mistral.rs: Unbounded Remote Media Fetch and Video Frame Expansion DoS

Unbounded Remote Media Fetch and Video Frame Expansion DoS Summary The POST /v1/chat/completions endpoint in mistral.rs fetches attacker-supplied media URLs image, audio, video into server memory with no byte limit, and extracts every frame of a supplied video when numframes is None. An...

sherloq

An open source digital image forensic toolset Introduction "Forensic Image Analysis is the application of image science and domain expertise to interpret the content of an image and/or the image itself in legal matters. Major subdisciplines of Forensic Image Analysis with law enforcement...

django-defender

django-defender .. image:: https://jazzband.co/static/img/badge.svg :target: https://jazzband.co/ :alt: Jazzband .. image:: https://img.shields.io/pypi/pyversions/django-defender.svg :alt: Supported Python versions :target: https://pypi.org/project/django-defender/ .. image::...

RedGridLink

Red Grid Link Offline MGRS navigation and proximity team coordination for small teams 2-8 people. No cell service needed. Built on the MGRS engine from Red Grid MGRS. Field Link adds zero-config proximity sync over Bluetooth, with Apple Multipeer Connectivity iOS and Google Play Services Nearby...

Mistica

Mística --- Mística Logo by JoelGMSec Mística is a tool that allows to embed data into application layer protocol fields, with the goal of establishing a bi-directional channel for arbitrary communications. Currently, encapsulation into HTTP, HTTPS, DNS and ICMP protocols has been implemented, bu...

APKDeepLens

APKDeepLens Android security insights in full spectrum. Features • Detection • Installation • Usage • Reports Featured atBlack Hat MEA 2023 and Black Hat ASIA 2024 What is APKDeepLens? APKDeepLens is a Python-based static analysis tool for Android APK files. It decompiles APKs using JADX and runs...

ActiveDirectoryEnumeration

ADE - ActiveDirectoryEnum root@kitploit: python -m ade usage: ade -h --dc DC -o OUTFILE -u USER -s -smb -kp -bh -spn -sysvol --all --no-creds --dry-run --exploit EXPLOIT / | / / / \ / / / / / /| |/ / / / | / / / / / / / / / / / / / / / / / / / / / / \ / / // // /| |/ / / // / /...

hal

Welcome to HAL! HAL /hel/ is a comprehensive netlist reverse engineering and manipulation framework. Navigation 1. Introduction 2. Build Instructions 3. Quickstart Guide 4. Academic Context Introduction What the hell is HAL? Virtually all available research on netlist analysis operates on a...

trueseeing

README trueseeing is a fast, accurate and resillient vulnerability scanner for iOS/Android apps. We operate on the Dalvik VM level for Android -- i.e. we don't care if the target app is obfuscated or not. Capability Currently we can: Automatically scan app for vulnerabilities, reporting in...

Exploit for Stack-based Buffer Overflow in Microsoft

🛡️ AI Security Tool Module CVE-2026-4...

smack

SMACK is both a modular software verification toolchain and a self-contained software verifier. It can be used to verify the assertions in its input programs. In its default mode, assertions are verified up to a given bound on loop iterations and recursion depth; it contains experimental support...

metabigor

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

yaralyzer

THE YARALYZER Visually inspect all of the regex matches and their sexier, more cloak and dagger cousins, the YARA matches found in binary data and/or text. See what happens when you force various character encodings upon those matched bytes. With colors. Quick Start root@kitploit: pipx install...

MyJWT

MyJWT codebeat badge Introduction This cli is for pentesters, CTF players, or dev. You can modify your jwt, sign, inject ,etc... Check Documentation for more information. If you see problems or enhancement send an issue.I will respond as soon as possible. Enjoy : Documentation Documentation is...

pentest-tools

pentest-tools A collection of custom security tools for quick needs. Important note ‼ A big clean occured in 2022-11 ‼ Some useless/not working scripts have been archived and some others have been moved to their own repository to get more visibility, feel free to check them: apk-analyzer...

pywhisker

pyWhisker pyWhisker is a Python equivalent of the original Whisker made by Elad Shamir and written in C. This tool allows users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object. It's based on Impacket and on a Python equivalent o...

mcp-doorman

mcp-doorman The security gateway for MCP servers — every tool call gets checked at the door. CI npm License: Apache-2.0 PRs welcome mcp-doorman is a drop-in proxy that sits between your AI agent Claude Desktop, Claude Code, Cursor, VS Code, any MCP client and the MCP servers it uses. One command,...

roca

ROCA detection tool This tool is related to ACM CCS 2017 conference paper 124 Return of the Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli. It enables you to test public RSA keys for a presence of the described vulnerability. Update 4.11.2017 : Python 2.7, 3.4+ supported...

mitos

Mitos Isolated, forkable computers for your AI agents. Millisecond microVM sandbox forking on Kubernetes: fork a running VM into parallel attempts and restore from memory in tens of milliseconds. Quickstart . Documentation . Features . Comparison . Contributing . Community What is Mitos Mitos giv...

DATA

DATA: Credential Phish Analysis and Automation Slides from presentation at CircleCityCon 2017 Tested on Headless Ubuntu Server 16.04 BUCKLEGRIPPER py Given a suspected phishing url or file of line separated urls, visit, screenshot, and scrape for interesting files. Requirements can be installed b...