XSSYA

XSSYA-V2.0 è stato rilasciato - vedi https://github.com/yehia-mamdouh/XSSYA-V-2.0 XSSYA è uno scanner per Cross Site Scripting e conferma di vulnerabilità funziona con due metodi • Metodo numero 1 per la conferma di richiesta e risposta • Metodo numero 2 per la conferma: esegue il payload...

dns-rebind-toolkit

DNS Rebind Toolkit Demo | Security Advisory | Included Payloads | FAQ DISCLAIMER: This software is for educational purposes only. This software should not be used for illegal activity. The author is not responsible for its use. Don't be a dick. DNS Rebind Toolkit is a frontend JavaScript framewor...

batchfuscate

batchfuscate Uno script semplice ed efficiente per rendere il tuo payload batch indetectabile. Requisiti: root@kitploit: 1. python3 deve essere installato su Windows e Linux 2. pip install termcolor pip install pystyle pip install tqdm pip install colorama pip install requests Installazione:-...

Graffiti

HINWEIS : Laden Sie Payloads niemals auf Online-Prüfer hoch Graffiti ist ein Werkzeug zur Erstellung von verschleierten Einzeilern, um Penetrationstests zu unterstützen. Graffiti akzeptiert die folgenden Sprachen zum Codieren: Python Perl Batch Powershell PHP Bash Graffiti akzeptiert auch Sprache...

CVE-2018-11776-Python-PoC

CVE-2018-11776-Python-PoC hook-s3c github.com/hook-s3c, @hooks3c su twitter Test funzionante in Python e PoC per CVE-2018-11776, originariamente apparso su; https://github.com/hook-s3c/CVE-2018-11776-Python-PoC Cosa sta succedendo? Man Yue Mo di Semmle ha divulgato una vulnerabilità RCE in Struts...

Invoke-PSImage

Invoke-PSImage Kodiert ein PowerShell-Skript in die Pixel einer PNG-Datei und generiert einen Einzeiler zur Ausführung Invoke-PSImage nimmt ein PowerShell-Skript und kodiert die Bytes des Skripts in die Pixel eines PNG-Bildes. Es generiert einen Einzeiler zur Ausführung entweder von einer Datei...

python-paddingoracle

python-paddingoracle: A portable, padding oracle exploit API UPDATED FOR PYTHON 3 python-paddingoracle is an API that provides pentesters a customizable alternative to PadBuster and other padding oracle exploit tools that can't easily without a heavy rewrite be used in unique, per-app scenarios...

CVE-2026-48537 GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected...

Byte XORi Encoder

Byte XOR encoder for RISC-V 64-bit Little Endian. Encodes the payload byte-by-byte with a 1-byte XOR key using the xori instruction. Useful when R-type XOR instruction bytes 0x33 are bad characters. Module Options msf use encoder/riscv64le/bytexori msf encoderbytexori show actions ...actions... m...

XOR Encoder

Dword XOR encoder for RISC-V 64-bit Little Endian. Encodes the payload with a 4-byte XOR key. Module Options msf use encoder/riscv64le/longxor msf encoderlongxor show actions ...actions... msf encoderlongxor set ACTION msf encoderlongxor show options ...show and set options... msf encoderlongxor...

Byte XORi Encoder

Byte XOR encoder for RISC-V 32-bit Little Endian. Encodes the payload byte-by-byte with a 1-byte XOR key using the xori instruction. Useful when R-type XOR instruction bytes 0x33 are bad characters. Module Options msf use encoder/riscv32le/bytexori msf encoderbytexori show actions ...actions... m...

Dword XOR Encoder (Tag-based)

Dword XOR encoder for RISC-V 32-bit Little Endian using a tag-based terminator rather than an encoded length. The decoder loop XORs each dword and stops when the result is zero the sentinel. This avoids encoding the payload length in the stub, eliminating a source of bad character conflicts. Note...

CVE-2019-25612 Admin Express 1.2.5.485 Local SEH Buffer Overflow via Folder Path

Admin Express 1.2.5.485 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an alphanumeric encoded payload in the Folder Path field. Attackers can trigger the vulnerability through the System Compare...

CVE-2019-25467

Verypdf docPrint Pro 8.0 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized alphanumeric encoded payload in the User Password or Master Password fields. Attackers can craft a malicious payload with...

cl-cybersec-pysxss

XSS WAF Lab – Payload Generator This project studies how Web...

Exploit for Deserialization of Untrusted Data in Laravel

CVE-2018-15133-PoC Este script Python implementa un exploit d...

Incorrect functionID will not trigger fallback

Lines of code Vulnerability details Impact When encoding a payload for settlement of multiple tokens, the fallback flag is not set when it should be. This will cause no fallback to be triggered even though the user has paid enough to cover the additional costs that are required. Proof of Concept ...

Exploit for Code Injection in Vmware Spring_Framework

Spring Framework RCE exploitation Quick pentest notes...

Microsoft Windows Defender - Detections Bypass

Exploit Title: Microsoft Internet Explorer / ActiveX Control - Security Bypass Exploit Author: John Page aka hyp3rlinx Website: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/MICROSOFTWINDOWSDEFENDERDETECTIONBYPASS.txt twitter.com/hyp3rlinx ISR: ApparitionSec Vendor...

DNSStager - Hide Your Payload In DNS

DNSStager is an open-source project based on Python used to hide and transfer your payload using DNS. DNSStager will create a malicious DNS server that handles DNS requests to your domain and return your payload as a response to specific record requests such as AAAA or TXT records after splitting...