sparrow-wifi

Sparrow-WiFi Sparrow-WiFi is a 2.4 GHz and 5 GHz WiFi and Bluetooth spectral awareness tool for Linux. It integrates WiFi scanning, Bluetooth Low Energy and Classic discovery, software-defined radio spectrum analysis HackRF, Ubertooth, GPS tracking, FAA RemoteID drone detection, drone/rover-mount...

concealed_code_execution

Concealed Code Execution Hunt& Hackett presents a set of tools and technical write-ups describing attacking techniques that rely on concealing code execution on Windows. Here you will find explanations of how these techniques work, receive advice on detection, and get sample source code for testi...

CVE-2021-21983

CVE-2021-21975 VMware vRealize Operations vROps Manager APIの任意ファイル書き込みによるリモートコード実行（RCE） vRealize Operations（vROps）は、アプリからインフラストラクチャまで、AIを活用した自律型IT運用管理ツールであり、パブリッククラウドの監視を統合しながらVMware CloudおよびHCIデプロイメントの最適化、計画、拡張を支援します。VMware vRealize Operations Manager API 8.4 and all previous versions には、Server...

bashacks

bashacks ¿Qué es? bashacks es una colección de funciones de bash probablemente útiles para programadores, analistas de seguridad y usuarios generales que necesitan operaciones de bajo nivel. De hecho, no hay nada realmente nuevo en bashacks; todas las funciones están escritas usando software...

OffensiveNim

OffensiveNim Nim을 이용한 임플란트 개발 및 일반적인 공격적 작전에서의 무기화 실험을 진행하고 있습니다. 목차 OffensiveNim 목차 왜 Nim인가? 이 저장소에서 작동하는 예제 작업 중인 예제 이 저장소의 예제 컴파일하기 쉬운 방법 권장 어려운 방법 대담한 자를 위한 크로스 컴파일 C/C++와의 인터페이싱 내보낸 DllMain을 가진 Windows DLL 생성 XLL 생성 실행 파일 크기 최적화 Nim 실행 파일 반사적으로 로드 Winim 라이브러리 사용 시와 미사용 시의 실행 파일 크기 차이 Opsec...

pcileech

PCILeech Summary: PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system. PCILeech also works without hardware together with a wide range of software memory acqusition methods supported by the...

AtlasC2

AtlasC2 C C2 프레임워크, Stage 1 작업 중심 Atlas는 환경 내에서 발판을 확보하고, HTTP 기반 임플란트를 사용하여 C 현재는 엄격히 C 무기 체계를 밀반입하는 데 기반을 둡니다. 현재 상태에서는 OPSEC이 그다지 안전하지 않습니다... 전혀요. 현재 Windows 환경만 대상으로 합니다. 참고: 임플란트의 기본 연결 설정은 localhost의 8080 포트로 연결되도록 설정되어 있으며, 이는 여기에서 변경할 수 있습니다. 사용법 TeamServer 시작 클라이언트, 팀서버, 임플란트의 exe를 생성한 ...

redherd-framework

...

cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

CVE-2025-12737

CVE-2025-12737 affects WSO2 products via the Carbon Console . Administrative operations within the console do not adequately validate specific user-supplied input, allowing a threat actor with administrative privileges to inject and execute arbitrary code remotely , leading to complete compromise...

remote-method-guesser

Remote Method Guesser remote-method-guesser rmg is a Java RMI vulnerability scanner and can be used to identify and verify common security vulnerabilities on Java RMI endpoints...

moonwalk

moonwalk Cover your tracks during Linux Exploitation / Penetration Testing by leaving zero traces on system logs and filesystem timestamps. 📖 Table of Contents Introduction Features Installation Usage Contribution License ℹ️ Introduction moonwalk is a 400 KB single-binary executable that can clear...

autorootlinux

autorootlinux CVE-2026-31431に基づいてroot権限を取得するLinuxスクリプト このスクリプトは学習目的のみで使用してください。テスト環境で使用してください（カーネル操作にはリスクがあります） 使用方法: root@kitploit: chmod +x main.sh ./main.sh...

Django - Open Redirect

Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 contains an open redirect vulnerability. If django.middleware.common.CommonMiddleware and APPENDSLASH settings are selected, and if the project has a URL pattern that accepts any path ending in a slash, an attacker can redirect a user to a...

Cobub Razor 0.8.0 - Information Disclosure

Cobub Razor 0.8.0 is susceptible to information disclosure via generate.php, controllers/getConfigTest.php, controllers/getUpdateTest.php, controllers/postclientdataTest.php, controllers/posterrorTest.php, controllers/posteventTest.php, controllers/posttagTest.php, controllers/postusinglogTest.ph...

GitLab CE/EE - Information Disclosure

GitLab CE/EE is susceptible to information disclosure. An attacker can access runner registration tokens using quick actions commands, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. Affected versions are from 12.10 before 14.6.5,...

CVE-2024-4577

lol CVE-2024-4577 1. エクスプロイトコマンド RCE 値 root@kitploit: python3 cek.py --target http://target/index.php --ls --dir /path/to/directory python3 cek.py --target https://target/index.php --dir /path/to/directory python3 cek.py --target https://target/index.php --cat /path/to/directory 書き込み可能なディレクトリを検索...

IOBitUnlockerUnlocker

概要 0day 任意のファイルを移動またはコピーします。チェックサムのトリックにより、以前のパッチを回避します。 解説: https://nathan2.com/files/iobit.pdf 全体情報: https://nathan2.com/posts/iobit/ 私は、この脆弱性が以前に別のエクスプロイトとして発見されていたことを知らずに発見しました。ただし、これはIObitが施したパッチを回避するものです。バージョン1.3.0で動作します。 使用方法: root@kitploit:...

CVE-2025-41244-PoC

CVE-2025-41244 PoC VMware Aria Operations &1" VERSIONEND done get-versions.sh からの抜粋 119〜124行目: root@kitploit: getversion "/\S+/httpd-prefork|httpd|httpd2-prefork$|\s" -v getversion "/usr/bin|sbin/apache\S" -v getversion "/\S+/mysqld$|\s" -V getversion ".?/\Snginx$|\s" -v getversion...

access_updated

Singular Access btbd/access の更新版フォーク — Windows 10/11 互換性のため Zydis ベースの動的パターン検索を採用 ハンドルを必要とせずに特権プロセス操作を可能にするカーネルモード syscall ラッパーです。カーネルとユーザーモード間の通信に xKdEnumerateDebuggingDevices ポインターフックを使用します。 特徴 ✅ ハードコードされたオフセットなし — すべてのカーネル関数/オフセットは Zydis ディスアセンブラにより実行時に発見されます ✅ バージョン非依存 — Windows 10 1607+ および...