WHP

M$ Windows Hacking Pack Tools here are from different sources. The repo is generally licensed with WTFPL, but some content may be not eg. sysinternals. "pes" means "PE Scambled". It's useful sometimes. Remote Exploits Windows 2000 / XP SP1 MS05-039 Microsoft Plug and Play Service Overflow, Works...

CVE-2016-2098

CVE-2016-2098 Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method. https://vulners.com/cve/CVE-2016-2098 Usage root@kitploit: git clo...

IntRec-Pack

IntRec-Pack Intelligence and Reconnaissance Package/Bundle installer. IntRec-Pack is a Bash script designed to download, install and deploy several quality OSINT, Recon and Threat Intelligence tools. Due to the fact it manages the installation of the various dependencies related to these programs...

CVE-2021-44228-Log4j

Pon a prueba este contenido antes de aplicarlo a sistemas de producción. Uso Descarga el último paquete desde las versiones aquí: https://github.com/VerveIndustrialProtection/CVE-2021-44228-Log4j/releases y luego importa los Fixlets, los análisis y el grupo de equipos en un sitio y aplica las...

Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection

Cryptocurrency Widgets Pack Plugin =1.8.1 for WordPress contains an unauthenticated SQL injection caused by unsanitized user input in database queries, letting attackers execute arbitrary SQL commands, exploit requires no authentication. id: CVE-2022-44588 info: name: Cryptocurrency Widgets Pack ...

News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Local File Inclusion

The News & Blog Designer Pack WordPress plugin up to version 3.4.1 contains a remote code execution caused by local file inclusion in the bdpgetmorepost function, letting unauthenticated attackers include arbitrary PHP files, exploit requires AJAX request with crafted POST data. id: CVE-2023-5815...

pantagrule

Pantagrule gargantuan hashcat rulesets generated from compromised passwords Project maintenance warning : This project is deemed completed. No pull requests or changes will be made to this project in the future unless they are actual bugs or migrations to allow these rules to work with newer...

pack

Password Analysis and Cracking Kit de Peter Kacherginsky iphelix PACK Password Analysis and Cracking Toolkit es una colección de utilidades desarrolladas para ayudar en el análisis de listas de contraseñas con el fin de mejorar el descifrado de contraseñas mediante la detección de patrones de...

CVE-2016-2098

CVE-2016-2098 Action Pack en Ruby on Rails anterior a 3.2.22.2, 4.x anterior a 4.1.14.2, y 4.2.x anterior a 4.2.5.2 permite a atacantes remotos ejecutar código Ruby arbitrario aprovechando el uso sin restricciones del método render por parte de una aplicación RCE...

CVE-2016-2098

CVE-2016-2098 Action Pack en Ruby on Rails anterior a 3.2.22.2, 4.x anterior a 4.1.14.2 y 4.2.x anterior a 4.2.5.2 permite a atacantes remotos ejecutar código Ruby arbitrario aprovechando el uso sin restricciones del método render por parte de una aplicación. Clase Error de validación de entrada...

BOF-pack-1

BOF-pack-1 A care package of useful bofs for red team engagments GetAppLockerPolicy Prints the Effective AppLockerPolicy for the domain TokenElevate Creates a process with winlogon's tokenIncludes Tcb Privilege enabled by default and other winlogon specific privileges. Alternative way to elevate ...

CVE-2016-2098

CVE-2016-2098 Action Pack en Ruby on Rails anterior a 3.2.22.2, 4.x anterior a 4.1.14.2 y 4.2.x anterior a 4.2.5.2 permite a atacantes remotos ejecutar código Ruby arbitrario aprovechando el uso sin restricciones del método render por parte de una aplicación. Recursos...

0day-security-software-vulnerability-analysis-technology

0day-security-software-vulnerability-analysis-technology Notas de uso del paquete de materiales complementarios de «Seguridad 0day: Tecnología de análisis de vulnerabilidades de software segunda edición» Los materiales incluidos en el paquete se proporcionan únicamente con fines de aprendizaje...

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

SummaryThe checkunsafeoptions guard can be bypassed on every guarded method clone/clonefrom, fetch/pull/push, lsremote, itercommits, blame, archive by combining a single-character kwarg with splitsinglecharoptions=False. The guard's candidate list omits the smuggled option, but transformkwarg emi...

auth-header-trust-rules

auth-header-trust-rules Un pequeño conjunto de reglas de Semgrep que señala código que toma decisiones de autenticación, autorización o confianza basadas en cabeceras de solicitudes HTTP que un atacante controla. El ejemplo canónico de esta clase de vulnerabilidad es CVE-2025-29927: Next.js...

Ruby on Rails - Open Redirect via Host Header Injection

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers. id: CVE-2021-22881 info: name: Ru...

redsun-bluehammer-undefend-detection-pack

RedSun, BlueHammer, UnDefend, and CrossFamily Detection Pack IMPORTANT: All code and detection logic in this repository is AI-generated. There is no guarantee that these scripts are correct, complete, safe, or suitable for any environment. Use these scripts entirely at your own risk. The reposito...

CVE-2026-86198

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...

CVE-2025-71417

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUSSENDPACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server...

EUVD-2026-74909

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUSCOMPLETED status during resource pack handling. Malicious clients can send batches of these packets to repeatedly trigger pre-spawn progression, creating duplicate Player...