xssless

xssless 一款基于 Python 的自动化 XSS 载荷生成器。 用法 1. 使用 Burp 代理 记录请求 2. 选择要生成的请求，右键点击并选择 "Save items" 3. 使用 xssless 生成载荷：./xssless.py burpexportfile 4. 搞定！ 更详细的教程请参见此处 功能特性 从导入的 Burp 代理请求自动生成 XSS 载荷 载荷完全异步，不会冻结用户浏览器 载荷已优化，但建议使用第三方工具进行压缩 可通过 -p 选项轻松提取和设置 CSRF 令牌 支持 POST multipart，以及通过 -f 选项进行 XSS 文件上传...

CVE-2026-39107

CVE-2026-39107：Kimi AI v1.0 中的跨站脚本（XSS）漏洞 描述 Kimi AI v1.0 Web 界面的“预览”功能中存在跨站脚本（XSS）漏洞。应用程序未能正确清理或编码由 AI 模型生成的 HTML/JavaScript 载荷。当用户切换到“预览”选项卡查看 AI 生成的代码时，恶意载荷直接渲染到 DOM 中，导致受害者浏览器会话中执行任意 JavaScript。 研究员 Mustafa Hameed 漏洞详情 漏洞类型： 通过 AI 响应触发的存储型/类存储型跨站脚本（XSS） 受影响产品： Kimi AI 受影响版本： v1.0 受影响组件： “预览”选...

njRAT-0.7d-Stub-CSharp

此存储库没有 README。...

-EXPLOIT-CVE-2023-36025

EXPLOIT CVE-2023-36025 - Description Windows SmartScreen Security Feature Bypass Vulnerability Usage NOTE handler waiting for tcp request for target P.S configure CVE-2023-36025.vbs file to change the ip and port to machine ip and port that is being used for the TCP handler configure reverse TCP...

bxss

Bxss - Blind XSS Scanner 🚀 Description...

Kitsune

Kitsune Kitsune is a Polymorphic Command & Control. This tool allows you to get a graphical version of your favourite hacking tools, such as NetExec, Villain or Evil-WinRM among others. In addition, brings many improvements such as automatic reconnection, reports, history and some extra functions...

log4j-payload-generator

log4j-payload-generator log4j-paylaod generator : 用于Apache log4j RCE CVE-2021-44228的通用payload生成器。 部署 部署本项目请运行 root@kitploit: sudo git clone https://github.com/yesspider-hacker/log4j-payload-generator.git 运行测试 要运行测试，请执行以下命令 root@kitploit: cd log4j-payload-generator/ python3 log4jpayloadgenerater.p...

CVE-2022-4616-POC

CVE-2022-46169 Pseudo Shell Description This Python script serves as a helper tool to streamline the process of exploiting the CVE-2022-46169 vulnerability. It starts an HTTP server that listens for incoming requests and provides a simple interface for the user to input commands. These commands a...

citrix-honeypot

Citrix ADC NetScaler 蜜罐 检测并记录 CVE-2019-19781（Shitrix / Citrixmash）的攻击载荷 记录失败的登录尝试 提供从真实设备获取的内容和响应头，以增加在搜索引擎（如 Google、Shodan 等）上的索引机会 安装 预编译版本 预编译的 Linux（x64）软件包可在此处获取 root@kitploit: mkdir citrix-honeypot cd citrix-honeypot wget...

CVE-2025-1302_jsonpath-plus_RCE

CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: poc.py A proof-of-concept exploit script for CVE-2025-1302, which targets an RCE vulnerability in the jsonpath-plus library. When run against a vulnerable service endpoint, the script attempts to trigger remote code execution via a JSONPath...

LightMe

LightMe LightMe is a Simple HTTP Server serving Powershell Scripts/Payloads after Obfuscate them and run obfuscation as a service in backgroud in order to keep obfuscate the payloads which giving almost new obfuscated payload on each HTTP request Main Features Obfuscate all powershell files withi...

kwetza

介绍 作者：Chris Le Roy @brompwnie [email protected] Kwetza 是一款允许你用 Meterpreter 载荷感染现有 Android 应用程序的工具。 它能做什么？ Kwetza 使用自定义或默认的载荷模板感染现有的 Android 应用程序，以规避防病毒软件的检测。Kwetza 允许你使用目标应用程序的默认权限感染 Android 应用程序，或注入额外权限以获得更多功能。 哪里可以找到博文？ Kwetza...

python-log4rce

Python Log4RCE 一个用于CVE-2021-44228的全能纯Python3 PoC。 示例 root@kitploit: python3 log4rce.py --target "linux" --payload "PAYLOAD" http -X POST --url "http://localhost:8080/" --data "address=" root@kitploit: INFO:HTTP:Running on local port 1337 INFO:HTTP:Remote target is...

CVE-2024-26169-Detail-1

CVE-2017-11882-metasploit This is a Metasploit module which exploits CVE-2017-11882 using the POC below: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about. Installation 1. Copy the cve201711882.rb to /usr/share/metasploit-framework/modules/exploits/windows/local...

cve-2023-38831

CVE-2023-38831 受影响版本：WinRAR = 6.22 https://www.win-rar.com/ 使用方法： root@kitploit: python3 cve-2023-38831.py filename payloadname archivename 参考链接： https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ https://xakep.ru/2023/08/24/winrar-0day/ Telegram： https://t.me/ptsoft...

scansploit

=SCANSPLOIT= 用于将恶意载荷注入条形码的工具 条形码 code128 QR码 DataMatrix EAN13 依赖 Python3 PyStrich pip3 install pystrich 如果出现jpeg错误： sudo apt-get install libtiff5-dev zlib1g-dev libfreetype6-dev liblcms2-dev libwebp-dev tcl8.6-dev tk8.6-dev python-tk Pillow pip3 install pillow...

CVE-2023-33408

CVE-2023-33408 Minical 1.0.0 is vulnerable to Stored Cross-Site Scripting XSS Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC Step 1: Log in to the Minical Application and Navigate to Room-Room Status. Step 2: Click on the Edit Room Note option and enter...

Trust-Decision-Security

Trust Decision Solver - Reverse Engineered This software lets you Generate infinite dynamic fingerprints Generate infinite TD pass tokens with no detection Some of the web securities flaws include: TLS fingerprint checks not present on token domain However TLS checks present on retail site domain...

msfpc

MSFvenom Payload Creator MSFPC 一种通过 msfvenom（Metasploit 框架的一部分）快速生成各种“基本”Meterpreter 有效载荷的工具。 关于 MSFvenom Payload Creator MSFPC 是一个封装工具，用于根据用户选择生成多种类型的有效载荷。其理念是尽可能简单 （只需一个输入 ）来生成有效载荷。 终极目标是完全自动化 msfvenom 和 Metasploit（当然也要能够自动化 MSFPC 本身）。其余部分则是为了让用户的生活尽可能轻松 （例如 IP 选择菜单 、msfconsole 资源文件/命令 、批量生成有效载...

CVE-2017-9779

Automatic execution Payload From Windows By Path Users :: What is ? Cmder Cmder is a software package created out of pure frustration over the absence of nice console emulators on Windows. It is based on amazing software, and spiced up with the Monokai color scheme and a custom prompt layout,...