vss-fr2system

vss-fr2system Two small tools that turn an arbitrary file read bug on Windows into a SYSTEM shell. vssfreeze/ — creates a Volume Shadow Copy as a standard user , then holds it open so you have time to read the SAM/SECURITY/SYSTEM hives out of it fr2system/ — takes the hives you copied out, decryp...

anteon

eBPF-powered Kubernetes Monitoring and Performance Testing Anteon automatically generates Service Map of your K8s cluster without code instrumentation or sidecars. So you can easily find the bottlenecks in your system. Red lines indicate the high latency between services. Live Demo • Documentatio...

CVE-2025-58434-AND-59528-POC

Flowise Dual CVE PoC — CVE-2025-58434 + CVE-2025-59528 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents Overview Vulnerability Details CVE-2025-58434 — Account Takeover...

langflow-CVE-2026-33017-poc

CVE-2026-33017 — Langflow Unauthenticated RCE PoC For educational and authorized testing purposes only. Summary Langflow = 1.8.1 exposes a public flow build endpoint that accepts attacker-controlled flow data containing arbitrary code. This code is passed to prepareglobalscope in validate.py, whi...

PISmith

PIForge An Open Framework for RL-based Prompt Injection Red Teaming 💻 Code · 🤗 Models · 📜 Papers PIForge is the shared codebase for PISmith and Climbing the Hill. PISmith addresses the sparse reward problem in prompt injection red teaming, helping RL attackers explore and learn from rare successf...

MyJWT

MyJWT codebeat badge Introduction This cli is for pentesters, CTF players, or dev. You can modify your jwt, sign, inject ,etc... Check Documentation for more information. If you see problems or enhancement send an issue.I will respond as soon as possible. Enjoy : Documentation Documentation is...

shellcodetester

Shellcode Tester ShellcodeTester officially supports Python 3.8+. Main features Assembly ASM file 32 and 64 bits Assembly ASM file to Windows, Linux and MacOS Check badchars Output to several formats NASM Shell Other amazing features... Shellcode Tester - Getting stats shellcodetester -asm file.a...

ntlm_theft

ntlmtheft A tool for generating multiple types of NTLMv2 hash theft files. ntlmtheft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already insi...

proxmox-lxc-docker-fix

Proxmox LXC AppArmor Fix for Docker/Containers Workaround for CVE-2025-52881 : Fixes Docker, Podman, and container runtime breakage in Proxmox LXC containers caused by AppArmor incompatibility with runc 1.2.7+/1.3.2+ 🚨 The Problem Recent security updates to runc versions 1.2.7+ and 1.3.2+ and...

awesome-rat

All Resource Collection Projects RAT 2500+ open source RAT/C&C tools, 1200+ blogs and video about RAT/C&C analysis. 中文版本 Directory Popular Tools pupy - 1Tools 6Post Covenant - 3Tools 18Post Slackor - 1Tools 3Post QuasarRAT - 1Tools 9Post EvilOSX - 1Tools 9Post Merlin - 1Tools 3Post Commercial Too...

batea

Batea A batea is a large shallow pan of wood or iron traditionally used by gold prospectors for washing sand and gravel to recover gold nuggets. Batea is a context-driven network device ranking framework based on the anomaly detection family of machine learning algorithms. The goal of Batea is to...

Krawl

Krawl A modern, customizable web honeypot server designed to detect and track malicious activity from attackers and web crawlers through deceptive web pages, fake credentials, and canary tokens. Table of Contents Demo What is Krawl? Krawl Dashboard Deployment Modes Krawl Banlist Quickstart Docker...

CVE-2025-34085

CVE-2025-34085 — WordPress Simple File List Unauthenticated RCE An automated exploit for CVE-2025-34085 duplicate of CVE-2020-36847, a critical unauthenticated remote code execution vulnerability in the WordPress Simple File List plugin versions ≤ 4.2.2. Note: CVE-2025-34085 was rejected by MITRE...

Arkhota

Arkhota, a web brute forcer for Android What? Arkhota is a web HTTP/S brute forcer for Android OS. Why? A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather...

pantagrule

Pantagrule gargantuan hashcat rulesets generated from compromised passwords Project maintenance warning : This project is deemed completed. No pull requests or changes will be made to this project in the future unless they are actual bugs or migrations to allow these rules to work with newer...

bromure

Bromure Secure, ephemeral computing in disposable Linux VMs on macOS. → Full details, screenshots, and downloads at bromure.io This repo ships two sibling apps, both built on Apple's Virtualization.framework: Bromure — every browser session runs in a throwaway Linux VM. Close the window, the VM i...

deptrust

deptrust / / / / / / / / / / / / / / / / / / / // / / // / / // / ,// ./// ,/// // deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub Actions, and...

uefi-firmware-parser

UEFI Firmware Parser .. image:: https://travis-ci.org/theopolis/uefi-firmware-parser.svg?branch=master :target: https://travis-ci.org/theopolis/uefi-firmware-parser The UEFI firmware parser is a simple module and set of scripts for parsing, extracting, and recreating UEFI firmware volumes. This...

ars0n-framework

The Ars0n Framework VERSION 2 ALPHA IS COMING SOON!!CHECK THE REPO FOR UPDATES! Designed to Help Aspiring Researchers Start Their Bug Bounty Journey and "Earn While You Learn" -- by rs0n About • Install • Modules • Troubleshooting • FAQs • Ars0n Security • YouTube • Twitch About Howdy! My name is...

omigod-lab

Readme An educational lab VM to learn about the 9.6 CVSS unauthenticated Remote Code Execution RCE vulnerability in Open Management Infrastructure software CVE-2021-38647. Disclosure original research: https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure OMI source code:...