LID

root@kitploit: ██╗ ██╗██████╗ ██║ ██║██╔══██╗ ██║ ██║██║ ██║ ██║ ██║██║ ██║ ███████╗██║██████╔╝ ╚══════╝╚═╝╚═════╝ Linux Integrity Drift — "Linux is Dying" — Systematic discovery of kernel code paths that bypass LSM security guarantees The gate was never breached. It was walked around. What is LI...

uddup

UDdup - URLs Deduplication Tool The tool gets a list of URLs, and removes "duplicate" pages in the sense of URL patterns that are probably repetitive and points to the same web template. For example: root@kitploit: https://www.example.com/product/123 https://www.example.com/product/456...

leaky-paths

About A collection of special paths linked to major web frameworks and infrastructure projects, known juicy APIs, misconfigurations.. etc. These could be used for web-content discovery as the fastest way to find quick wins. Goal With the goal of providing the community with high-quality wordlists...

SharpPrivesc

SharpPrivesc Practicing C and bringing Privesc attack surfaces together. Still noob stuff. Privesc checks and the like. I preferred Spectreops command line parsing classes so decided to utilize theirs over other .net packages like command line parser etc. To-Do: Menu More Privesc Check modules...

mole

Mole Mole is a Binary Ninja plugin designed to identify interesting execution paths in binaries. It performs backward slicing on variables using Binary Ninja 's Medium Level Intermediate Language MLIL in Static Single Assignment SSA form, forming the basis for a static taint analysis. In Mole , a...

deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

Coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through many methods. Windows Support To build a binary for Windows, download the installer.ps1 script from this repository. Run it simply with no arguments to create a binary in the working directory...

Dop2Mop

Dop2Mop A proof-of-concept OpenGraph collector for BloodHound that maps attack paths from DevOps to MLOps infrastructure. Based on Pipelines of Privilege: Attack Paths from DevOps to MLOps Infrastructure by Brett Hawkins @h4wkst3r. Table of Contents Acknowledgments Overview Supported Platforms...

GoodHound

GoodHound root@kitploit: / / / / / / / / / / / / / / / // / / / / / / / / // / // / // / // / / // / // / / / / // / ///,// ///,// //,/ Attackers think in graphs, defenders think in actions, management think in charts. GoodHound operationalises Bloodhound by determining the busiest paths...

Apache-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Contributors 이희수@lheeeesoo Apache HTTP Server 2.4.49 has a vulnerability where it fails to properly block encoded parent paths during URL path normalization. An attacker can use values like .%2e to traverse outside the directories that the web serv...

forbiddenpass

UPDATE Thanks to Knowledge-Wisdom-Understanding MrPMillz for making the script cleaner and fixing the header payloads. INSTALLATION root@kitploit: git clone https://github.com/gotr00t0day/forbiddenpass.git cd forbiddenpass pip3 install -r requirements.txt python3 forbiddenpass.py -h USAGE...

debugHunter

debugHunter Discover Hidden Debug Endpoints & Development Environments The essential Chrome extension for bug bounty hunters and penetration testers Passively detect debug parameters, sensitive headers, and exposed paths while you browse. Why debugHunter? Finding debug endpoints and exposed...

clair

Clair Note : The main branch may be in an unstable or even broken state during development. Please use releases instead of the main branch in order to get stable binaries. Clair is an open source project for the static analysis of vulnerabilities in application containers currently including OCI...

uptux

uptux Specialized privilege escalation checks for Linux systems. Implemented so far: Writable systemd paths, services, timers, and socket units Disassembles systemd unit files looking for: References to executables that are writable References to broken symlinks pointing to writeable directories...

k8scout

k8scout Beta — A single-binary Kubernetes attack path engine for authorized security assessments. Drop it into a compromised pod, run it, and get a map of every realistic escalation path — from your current foothold to cluster-admin, node access, secret theft, and cloud IAM roles. The idea You ha...

CVE-2021-44228

Tai-e for CVE-2021-44228 This a sample project that utilizes Tai-e to identify Log4Shell a.k.a. CVE-2021-44228 vulnerability and its trigger paths Related video in Chinese: https://www.bilibili.com/video/BV1dV411F781 Getting started Clone this repository via Git: root@kitploit: git clone...

CVE-2024-1086-checker

CVE-2024-1086-checker This is a simple checker script to detect the kernel configuration which is vulnerable to exploitation. A result of "kernel config not vulnerable" from this script only means that the vulnerability is not exploitable with currently known paths. How to Use root@kitploit: curl...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

Invoke-DumpMDEConfig

DumpMDEConfig PowerShell Script Overview Invoke-DumpMDEConfig is a PowerShell script designed to extract and display Microsoft Defender configuration and logs, including excluded paths, enabled ASR rules, allowed threats, protection history, and Exploit Guard protection history. The script provid...

go_parser

Yet Another Golang binary parser for IDAPro English |中文 NOTE : Now the latest master branch is the Python3 version. The old master branch has been changed to branch py2 , and temporarily not maintained. Instructions for Python3 branch This version is developed and tested on macOS/Windows, IDA7.4+...