POC-CVE-2026-60206

CVE-2026-60206 — Обход аутентификации SAML в Oracle WebLogic CVSS 9.9 — обход аутентификации SAML в Oracle WebLogic Server Core. Подвержены: 12.2.1.4.0 14.1.1.0.0 14.1.2.0.0 15.1.1.0.0 ⚠️ Только авторизованное тестирование безопасности. Установка root@kitploit: git clone...

pstf2

pstf^2 Passive Security Tools Fingerprinting Framework Have you ever wanted a simple, easy and stealth bypass for multiple classes of security products? pstf^2 pronounced pstf-square is an implementation of an HTTP server capable of passive browser fingerprinting - and it might just be the thing...

SKA

About SKA allows you to implement a very simple and fast karma attack. You can sniff probe requests to choose the fake AP name or, if you want, you can insert the name of the AP manually evil twin attack. When target is connected to your WLAN you can active the HTTP redirection and perform a MITM...

Chaya

Chaya Right To Privacy Chaya protects your privacy through steganography, cryptography and compression. It effectively encrypts your payloads using AES-256-GCM cryptography, embeds them using LSB-LPS steganography technique into images and compresses them using FLIF to evade detection by performi...

Flerken

Flerken Introduction Command Line Obfuscation CLOB has been proved to be a non-negligible factor in fileless malware or malicious actors that are "living off the land". With dozens of obfuscation tools seen in the wild, by contrast few proper countermeasures can be found. In this talk, we present...

knocker

Knocker is a self-hosted service that provides an HTTP based "knock-knock" single-packet authorization SPA gateway for your Homelab with web, cli + gnome and android clients. it can be used as authentication for your reverse proxy like Caddy, or even on the firewall level using the FirewallD...

ZeusCloud

Secure your cloud. ZeusCloud is an open source cloud security platform. Discover, prioritize, and remediate your risks in the cloud. Build an asset inventory of your AWS accounts. Discover attack paths based on public exposure, IAM, vulnerabilities, and more. Prioritize findings with graphical...

awesome-appsec-interview

Awesome AppSec Interview A curated list of resources, practice questions, and study materials to help you prepare for Application Security Engineer interviews, organized by interview type. Contents Interview Overview Secure Code Review Threat Modeling Coding & Scripting Scenario-Based Interviews...

threatbox

Threatbox - Standard Attack Platform ThreatBox is a standard and controlled Linux based attack platform. I've used a version of this for years. It started as a collection of scripts, lived as a rolling virtual machine, existed as code to build a Linux ISO, and has now been converted to a set of...

wardn

wardn A credential firewall for AI agents. The headline claim is structural, not policy: agents receive placeholder tokens, never real API keys. The real key crosses only one network seam — inside the wardn proxy, on its way to the upstream API — and is stripped from responses before they reach t...

Puwr

Contents About Puwr Puwr Usage Port scanning Showcases Disclaimer Future Puwr Easily expand your attack surface on a local network by discovering more hosts, via SSH. Using a machine running a SSH service, Puwr uses a given subnet range to scope out IP's, sending back any successful ping requests...

PiSavar

PiSavar - Detects PineAP module and starts deauthentication attack for fake access points - WiFi Pineapple Activities Detection About Project The goal of this project is to find out the fake access points opened by the WiFi pineapple device using the PineAP module and to prevent clients from bein...

wcw-cyberring-pav-decryptor

WCW CyberRing PAV Decryptor Cryptanalysis of a proprietary 1999 video DRM system, recovering 51 minutes of lost media through static binary analysis and known-plaintext attack. Frame from a recovered "CyberRing" match. WCW wrestlers were filmed against blue screen and composited into a CGI arena...

tengu

Tengu — Pentesting MCP Server "In Japanese mythology, the Tengu is a fierce mountain spirit — master strategist, warrior, and trainer of samurai. In cybersecurity, it guides you through every phase of the hunt." From recon to report — AI-assisted pentesting in one command. Tengu is an MCP server...

redeval

RedEval - LLM 안전성 평가 프레임워크 체계적인 공격attack 및 거부refusal 테스트를 통해 대규모 언어 모델LLM의 안전성을 평가하기 위한 포괄적인 프레임워크입니다. RedEval은 적대적 프롬프트와 유해 콘텐츠에 대한 LLM의 견고성을 평가하기 위한 통합되고 안전하며 확장 가능한 플랫폼을 제공합니다. 이는 LLM의 종합적인 레드팀링red teaming을 위한 범용 데이터셋인 논문 "RedBench: A Universal Dataset for Comprehensive Red Teaming of Large...

PoC---CVE-2018-6389

PoC - CVE-2018-6389 Preuve de concept de la vulnérabilité CVE-2018-6389 sur Wordpress 4.9.2. Cette vulnérabilité permet à un attaquant distant non authentifié de provoquer un DoS d'une application web basée sur Wordpress. Présentation : docs.google.com/presentation Outil Python DoSer root@kitploi...

Cybersec

Offensive CyberSec Cheat Sheet A highly dynamic, single-file HTML cheat sheet designed for Red Teamers, Pentesters, and CTF players. Tired of typing the same Reverse Shell payloads and constantly replacing your local IP and port? This tool eliminates the "Typo Fatigue" and cognitive load during...

Aladdin

Aladdin root@kitploit: .-. .-''-., | //\ ";\ "/ \ , |'./ \ '='-, /\ \ || ///\ '. T |\ | /,-' '. '..-' /'/ | | '. .'-../ ,\ / '-' |/ /-----j .--..--'\ / --' '---. / '---. -'. .' .-- '. \ '--. ;.-o / '. /.8----' c-'----' Lefty @lefterispan - Nettitude Red Team - 2022 / 2023 About Aladdin is a...

LeakGauge

LeakGauge Это репозиторий с кодом для нашей статьи: The Model's Tell: Measuring Context-Leakage Attack Signals with Behavior Gauges. Версия на arXiv и ссылка на статью: https://arxiv.org/abs/2608.17829 Этот репозиторий реализует конвейер LeakGauge для обнаружения утечек: подготовка демо-наборов...

MOSAIC

🎯 MOSAIC — v1.0.0-alpha Behavioral Intelligence Across Platforms A privacy-first, multi-platform framework for behavioral and sociodynamic analysis 📺 Demo 🧭 What is MOSAIC? MOSAIC is not a simple OSINT aggregator. It is a behavioral analysis framework designed to help researchers, analysts, and...