ipv6tools

IPv6Tools The IPv6Tools framework is a robust set of modules and plugins that allow a user to audit an IPv6 enabled network. The built-in modules support enumeration of IPv6 features such as ICMPv6 and Multicast Listener Discovery MLD. In addition, the framework also supports enumeration of Upper...

DamnVulnerableCryptoApp

Why? If you try to learn a little bit more about crypto, either because you want to know how the attacks work or just because you want to do safe code, you end up diving really fast into the math behind the algorithms, and for a lot of people this is a NO...

CVE-2024-33676

CVE-2024-33676 Enel X JuiceBox Level 2 电动汽车充电器上的弱身份验证和授权机制，使攻击者能够访问操作系统功能和参数。 描述 本地电动汽车充电器 WLAN 网络上的用户可以提取个人身份信息 PII、更改设置并操纵操作系统文件系统。 这可以通过访问端口 2000 上的本地 Gecko OS 接口功能来实现。 该信息已于 2025 年 7 月 26 日在 BSides Albuquerque 大会上公布。幻灯片位于 此处。 产品详情 受影响厂商：Enel X Way 受影响产品：JuiceBox Level 2 充电器 影响范围：Enel X...

GHSA-2J95-GQXF-V3VG Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...

Central Dogma: Hard-coded ZooKeeper replication secret 'ch4n63m3' with silent fallback enables cluster takeover

Vulnerability ZooKeeperReplicationConfig.secret silently substitutes the hard-coded constant "ch4n63m3" leetspeak for "change me" whenever the operator omits replication.secret. The same secret is wired into both the client-facing SASL context and the quorum/learner SASL contexts of the embedded...

TREVORspray

TREVORspray 2.0 TREVORspray 是一个模块化密码喷洒工具，支持线程、SSH 代理、战利品模块等功能！ 作者：@thetechr0mancer 安装： root@kitploit: pip install git+https://github.com/blacklanternsecurity/trevorproxy pip install git+https://github.com/blacklanternsecurity/trevorspray 详细内容请参见配套的 博客文章，里面有有趣的吐槽和一些酷炫的演示！ 功能特性 多线程，大量线程 多种模块...

hashcracker

hashcracker Supported hashing algorithms: SHA512, SHA256, SHA384, SHA1, MD5, SHA224 Features: auto detection of hashing algorithm based on length not recommended, bruteforce, password list Arguments: type: hash algorithm must be one of the supported hashing algorithms mentioned above or AUTO if y...

NextRce

NextRce - Next.js RSC 漏洞利用工具 CVE-2025-55182 针对 Next.js App Router 的高级漏洞扫描与利用工具 由Mitsec 开发 🔥 新特性：WAF 绕过模式 UTF-16LE 包含 childprocess 或 execSync 等关键词的标准攻击载荷常常会被 Web 应用防火墙（WAF）拦截。 NextRCSWaff.py 利用专门的 UTF-16LE（小端序） 编码引擎。通过以这种特定格式编码恶意载荷，字节序列完全改变，使其对大多数基于签名的 WAF 不可见。然而，Next.js（Node.js）服务器能够正确解码并执行该命令。...

cipherscan

CipherScan CipherScan 测试给定目标上所有主要 SSL 和 TLS 版本的密码套件排序。它还提取一些证书信息、TLS 选项、OCSP 装订等。CipherScan 是 openssl sclient 命令行的封装。 CipherScan 旨在运行于所有类 Unix 系统。它自带针对 Linux/64 和 Darwin/64 的 OpenSSL 构建。在其他平台上，它将使用操作系统提供的 openssl 版本（可能支持的密码有限），或通过 -o 命令行标志提供您自己的版本。 示例 基本测试： root@kitploit: $ ./cipherscan google.co...

cipherscan

CipherScan Cipherscan tests the ordering of the SSL/TLS ciphers on a given target, for all major versions of SSL and TLS. It also extracts some certificates informations, TLS options, OCSP stapling and more. Cipherscan is a wrapper above the openssl sclient command line. Cipherscan is meant to ru...

discover

root@kitploit: Custom bash scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Kali Linux or Ubuntu. Lee Baird @discoverscripts Jay "L1ghtn1ng" Townsend @jaytownsend1 Jason Ashton @ninewir...

threadtear

Threadtear Threadtear is a multifunctional deobfuscation tool for java. Android application support is coming soon Currently working on a dalvik to java converter. Suitable for easier code analysis without worrying too much about obfuscation. Even the most expensive obfuscators like ZKM or String...

CVE-2025-7384

CVE-2025-7384 — PHP Object Injection to RCE Plugin: Database for Contact Form 7 contact-form-entries ≤ 1.4.3 CVSS: 9.8 Critical CWE: CWE-502 — Deserialization of Untrusted Data Authentication Requirement: None Unauthenticated Impact: Remote Code Execution Table of Contents 1. Vulnerability Overvi...

CosmicRakp

CosmicRakp 目录 简介 CVE-2013-4786 安装 使用 致谢 许可证 简介 CosmicRakp 是一款使用 Go 语言编写的强大工具，允许红队成员和渗透测试人员导出 IPMI 哈希值。该项目旨在高效、快速且易于使用。 CVE-2013-4786 该工具利用了 CVE-2013-4786 中详述的漏洞，允许未经授权的用户通过 RAKP（远程认证密钥协议）机制从 IPMI 设备中检索加盐密码哈希值。实现方式是通过启动一个 IPMI 2.0 RAKP 认证过程，使用允许 'None' 认证的密码套件，从而能够检索加盐密码哈希值。 安装 root@kitploit:...

pbscan

SUMMARY polarbearscan is an attempt to do faster and more efficient banner grabbing and port scanning. It combines two different ideas which hopefully will make it somewhat worthy of your attention and time. The first of these ideas is to use stateless SYN scanning using cryptographically protect...

publiccms_decrypt

publiccmsdecrypt https://github.com/sanluan/PublicCMS publiccms-core-V4.0.202004.a.jar!/com/publiccms/common/constants/CommonConstants.class publiccms-common-V4.0.202004.a.jar!/com/publiccms/common/tools/VerificationUtils.class com.publiccms.common.tools.VerificationUtils...

CVE-2026-48907

CVE-2026-48907 — Unauthenticated RCE in Joomla Content Editor JCE ≤ 2.9.99.4 Proof-of-concept exploit for CVE-2026-48907 — a CVSS 10.0 pre-authentication remote code execution vulnerability in the Joomla Content Editor JCE extension. Research by Grayxploit Security Team Table of Contents...

DEBIAN-CVE-2026-89758

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe "mm/hugememory: add device-private THP support to PMD operations" a PMD may...

CVE-2026-89758

In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: skip non-present PMDs when queueing folios Patch series "mm: handle device-private PMDs in walk callbacks", v3. Since commit 368076f52ebe "mm/hugememory: add device-private THP support to PMD operations" a PMD may...

CVE-2026-89669

In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4copynotify finished initializing the cpntf state after nfs4allocinitcpntfstate had already linked it into the s2scpstateids IDR and the parent's sccplist, with cscoun...