matchlock

Matchlock Experimental: This project is still in active development and subject to breaking changes. Matchlock is a CLI tool for running AI agents in ephemeral microVMs - with network allowlisting, secret injection via MITM proxy, and VM-level isolation. Your secrets never enter the VM. Why...

bypass-firewalls-by-DNS-history

Bypass firewalls by abusing DNS history This script will try to find: the direct IP address of a server behind a firewall like Cloudflare, Incapsula, SUCURI ... an old server which still running the same inactive and unmaintained website, not receiving active traffic because the A DNS record is n...

dnscat2

NOTE: The password for the .zip downloads are all "password"! Introduction Welcome to dnscat2, a DNS tunnel that WON'T make you sick and kill you! This tool is designed to create an encrypted command-and-control C&C channel over the DNS protocol, which is an effective tunnel out of almost every...

goproxy

GoProxy GoProxy is a library to create a customized HTTP/HTTPS proxy server using Go aka Golang, with several configurable settings available. The target of this project is to offer an optimized proxy server, usable with reasonable amount of traffic, yet customizable and programmable. The proxy...

CVE-2025-53693

CVE-2025-53693: HTML Cache Poisoning The XAML handler, located at /-/xaml/, exposes several controls that can be accessed without authentication. The AjaxScriptManager within these controls allows for the execution of methods via reflection. The AddToCache method can be abused to inject arbitrary...

icu-74-debian

icu-74-debian Debian build files for icu 74.2 with a patch to fix CVE-2025-5222 You need to download and extract icu74.2.orig.tar.gz to set up your source tree. Clone this repo somewhere with the following command :- git clone https://github.com/berkley4/icu-74-debian Copy the debian folder from...

CVE-2019-12725

CVE-2019-12725 CVE-2019-12725 ZeroShell Remote Command Execution Vulnerability =================================================== My own practice project...

CVE-2023-4220-RCE

CVE-2023-4220-RCE Summary Starlabs advisory Affected product: Chamilo , -p --port REMOTE PORT -c --comand Flags for reverse shell -lh/--localhost: Attacker IP -lp/--localtcat listener port...

cve-2023-34035-mitigations

This repo is a set of samples to demonstrate the arrangements wherein applications may be vulnerable to https://spring.io/security/cve-2023-34035CVE-2023-34035. An application is vulnerable when all of the following are true: Spring MVC is on the classpath DispatcherServlet and at least one other...

ComoDoS

Technical Details see: https://malwaretech.com/2026/06/exploiting-a-remote-kernel-vulnerability-in-comodo-internet-security.html...

Hollow

Hollow hollow is a shellcode loader generator. You give it a raw shellcode binary and a profile, and it spits out a compiled Windows PE loader with your shellcode encrypted inside. Getting Started Binaries are available on the releases page, or build from source: go build -o hollow . Requires...

Next.js-RSC-RCE-Scanner-CVE-2025-66478

Next.js RSC RCE Scanner and POC/Exploit Collection CVE-2025-66478 A command-line scanner for batch detection of Next.js application versions and determining if they are affected by CVE-2025-66478 vulnerability. This Scanner do not exploit the vulnerability Vulnerability Description...

brutus

Brutus "Et tu, Brute?" — The last words before credentials fall. Modern credential testing tool in pure Go Installation • Quick Start • Pipeline • Protocols • Enumeration • Proxy • Library Overview Brutus is a multi-protocol authentication testing tool designed to address a critical gap in...

CVE-2025-53772-IIS-WebDeploy-RCE

CVE-2025-53772 - IIS WebDeploy RCE Exploit This repository contains a Proof-of-Concept PoC exploit for CVE-2025-53772, a Remote Code Execution vulnerability in IIS WebDeploy through unsafe deserialization. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Th...

CVE-2024-6783

CVE-2024-6783 - Vue CVE A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript...

CVE-2021-41773

This repository does not have a README...

CVE-2025-54253-Inside-the-Adobe-AEM-Forms-Zero-Day

CVE-2025-54253: Inside the Adobe AEM-Forms Zero-Day — What Pentesters & Defenders Must Do TL;DR: Adobe Experience Manager AEM Forms on JEE ≤ 6.5.23.0 contained a critical, network-accessible flaw CVE-2025-54253 that allows unauthenticated remote code execution via misused Struts/OGNL endpoints. A...

CVE-2020-9802

This repository does not have a README...

CVE-2021-22986

CVE-2021-22986 F5 BIG-IP/BIG-IQ iControl Rest API SSRF to RCE Usage: python CVE-2021-22986.py...

CVE-2025-29306

POC - CVE-2025-29306 FOXCMS /images/index.html Code Execution Vulnerability Overview An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. Full POC Read about it — CVE-2025-29306 Disclaimer : This Proof of Concept POC ...