pentesting-multitool

Pentesting-Multitool Introduction Pentesting-Multitool project arises from the need to gather some pentesting tools into one tool. It will be developed using Python3 adding some external libraries as DNSPython, pythonwhois or scapy. The main functions of the script is to collect information about...

CVE-2024-4577

Orange Tsi 🍊 This vulnerability was found by Orange Tsai @orange8361 of DEVCORE @d3vc0r3. Make sure to follow his outstanding research, our role was to only recreate and develop the exploit for this issue. Security Alert: CVE-2024-4577 PHP CGI Argument Injection Vulnerability Overview CVE-2024-45...

malware-jail

malware-jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript Windows Scripting Host context env/wscript.js, at least the part frequently used by malware...

CVE-2024-45265

CVE-2024-45265 Suggested description A SQL injection vulnerability in the poll component in SkySystem Arfa-CMS before 5.1.3132 allows remote attackers to execute arbitrary SQL commands via the psid parameter. Vulnerability Type CWE-89 | SQL Injection Vendor of Product SkySystem https://skyss.ru/...

CVE-2015-0057

CVE-2015-0057 Exploitation on 32-bit and 64-bit Systems Author: Aaron Adams Translation: 55-AA Translator's Note: Some parts of this article are freely translated. Please refer to the original text for any questions. Terminology: Primitive: Similar to a functional function, it is a collection of...

CVE-2020-16898-EXP-POC

CVE-2020-16898 CVE-2020-16898 Windows TCP/IP Remote Code Execution Vulnerability EXP&POC Reproduction forforever: https://www.cnblogs.com/forforever/p/13846077.html PoC CVE-2020-16898Checker-poc Command: Run PowerShell/CMD as Administrator root@kitploit: Powershell.exe -ExecutionPolicy UnRestrict...

TokenTacticsV2

root@kitploit: / / / / / / / / | \ / / / / /// / \ / / / / / / / / | | / / / / / / / // / , / / / / / / // // / // // / / | |/ / / / // //||// // /,////// |/ TokenTactics v2 This is an updated version of TokenTactics originally written by Stephan Borosh @rvrsh3ll & Bobby Cooke @0xBoku...

redamon

Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merge...

Harmonic

Harmonic Suite Beginning of a linux toolset for managing and interfacing with reverse shells code is still currently in a quick and dirty state, with little exception handling. With a strong inspiration in UNIX philosophy, the basic idea is to have a daemon for handling arbitrary end points connd...

CVE-2025-29017

CVE-2025-29017 - Internet Banking System 2.0.0 Remote Code Execution via Profile Picture Upload Description A Remote Code Execution RCE vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profilepic parameter within pagesviewclient.php...

wcfproxy

Build You can either compile the tool once and then use the resulting binary or you can run it "like a script" the Go toolchain will compile it on the fly. For development, the latter option is convenient. For productive use, it is recommended to compile it once from the cli directory and use the...

dnsx

A fast and multi-purpose DNS toolkit designed for running DNS queries Features • Installation • Usage • Running dnsx • Wildcard • Notes • Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...

CVE-2024-46635

CVE-2024-46635 Background The GongZhiDao System is a platform developed by GongZhiDao. It provides enterprise solutions including user management, data analysis, and operational functionalities. However, a security vulnerability was discovered in one of the API endpoints that could potentially le...

Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

Microfinance Management System V1.0 SQL Injection Vulnerability Unauthenticated 1. Description: Microfinance Management System allows SQL Injection via parameter 'customernumber' in /mims/updatecustomer.php. Exploiting this issue could allow an attacker to compromise the application, access or...

CVE-2025-53652-Jenkins-Git-Parameter-Analysis

CVE-2025-53652: Jenkins Git Parameter Plugin Unvalidated Input Vulnerability. Summary This vulnerability arises because user-controlled input from Jenkins build parameters is injected unsafely into the Git checkout command. User input is provided as a build parameter e.g., gitParameters, which ca...

Just-Metadata

Just-Metadata Just-Metadata is a tool that can be used to gather intelligence information passively about a large number of IP addresses, and attempt to extrapolate relationships that might not otherwise be seen. Just-Metadata has "gather" modules which are used to gather metadata about IPs loade...

CVE-2018-25031

CVE-2018-25031 CVE-2018-25031 exploits tests Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. HowTo Find the documentation endpoint a...

strot

Reverse-engineer any website's internal API with natural language The Problem Modern websites load data through hidden AJAX calls: Data isn't in the HTML - it's fetched via internal APIs You have to manually inspect network requests Complex pagination logic buried in JavaScript APIs change...

CVE-2019-20059

CVE-2019-20059 Yetishare SQL Injection in sSortDir0 parameter - v3.5.2 - v4.5.4. Apart from an admin being able to exploit this, it could also be used in a CSRF attack to trick an admin user into running malicious queries. Files affected paymentmanage.ajax.php paymentsubscriptionmanage.ajax.php...

ARTIF

ARTIF ARTIF is a new advanced real time threat intelligence framework built that adds another abstraction layer on the top of MISP to identify threats and malicious web traffic on the basis of IP reputation and historical data. It also performs automatic enrichment and threat scoring by collectin...