undetected-httpx

undetected-httpx undetected-httpx is a multi-purpose HTTP probing toolkit inspired by httpx. It is specifically engineered to bypass modern anti-bot infrastructures by mimicking real-world browser signatures. Traditional HTTP clients are easily fingerprinted and blocked by WAFs. This tool leverag...

CGIShell

CGIShell shellshock CVE-2014-6271 CGI Exploit Use like OpenSSH via CGI Page Use python cgishell.py 'http://www.google.com/cve-2014-6271/poc.cgi' Screenshot Dependence Windows needed pyreadline It is not needed chardet Future Add TestCase HTTP Login Support http transmission gzip compression chard...

goahead-webserver-pre-5.1.5-RCE-PoC-CVE-2021-42342-

Goahead webserver pre v5.1.5 RCE PoC CVE-2021-42342 A recent bug in Goahead Webserver was discovered by William Bowling which leads to RCE on the exploited server. The issue exists prior to version 5.1.5 which, according to Shodan covers around 2.8mio servers on the internet. A CVS is available n...

AVBypass

antivirus bypass protection requirements golang installed usage 1 - create your payload go run create.go e.g: go run create.go 1.1.1.1 443 SecRetkira https://www.youtube.com/watch?v=Rv4VzpGCEEM 2 - in output folder you will find shell.go compile it go build shell.go 3 - now you have exe file to...

mach_race

Mach Race OS X Local Privilege Escalation Exploit c fG! 2015, 2016, [email protected] - https://reverse.put.as A SUID, SIP, and binary entitlements universal OS X exploit CVE-2016-1757. Usage against a SUID binary: ./machraceserver /bin/ps compatmode for i in seq 0 1000000; do...

CTFCrackTools

CTFCrackTools X Next-Generation Node-Based CTF Toolkit English | 简体中文 From V4 to X — More Than Just a Version Number Download | Features | Author's Note Brand Evolution CTFCrackTools X represents the next generation of CTFCrackTools. The "X" stands for: eXtreme — Ultimate performance and experien...

cloud-custodian

Cloud Custodian c7n Cloud Custodian, also known as c7n, is a rules engine for managing public cloud accounts and resources. It allows users to define policies to enable a well managed cloud infrastructure, that's both secure and cost optimized. It consolidates many of the adhoc scripts...

CVE-2021-26121

CS-Cart templates.manage Server Side Template Injection Remote Code Execution Vulnerability Found by: Steven Seeley of 360 Vulcan Team Version: = 4.12.x latest Date: 2021-01-08 12:49 CVE: CVE-2021-26121 Disclosure Timeline 2021-01-26 – Sent to CSCart dev team 2021-01-27 – Notification of reciept...

loki-parse

loki-parse A python script that can detect and parse loki-bot malware related network traffic between a compromised host and a C2 server. This script can be helpful to DFIR analysts and security researchers who want to know what data is being exfiltrated to the C2, bot tracking, etc... This scrip...

CVE-2023-43284

CVE-2023-43284 DLink Model DIR-846 Authenticated Remote Code Execution. This flaw abuse QoS POST parameter in the router to exploit an Authenticated Remote Code Execution. Doesn't require QoS be enabled! -h, --help show this help message and exit -x , --command Command to be executed Default: id ...

CVE-2024-8381

CVE-2024-8381 A SpiderMonkey Interpreter Type Confusion Bug. This repository contains analyses in markdown and slide forms, including root cause, PoC, and exploit. Unfortunately, due to nature of this bug, exploit is only applicable when ASLR is disabled. Slides: Slides.pdf Analysis: Analysis.md...

CPLDCOMTrigger

CPLDCOMTrigger Description A Python script depends on Impacket scripts to trigger the loading of a .cpl file into memory using a DCOM object. The CPL file path must already be added to the registry. The script uses the Open function in the IOpenControlPanel interface to load the CPL Control Panel...

Astral_Projection

Astral Projection - UDRL Astral Projection is a Cobalt Strike UDRL User-Defined Reflective Loader, that performs advanced module stomping. The UDRL loads a module using LoadLibraryExW, then manipulates its internals by setting VEH to intercept strategic calls that allow it to steal the section...

morf

MORF Mobile Reconnaissance Framework A powerful offensive security toolkit for mobile application analysis Find Secrets. Protect Apps. Stay Secure. 📋 Table of Contents 💡 Overview 🚀 Quick Start 🔍 Key Features 🏗️ Architecture 📋 Common Use Cases 📦 Installation Prerequisites Method 1: Docker...

FavFreak

FavFreak - Weaponizing favicon.ico for BugBounties , OSINT and what not Detailed Description about this can be found here : Read Blog here : https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 Introduction I have created this tool for making my wor...

JSONBee

JSONBee A ready to use JSONP endpoints to help bypass content security policy of different websites. The tool was presented during HackIT 2018 in Kiev. The presentation can be found here not sure why format of the slides is screwed :D:...

CVE-2026-35273

🚨 CVE-2026-35273 - Oracle PeopleSoft PeopleTools Unauthenticated Remote Code Execution ⚠️ Critical Unauthenticated RCE in Oracle PeopleSoft PeopleTools A vulnerability affecting Oracle PeopleSoft Enterprise PeopleTools that allows remote attackers to compromise vulnerable systems without...

CVE-2019-0708

CVE-2019-0708 Goby support CVE-2019-0708 "BlueKeep" vulnerability check. Respect to @JaGoTu and @zerosum0x0 How to use 1. Download Goby http://gobies.org/ 2. Download and instrall npcap https://nmap.org/npcap/ 3. Scan network of 3389 port ScreenShots About Goby Goby - Make Cybersecurity More...

power_analysis

Power analysis attack over RSA Index Index Introduction Power Analysis Attacks RSA: A Short Introduction RSA Example Equipment Measuring Power: A Short Introduction Ohm's Law Kirchhoff's Voltage Law KVL Voltage Divider Shunt Resistor Example Power Measurement Fast Exponentiation Fast Exponentiati...

CVE-2021-3560

CVE-2021-3560 a reliable C based exploit for CVE-2021-3560. Summary: Yestreday i stumbled upon this blog post by Kevin Backhouse discovered this vulnerability, i tried the bash commands provided in the blogpost and to my surpise it worked on my Kali Linux box! CVE-2021-3560 is an authentication...