MsfMania

MsfMania MsfMania is an advanced Python-based payload obfuscation framework designed to evade EDR/AV detection on Windows systems. It generates highly polymorphic executables through dynamic code generation, multi-layer encryption RC4, and binary metadata spoofing. ⚠️ Educational Purpose Only -...

Ninja

Quick Update to include Follina Exploitation 01/06/2022 - NinjaC2 will generate the document and serve the HTML payload . More information : https://www.linkedin.com/posts/ahmed-khlief-499321a7i-just-pushed-a-quick-update-to-ninjac2-to-activity-6937661951007170560-Tmps Ninja V2.2 Released...

XORpass

XORpass is an encoder to bypass WAF filters using XOR operations. Installation & Usage root@kitploit: git clone https://github.com/devploit/XORpass cd XORpass $ python3 xorpass.py -h Example of bypass: Using clear PHP function: Using XOR bypass of that function: root@kitploit: $ python3 xorpass.p...

Nextjs_Exploit_Tool

Next.js RSC RCE Exploit Tool CVE-2025-55182 Project Introduction CVE-2025-55182 is a high-severity vulnerability in Next.js's Server Component RSC processing chain. An attacker can craft special multipart/form-data requests and forged RSC response chunks to induce the server to execute arbitrary...

elfpack

ElfPack: ELF Binary Section Docking for Stageless Payload Delivery Highlights Overview of payload bundling mechanisms: compilation,linking and loading. Binary compatibility and creation of loosely coupled payloads to their delivery mechanism. Avoiding automatic memory loading of sections. Use of...

some-tweak-to-hide-jwt-payload-values

algunos-ajustes-para-ocultar-valores-de-payload-jwt Un puñado de ajustes e ideas para proteger el payload JWT, haciendo inútil intentar decodificarlo al alterar constantemente su valor, asegurando que la salida decodificada sea ininteligible mientras se impone una sobrecarga de rendimiento mínima...

bantam

Bantam Una herramienta avanzada de gestión de backdoors PHP, con una huella de servidor ligera, comunicación multi-hilo y una herramienta avanzada de generación y ofuscación de payloads. Cuenta con cifrado de extremo a extremo con claves de cifrado únicas por solicitud y transmisión de payloads...

pyobfuscate

pyobfuscate A simple and efficent script to obfuscate python payloads to make it completely FUD Note: root@kitploit: 1. Don't Upload Any Payloads To VirusTotal.com Bcz This tool will not work with Time. 2. Virustotal Share Signatures With AV Comapnies. 3. Again Don't be an Idiot! How To Install:...

hoaxshell

hoaxshell ⚡ La última versión de este proyecto es el listener independiente de HoaxShell, que incluye plantillas de payload actualizadas. También puedes usarlo directamente desde https://revshells.com asegúrate de seleccionar hoaxshell como listener. ⚠️ A partir del 18-10-2022, hoaxshell es...

blenny

Blenny is a proof-of-concept payload obfuscation tool for Windows which hides executable payload data within the icon of the executable. It is named after the sabre-toothed blenny fish, which mimmicks the behavior and looks of cleaner fish to prey on unsuspecting fish. Why? I can't recall exactly...

macro_pack

macropack Descripción breve Advertencia: MacroPack no se mantiene desde 2021, si eres un profesional y necesitas herramientas ofensivas de infosec para acceso inicial, asunción de brecha, evasión de EDR, revisa https://www.balliskit.com MacroPack Community es una herramienta utilizada para...

A Longitudinal Measurement Study of Log4Shell Exploitation from an Active Network Telescope

The disclosure of the Log4Shell vulnerability in December 2021 led to an unprecedented wave of global scanning and exploitation activity. A recent study provided important initial insights, but was largely limited in duration and geography, focusing primarily on European and U.S. network telescop...

Amadey Exploiting Self-Hosted GitLab to Distribute StealC

Amadey Exploiting Self-Hosted GitLab to Distribute StealC By Rahul Sharma · December 18, 2025 Executive summary Amadey is a malware loader that has been active since 2018, primarily used to distribute second-stage payloads and infostealers. While Amadey has been previously known to distribute...

EUVD-2025-36724

uv allows ZIP payload obfuscation through parsing differentials...

uv allows ZIP payload obfuscation through parsing differentials

Impact In versions 0.9.5 and earlier of uv, ZIP archives were handled in a manner that enabled two parsing differentials against other components of the Python packaging ecosystem: 1. Central directory entries in a ZIP archive can contain comment fields. However, uv would assume that these fields...

CVE-2025-54368 uv is vulnerable to ZIP payload obfuscation through parsing differentials

uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with...

uv allows ZIP payload obfuscation through parsing differentials

Impact In versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers: 1. An attacker could contrive a ZIP...

GHSA-8QF3-X8V5-2PJ8 uv allows ZIP payload obfuscation through parsing differentials

Impact In versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers: 1. An attacker could contrive a ZIP...

Exploit for Code Injection in Langflow

Langflow RCE Exploit CVE-2025-3248 !Python Versionhttps:...

Stopping Active Attacks with Penalty Box

Unfortunately, today's sophisticated web application threats have gained some advantages over typical WAFs: Favorable odds -- WAFs must correctly identify attacks 100% of the time, whereas attackers have the luxury of only needing to find a single bypass or evasion Temporary fixes -- Many WAFs us...