-2026-54090

Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True...

CVE-2026-65551

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7...

EUVD-2026-53820

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...