Imperva_gzip_bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...

ShareHound

ShareHound: Mapping rights of network shares using BloodHound OpenGraph A tool to map the access rights of network shares into BloodHound OpenGraphs. Read the associated blog post: https://specterops.io/blog/2025/10/30/sharehound-an-opengraph-collector-for-network-shares/ Two implementations This...

dbeaver

DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...

summit

One scriptable CLI for web security testing: scanner, TLS-intercepting proxy, fuzzer, authorization testing, WAF analysis, link-hijack detection, race conditions, scheduled monitoring and recon. 58+ checks across 11 families, 37 bundled YAML templates, Intruder-style payload fuzzing and a...

ObfuXtreme

If you find this GitHub repo useful, please consider giving it a star! ⭐ ⚡ ObfuXtreme — Advanced Python Obfuscation Engine ObfuXtreme is an advanced Python obfuscation engine focused on structural obfuscation , AST-level transformations , and runtime payload protection. It is designed for securit...

wp2shell

wp2shell by: ek0ms savi0r Unauthenticated Remote Code Execution for WordPress Core POC CVE-2026-63030 + CVE-2026-60137 wp2shell exploit for a critical vulnerability chain in WordPress core. It chains a REST API batch route confusion bug with an SQL injection in WPQuery to achieve unauthenticated...

FindFunc

FindFunc: Advanced Filtering/Finding of Functions in IDA Pro FindFunc is an IDA Pro plugin to find code functions that contain a certain assembly or byte pattern, reference a certain name or string, or conform to various other constraints. FindFunc won third place in the 2022 HexRays IDA Pro Plug...

smbcrawler

SmbCrawler SmbCrawler is no-nonsense tool that takes credentials and a list of hosts and 'crawls' or 'spiders' through those shares. Features: takes host names, IP addresses, IP ranges, or an nmap xml file as input checks permissions check for 'write' permissions is opt-in, because it requires...

CVE-2026-3854-lab

Flagship Lab 001: From Git Push Options to RCE A local Learning Lab and Research Lab inspired by the publicly documented vulnerability concepts behind CVE-2026-3854. Both experiences use real authenticated Git pushes against ForgeDock, a fictional Git server; the Research Lab. !CAUTION This proje...

CVE-2023-36723

CVE-2023-36723 This is PoC for arbitrary directory creation bug in Container Manager service. This PoC is not thoroughly tested so it may not even work most of the time it was enough for msrc to confirm vulnerability. In order to exploit this vulnerability a Windows Sandbox feature have to be...

SparstanBoogie

SparstanBoogie's origins were tested reportedly on iOS/iPadOS 15.2 - 16.7 RC 20H18 and 17.0 however, tests have been conducted up to 26.1 26.1. Also any testing on devices above or under whats been reported is welcomed as it may come back in newer devices so theres no reason to shrug off any good...

msteams

msteams A Mythic C2 Profile that uses the Microsoft Graph API to communicate through a Microsoft Teams channel. How It Works Agent Microsoft Teams Channel C2 Server Mythic 1. The agent authenticates to Microsoft Entra ID via OAuth2 client credentials 2. Posts its Mythic message base64-encoded,...

VMDragonSlayer

VMDragonSlayer Project will be public by mid-October Refactoring In Progress Advanced Virtual Machine Detection and Analysis Framework VMDragonSlayer is a comprehensive framework for analyzing binaries protected by Virtual Machine VM based protectors such as VMProtect 2.x/3.x, Themida, and custom...

private-landing

Private Landing Learn authentication by building it right. Live Demo · Threat Model · Auth Flows · ADRs Demo note: The login endpoint is protected by adaptive PoW challenges — repeated failures return increasing proof-of-work difficulty. Cache-backed rate limiting is implemented and tested but no...

UAP-protocol

██╗ ██╗ █████╗ ██████╗ ██║ ██║██╔══██╗██╔══██╗ ██║ ██║███████║██████╔╝ ██║ ██║██╔══██║██╔═══╝ ╚██████╔╝██║ ██║██║ ╚═════╝ ╚═╝ ╚═╝╚═╝ Universal Agent Protocol A unified, security-first wire protocol for tool access, agent coordination, and structured RPC. Built to close CVE-2025-49596 and the clas...

CVE-2024-10924-Wordpress-Docker

CVE-2024-10924 : Wordpress Really Simple Security authentication bypass flaw in Docker Description The Really Simple Security plugins Free, Pro, and Pro Multisite for WordPress, versions 9.0.0 to 9.1.1.1, are affected by an authentication bypass vulnerability. This issue arises from improper erro...

CVE

CVE's Table CVE Number| Type| Company/Product| Description| Article Link| Repository Link ---|---|---|---|---|--- CVE-2026-9680| SQLi| Alibaba RDS MCP Servers| TBA| TBA| TBA CVE-2026-50335| LPE| Windows July 2026| TBA| TBA| TBA GHSA-73cv-556c-w3g6| SQLi| Apache Pinot MCP 3.1.0| Missing sanitizati...

TREVORproxy

TREVORproxy A SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses! See the accompanying Blog Post for a fun rant and some cool demos! Note: If you're looking to defend against this...

ghidra-mcp

Ghidra MCP Server If you find this useful, please ⭐ star the repo — it helps others discover it! If Ghidra MCP saves you time, consider sponsoring the project. One-time and recurring support both help fund compatibility updates, production hardening, docs, and new tooling. A production-ready Mode...

Ninja

Quick Update to include Follina Exploitation 01/06/2022 - NinjaC2 will generate the document and serve the HTML payload . More information : https://www.linkedin.com/posts/ahmed-khlief-499321a7i-just-pushed-a-quick-update-to-ninjac2-to-activity-6937661951007170560-Tmps Ninja V2.2 Released...