ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

HydraDragonAntivirus openedr-v2-release-9

Hydra Dragon Antivirus 📚 For detailed documentation, architecture diagrams, and component guides, visit our Project Wiki. WARNING: ACTIVE DEVELOPMENT IN PROGRESS This project is not production-ready. Breaking changes, bugs, and incomplete features should be expected. ⚠️ NOTICE: This repository is...

CVE-2024-1651-PoC

CVE-2024-1651 Este CVE fue descubierto por Carlos Bello del Fluid Attack Offensive Team. El hallazgo aborda la deserialización insegura de objetos para obtener RCE Ejecución Remota de Código. Aquí he creado un PoC Prueba de Concepto más rápido y fácil de usar. Por lo tanto, si alguien quiere...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

EUVD-2026-70985

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2026-85547

CVE-2026-85547 is a cross-site request forgery (CSRF) vulnerability in MISP (Malware Information Sharing Platform). The root cause is that MISP's _isRest() check disables form-security and CSRF protections when a request is identified as REST, but this detection can be manipulated by an attacker-...

CVE-2026-85547 Cross-Site Request Forgery via Attacker-Controlled REST Detection in MISP

A cross-site request forgery CSRF vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether an incoming request was identified as a REST request. MISP's REST detection can be influenced by request properties such as the URL suffix or the HTTP Accept...

CVE-2025-29824

🔥 CVE-2025-29824 Zero-Day Exploit 🔥 Welcome to the dark heart of cyberspace, where ethical boundaries bend under the weight of forbidden knowledge. This repository contains a proof-of-concept PoC exploit for CVE-2025-29824 , a use-after-free UAF vulnerability in the Windows Common Log File System...

CVE-2024-1403

CVE-2024-1403 Progress OpenEdge Bypass de Autenticación Una prueba de concepto de exploit para Progress OpenEdge CVE-2024-1403. Publicación en el Blog Más detalles aquí: https://www.horizon3.ai/attack-research/cve-2024-1403-progress-openedge-authentication-bypass-deep-dive Uso Debe proporcionar s...

kbd-audio

kbd-audio This is a collection of command-line and GUI tools for capturing and analyzing audio data. Keytap The most interesting tool is called keytap - it can guess pressed keyboard keys only by analyzing the audio captured from the computer's microphone. Check this blog post for more details:...

OFBiz-Attack

OFBiz-Attack Una herramienta para el ataque CVE-2023-49070/CVE-2023-51467 Entorno de prueba vulhub/ofbiz:18.12.09 Uso Iniciar root@kitploit: java -jar OFBiz-Attack.jar Hay tres módulos: Detección de vulnerabilidades Solo es necesario introducir la URL de destino; no añadas rutas adicionales, de l...

netlas-cookbook

Netlas CookBook The goal of this guide is to teach anyone interested in cybersecurity, regardless of their knowledge level, how to make the most of Netlas Search Tools. This is a long read. We have collected as many simple use cases as possible and demonstrated how to automate them. ⭐️ Give us a...

CVE-2018-3639-specter-v4-

CVE-2018-3639-specter-v4 spectre v4 : Prueba de concepto de Speculative Store Bypass CVE-2018-3639 para Linux compilar: gcc spectre-v4.cpp -o spectre ejecutar: ./spectre resultado: --------attack-------- low than threshold:155 low than threshold:144 low than threshold:133 low than threshold:0 low...

attack-attention

Atacar la atención de los modelos fundacionales interrumpe eficazmente las tareas posteriores Implementación oficial en PyTorch del artículo "Atacar la atención de los modelos fundacionales interrumpe eficazmente las tareas posteriores" , aceptado en el taller Adversarial Machine Learning on...

prowler v5.41.0

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

nrf24-playset

nRF24 Playset El nRF24 Playset es una colección de herramientas de software para dispositivos de entrada inalámbricos como teclados, ratones y presentadores basados en transceptores nRF24 de Nordic Semiconductor, p. ej. nRF24LE1 y nRF24LU1+. Todas las herramientas de software son compatibles con...

Ivanti-EPM-Coercion-Vulnerabilities

Vulnerabilidades de Coerción de Ivanti EPM Exploits de prueba de concepto para Ivanti EPM CVE-2024-13159 y otros que permiten la coerción no autenticada de la credencial de la máquina Ivanti EPM para su uso en ataques de retransmisión. Publicación en el Blog Análisis en profundidad aquí:...

domi-owned

Domi-Owned Summary Domi-Owned is a tool used for compromising IBM/Lotus Domino servers. Tested on IBM/Lotus Domino 8.5.2, 8.5.3, 9.0.0, and 9.0.1 running on Windows and Linux. Requirements Domi-Owned uses Python 3, which can be install through your distribution's package manager apt, yum, etc...

ctftool

CTFTOOL Just want to test the SYSTEM exploit? Click here. An Interactive CTF Exploration Tool This is ctftool, an interactive command line tool to experiment with CTF, a little-known protocol used on Windows to implement Text Services. This might be useful for studying Windows internals, debuggin...