CVE-2019-0708-Batch-Blue-Screen

CVE-2019-0708-Batch-Blue-Screen Modified version of a blue screen script by an expert, changed to batch blue screen for a network segment. Usage: root@kitploit: python3 poc.py 192.168.20 64 Batch attacks hosts 1-255 in the 192.168.20 network segment to cause blue screens. Modify accordingly based...

Dirty-Frag-CVE-2026-43284

Dirty Frag CVE-2026-43284 and CVE-2026-43500 Exploit Reproduction and Detection Lab for a Linux kernel local privilege escalation chain. Status: VERIFIED. I completed the reproduction, the fileless verification, and the syscall-level detection in the lab kernel 6.18.9+kali-amd64. This document is...

AMBER-ICI

AMBER ICI v5 AMBER ICI AMBER Investigative Command Interface is a local-first browser interface for investigative and analytical workflows powered by a local Ollama server. It includes: A single-model Analyst Console and multi-model Parallel execution A user-defined agent chain driven from the ma...

algo

Algo VPN Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release announcement for more information. Features Supports only IKEv2 with strong crypto AES-GCM...

uefi_bootkit_softlanding

SOFTLANDING UEFI BOOTKIT — ARES-2026-0001 The first public documentation of the SoftLanding UEFI DXE bootkit — a multi-agent, cross-platform firmware implant that persists in SPI flash Ring -2, deploys kernel and userland agents, and survives OS reinstallation and BIOS updates. ⚡ QUICK CHECK — AR...

HATCHA

HATCHA CAPTCHA demuestra que eres humano. HATCHA demuestra que no lo eres. HATCHA H yperfast A gent T est for C omputational H euristic A ssessment es un CAPTCHA inverso que restringe el acceso mediante desafíos triviales para agentes de IA pero tediosos para humanos: multiplicación de números...

PenBox

PenBox – Un Framework de Pruebas de Penetración Un Framework de Pruebas de Penetración, El Repositorio del Hacker, nuestra esperanza es que en la última versión tendremos cada script que un hacker necesita Recopilación de Información : nmap Setoolkit Escaneo de Puertos Host To IP Enumeración de...

Ventoy

Ventoy Ventoy es una herramienta de código abierto para crear unidades USB arrancables para archivos ISO/WIM/IMG/VHDx/EFI. Con Ventoy, no necesitas formatear el disco una y otra vez, solo copia los archivos de imagen a la unidad USB e inícialos. Puedes copiar muchos archivos de imagen a la vez y...

CVE-2019-9053-working-

CVE-2019-9053-working script- CMS Made Simple 2.2.10 - SQL Injection . Actual working version Updated the script to work with latest python versions Added Exception Handling for each function You can also calibrate time.sleep inside the exception handling blocks depending on response and connecti...

Arkhota

Arkhota, un forzador web para Android ¿Qué es? Arkhota es un forzador web HTTP/S para Android OS. ¿Por qué? Un forzador web siempre está en la computadora de un hacker, por razones obvias. A veces los ataques requieren ser rápidos o/y con una preparación mínima del dispositivo. Además, un teléfon...

intel-me-research

Intel ME Firmware Reverse Engineering — Live CSME 16.x Analysis "Your computer has a secret second computer inside it. We found it, mapped it, and documented what's hiding in there." 🔥 TRY IT YOURSELF — HECI SPY 🔥 One Python script. Zero dependencies. Talk to your Intel Management Engine directly...

CVE-2025-2304-POC

CVE-2025-2304 PoC - Escalada de Privilegios en Camaleon CMS Una prueba de concepto PoC para CVE-2025-2304 , una vulnerabilidad crítica de asignación masiva en Camaleon CMS que permite la escalada de privilegios de usuarios con pocos permisos a administradores. root@kitploit: ██████╗ ██████╗ ██╗...

CVE-2026-84083

creationtimestamp| type| source ---|---|--- 2026-09-19 21:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvvlcuxqvi24...

cs2modrewrite

Automatically Generate Rulesets for Apache modrewrite or Nginx for Intelligent HTTP C2 Redirection This project converts a Cobalt Strike profile to a functional modrewrite .htaccess or Nginx config file to support HTTP reverse proxy redirection to a Cobalt Strike teamserver. The use of reverse...

ci_fuzz

Description: root@kitploit: This script fuzz's for Command Injection vulnerabilities resulting in remote command execution. Similiar OWASP vulnerablities are explained here -- https://www.owasp.org/index.php/CommandInjection The script will attempt to execute OS commands by injecting into every...

CVE-2020-15368

How to exploit a vulnerable windows driver Exploit and Proof of Concept PoC for CVE-2020-15368. Asrock repackaged rweverything driver for their RGB controller configuration tool and signed it. They "protect" it by encrypting their ioctls...lol. We found this CVE by accident last summer, and afaik...

device-activity-tracker

Device Activity Tracker WhatsApp & Signal Activity Tracker via RTT Analysis ⚠️ DISCLAIMER : Proof-of-concept for educational and security research purposes only. Demonstrates privacy vulnerabilities in WhatsApp and Signal. Overview This project implements the research from the paper "Careless...

netfence

Netfence Like Envoy xDS, but for eBPF filters. Netfence runs as a daemon on your VM/container hosts and automatically injects eBPF filter programs into cgroups and network interfaces, with a built-in DNS server that resolves allowed domains and populates the IP allowlist. Netfence daemons can be...

IOCs

//////////////// ////////////////////// // //////////////////////// // /// /////// ///// /////// /////// /////// /////// //////// //////// //////// //////// //////// //////// //////// //////// //////// //////// /////// /////// /////// /////// ///// // ////// // // /////////////////////////...

CVE-2025-67158

CVE-2025-67158 — Revotech I6032W-FHW Summary The Revotech I6032W-FHW IP camera firmware contains an authentication bypass vulnerability in the /cgi-bin/jvsweb.cgi endpoint. The device does not validate the user.name and user.digest fields included in JSON-based API requests, allowing...