CVE-2019-9194-elFinder-Command-Injection-PoC

CVE-2019-9194 — elFinder Command Injection PoC Command injection vulnerability in elFinder = 2.1.47 via the PHP connector component. Allows unauthenticated remote code execution as the web server user. How it works Uploads a valid JPEG with a malicious filename containing a shell command. Trigger...

cve_2024_0044

CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...

CVE-2021-31166-exploit

CVE-2021-31166 HTTP Protocol Stack Remote Code Execution Vulnerability Attacked version： Microsoft:Windows 10: version 2004 for 32-bit Systems version 2004 for x64-based Systems version 2004 for ARM64-based Systems version 20H2 for 32-bit Systems version 20H2 for x64-based Systems version 20H2 fo...

CANalyzat0r

This software project is a result of a Bachelor's thesis created atSCHUTZWERK in collaboration with Aalen University by Philipp Schmied @CaptnBanana. Please refer to the correspondingblog post for more information. Why another CAN tool? Built from scratch with new ideas for analysis mechanisms...

pixiewps

概述 Pixiewps 是一款用 C 语言编写的工具，用于离线暴力破解 WPS PIN，利用某些软件实现中低或不存在熵的漏洞，即 Dominique Bongard 在 2014 年夏季发现的所谓“精灵粉尘攻击”。此工具仅供教育用途。 与传统的在线暴力破解攻击（如 Reaver 或 Bully 等工具实现的方法）需要数小时才能恢复 PIN 不同，该方法仅在数秒 或数分钟 内就能获得 PIN（具体取决于目标），前提是目标存在漏洞 。 自 1.4 版本起，它还可以通过完整的被动捕获（M1 到 M7）为某些设备恢复 WPA-PSK （目前仅适用于某些支持--mode 3 的设备）。...

strace

strace - Linux 系统调用跟踪器 这是 strace —— 一款用于 Linux 的诊断、调试和教学型用户空间工具，具有传统的命令行界面。它用于监控和篡改进程与 Linux 内核之间的交互，包括系统调用、信号传递以及进程状态的变更。strace 的运行依赖于名为 ptrace 的内核特性。 strace 依据 GNU 宽通用公共许可证 2.1 或更高版本 发布；详情请参阅 COPYING 文件。 strace 测试套件依据 GNU 通用公共许可证 2 或更高版本 发布；详情请参阅 tests/COPYING 文件。 关于近期版本的变更信息，请参阅 NEWS 文件。 文档...

pacumen

No hay necesidad de instalar. Pero ejecuta python setup.py build para instalar las dependencias automáticamente...

HintInject

HintInject HintInject is a shellcode embedder and loader that I developed while playing with the PE file and Import Directory Table structures. It takes a raw shellcode file and puts the shellcode in chunks into the Hint/Name Table entries which are reachable via the Import Lookup Table of a fake...

smugglex

Escáner de HTTP Request Smuggling impulsado por Rust. Descripción general Smugglex es una herramienta de pruebas de seguridad que detecta vulnerabilidades de HTTP Request Smuggling en aplicaciones web. Prueba ataques de smuggling CL.TE, TE.CL, TE.TE, H2C y H2, ofrece auditorías opcionales de...

jackdaw

jackdaw 收集 收集 收集 这是什么？ Jackdaw 旨在收集你域中的所有信息，将其存储到 SQL 数据库中，并以精美的图形展示域对象之间的交互关系，以及潜在攻击者可能如何利用这些交互。 它还附带一个便利的功能，可帮你处理密码破解项目：存储/查找/报告哈希/密码/用户。 快速使用信息 如果不使用自动收集（例如不在 Windows 上），你需要通过 dbinit 创建一个初始空数据库 首先你需要执行 enum。在 Windows 上可以双击可执行文件或输入 jackdaw.exe auto 自动完成。 其次你需要运行 nest 来启动 Web 界面。默认情况下，它提供在...

jackdaw

jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...

CVE-2025-67906

-c0392b?style=flat -orange?style=flat CVE-2025-67906 MISP = 2.5.27 - Stored Cross-Site Scripting via Workflow Engine doT.js Template Injection Discovered byFranck FERMAN Overview - Root Cause - Attack Chain - Structure - Usage - Remediation - References Vulnerability Overview CVE-2025-67906...

gping

gping 🚀 Ping，但有图表。 具有以下超能力： 绘制多个主机的ping时间图表 通过--cmd标志绘制命令的执行时间图表 自定义颜色 支持Windows、Mac和Linux 目录 安装 💿 用法 🎷 安装 💿 macOS Homebrew：brew install gping MacPorts：sudo port install gping Linux（Homebrew）：brew install gping CentOS（及其他使用旧版glibc的发行版）：从最新版本下载MUSL构建 Windows/ARM： Scoop：scoop install gping...

CVE-2024-41651

Blind SSRF to RCE Exploit - PrestaShop 8.1.7 Este documento describe una explotación de Blind SSRF a RCE en una instalación docker limpia de PrestaShop 8.1.7. Requisitos previos Asegúrate de tener al menos un módulo desactualizado instalado, por ejemplo: psfacetedsearch Descarga el paquete...

CVE-2021-27928-POC

CVE-2021-27928 POC Description A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval...

CVE-2020-0601

CVE-2020-0601 PoC para CVE-2020-0601: Windows CryptoAPI Crypt32.dll POC: https://github.com/ollypwn/CurveBall En kali: 1.Crear archivo PKCS12 root@kitploit: openssl req -new -x509 -key spoofedca.key -out spoofedca.crt openssl ecparam -name secp384r1 -genkey -noout -out Microsoft.key openssl req...

XboxSeries

Xbox Series: Internal Architecture Research Field| Value ---|--- Date| March 9-12, 2026 + July 7-?, 2026 Hardware| Xbox Series S Codename: Lockhart OS Build| 26100.7010.amd64fre.xbflt2602ge.260212-1010 + 26100.8561.amd64fre.xbflt2606ge.260609-2200 Access Method| Dev Mode + SSH + REST API + NTFS...

Freeloader

Docker support for plexmediaservercrack Patches Plex Media Server running in Docker — both the official plexinc/pms-docker image and the community lscr.io/linuxserver/plex image — using the same LDPRELOAD-on-the-PMS-exec mechanism as the native systemd install. See the top-level README and the fu...

swarmer

swarmer A tool for sneakily adding registry keys to HKCU without EDR/AV being able to see what's happening even if you don't have administrator access. How do I use this? NOTE: You will only get to do this ONCE, afterNTUSER.MAN is your new registry hive you CANNOT change it without being an admin...

nuguard

NuGuard Open Source NuGuard is an open source AI application security toolkit. Its goal is to provide the most extensive redteaming and behavioral validation of Agentic AI applications. With NuGuard, AI developers can focus on building their applications while NuGuard continuously tests and...