pycrypt

pycrypt 基于Python的加密器，能够绕过任何类型的杀毒软件 注意： root@kitploit: 如果存根被检测到，请使用以下混淆方法:- 1. https://github.com/machine1337/fudcrypt 2. https://github.com/machine1337/pyobfuscate 重要说明： root@kitploit: 1. 确保你的载荷文件导入了所有库，并且是一个有效的载荷文件 2. 如果载荷被检测到，请告诉我，我会更新存根。 3. 如果需要Cobalt Strike规避功能，请在Telegram联系我: @R0ot1337 使用方法：...

haptyc

Haptyc 测试生成框架 Haptyc 是什么？ Haptyc 是一个 Python 库，旨在为 Turbo Intruder 添加载荷位置支持和狙击手/集束炸弹/攻城锤/草叉攻击类型。虽然 Haptyc 能够很好地实现这些目标，但它也提供了一种更简单的方式来表达常规测试序列。尽管该库是为 Turbo Intruder 设计的，但它并不强依赖 Turbo Intruder，可以在任何需要在 Python 环境中生成测试的地方使用。遗憾的是，由于 Haptyc 是为 jython 解释器构建的，目前仅支持 Python 2.7（不过未来的更新将解决这个问题）。 什么是 Haptyc 标签...

XORpass

XORpass is an encoder to bypass WAF filters using XOR operations. Installation & Usage root@kitploit: git clone https://github.com/devploit/XORpass cd XORpass $ python3 xorpass.py -h Example of bypass: Using clear PHP function: Using XOR bypass of that function: root@kitploit: $ python3 xorpass.p...

xssless

xssless 一款基于 Python 的自动化 XSS 载荷生成器。 用法 1. 使用 Burp 代理 记录请求 2. 选择要生成的请求，右键点击并选择 "Save items" 3. 使用 xssless 生成载荷：./xssless.py burpexportfile 4. 搞定！ 更详细的教程请参见此处 功能特性 从导入的 Burp 代理请求自动生成 XSS 载荷 载荷完全异步，不会冻结用户浏览器 载荷已优化，但建议使用第三方工具进行压缩 可通过 -p 选项轻松提取和设置 CSRF 令牌 支持 POST multipart，以及通过 -f 选项进行 XSS 文件上传...

CVE-2026-39107

CVE-2026-39107: Cross-Site Scripting XSS in Kimi AI v1.0 Description A Cross-Site Scripting XSS vulnerability exists in the Kimi AI v1.0 web interface's 'Preview' feature. The application fails to properly sanitize or encode HTML/JavaScript payloads generated by the AI model. When a user switches...

-EXPLOIT-CVE-2023-36025

EXPLOIT CVE-2023-36025 - Description Windows SmartScreen Security Feature Bypass Vulnerability Usage NOTE handler waiting for tcp request for target P.S configure CVE-2023-36025.vbs file to change the ip and port to machine ip and port that is being used for the TCP handler configure reverse TCP...

bxss

Bxss - Blind XSS Scanner 🚀 Description...

Kitsune

Kitsune Kitsune is a Polymorphic Command & Control. This tool allows you to get a graphical version of your favourite hacking tools, such as NetExec, Villain or Evil-WinRM among others. In addition, brings many improvements such as automatic reconnection, reports, history and some extra functions...

log4j-payload-generator

log4j-payload-generator log4j-paylaod generator : A generic payload generator for Apache log4j RCE CVE-2021-44228. Deployment To deploy this project run root@kitploit: sudo git clone https://github.com/yesspider-hacker/log4j-payload-generator.git Running Tests To run tests, run the following...

CVE-2022-4616-POC

CVE-2022-46169 Pseudo Shell Description This Python script serves as a helper tool to streamline the process of exploiting the CVE-2022-46169 vulnerability. It starts an HTTP server that listens for incoming requests and provides a simple interface for the user to input commands. These commands a...

citrix-honeypot

Citrix ADC NetScaler Honeypot Detects and logs payloads for CVE-2019-19781 Shitrix / Citrixmash Logs failed login attempts Serves content and headers taken from real appliance in order to increase chance of indexing on search engines e.g. google, shodan etc. Installation Precompiled Precompiled...

CVE-2025-1302_jsonpath-plus_RCE

CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: poc.py A proof-of-concept exploit script for CVE-2025-1302, which targets an RCE vulnerability in the jsonpath-plus library. When run against a vulnerable service endpoint, the script attempts to trigger remote code execution via a JSONPath...

LightMe

LightMe LightMe is a Simple HTTP Server serving Powershell Scripts/Payloads after Obfuscate them and run obfuscation as a service in backgroud in order to keep obfuscate the payloads which giving almost new obfuscated payload on each HTTP request Main Features Obfuscate all powershell files withi...

kwetza

介绍 作者：Chris Le Roy @brompwnie [email protected] Kwetza 是一款允许你用 Meterpreter 载荷感染现有 Android 应用程序的工具。 它能做什么？ Kwetza 使用自定义或默认的载荷模板感染现有的 Android 应用程序，以规避防病毒软件的检测。Kwetza 允许你使用目标应用程序的默认权限感染 Android 应用程序，或注入额外权限以获得更多功能。 哪里可以找到博文？ Kwetza...

python-log4rce

Python Log4RCE 一个用于CVE-2021-44228的全能纯Python3 PoC。 示例 root@kitploit: python3 log4rce.py --target "linux" --payload "PAYLOAD" http -X POST --url "http://localhost:8080/" --data "address=" root@kitploit: INFO:HTTP:Running on local port 1337 INFO:HTTP:Remote target is...

CVE-2024-26169-Detail-1

CVE-2017-11882-metasploit This is a Metasploit module which exploits CVE-2017-11882 using the POC below: https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about. Installation 1. Copy the cve201711882.rb to /usr/share/metasploit-framework/modules/exploits/windows/local...

cve-2023-38831

CVE-2023-38831 受影响版本：WinRAR = 6.22 https://www.win-rar.com/ 使用方法： root@kitploit: python3 cve-2023-38831.py filename payloadname archivename 参考链接： https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ https://xakep.ru/2023/08/24/winrar-0day/ Telegram： https://t.me/ptsoft...

scansploit

=SCANSPLOIT= 用于将恶意载荷注入条形码的工具 条形码 code128 QR码 DataMatrix EAN13 依赖 Python3 PyStrich pip3 install pystrich 如果出现jpeg错误： sudo apt-get install libtiff5-dev zlib1g-dev libfreetype6-dev liblcms2-dev libwebp-dev tcl8.6-dev tk8.6-dev python-tk Pillow pip3 install pillow...

CVE-2023-33408

CVE-2023-33408 Minical 1.0.0 is vulnerable to Stored Cross-Site Scripting XSS Vendor: https://github.com/minical/minical Demo Application: https://demo.minical.io/ PoC Step 1: Log in to the Minical Application and Navigate to Room-Room Status. Step 2: Click on the Edit Room Note option and enter...

Trust-Decision-Security

Trust Decision Solver - Reverse Engineered This software lets you Generate infinite dynamic fingerprints Generate infinite TD pass tokens with no detection Some of the web securities flaws include: TLS fingerprint checks not present on token domain However TLS checks present on retail site domain...