CVE-2026-121413: parse-community parse-server: Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade…

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the Session class create class-level permission. Attackers holding a user's session token can sen...

DeadDialect

DeadDialect Every boot speaks a different language. Yesterday's binary is today's dead code. A session-unique RISC-V ISA remapping system. Every time the system boots, it generates a fresh cryptographic permutation of the instruction set. Binaries compiled for one session are cryptographically...

-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – svchost Injection via Native API Calls The following Binary Ninja snippet reveals the core injection mechanism used by Remcos to inject its payload into svchost.exe. What This Code Does: CreateProcessW with the CREATESUSPENDED flag starts a new svchost process in a suspended state...

Persistnux

Persistnux A comprehensive Linux persistence detection tool for Digital Forensics and Incident Response DFIR investigations. Overview Persistnux is a bash-based tool designed to identify known Linux persistence mechanisms used by attackers to maintain access to compromised systems. It performs...

CVE-2026-120338

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted...

EUVD-2026-114859

Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted...

Chrono-Drip-Temporal-Viscosity-Exploitation-Framework-CVE-2022-0847

Chrono-Drip: Temporal Viscosity Exploitation Framework CVE-2022-0847 Weaponization via Convergent Time Theory CTT ⚠️ DISCLAIMER FOR RESEARCH AND ACADEMIC PURPOSES ONLY This tool demonstrates the application of fundamental physics discoveries to cybersecurity. All work presented here is theoretical...

backdoors

Backdoors Tools designed for maintaining access to systems and proof-of-concept demonstrations written by the team at Hacker House. These tools are designed to simulate or demonstrate common persistence techniques such as kernel mode hooking and command & control implementations. File| Descriptio...

inficere

inficere Public version of my Mac OS X rootkit built on top of fractalG's onyx-the-black-cat https://github.com/gdbinit/onyx-the-black-cat Tested only in Mountain Lion, 10.8.2 to 10.8.5. Not guaranteed to work on other versions. Features process hiding - hides from 'ps PID', 'ps aux', Activity...

CVE-2025-24813

Description This repository is an environment for reproducing the latest RCE of CVE-2025-24813 Tomcat. For learning and research purposes only! Exploitation Conditions The application has enabled the DefaultServlet write functionality, which is disabled by default. The application supports partia...

linux-root-kit

About This Project This project was developed as part of the Digitale Forensik course at the Technische Hochschule Deggendorf. It demonstrates a full forensic investigation and attack simulation involving: A Python dependency confusion attack using a malicious PyPI package Privilege escalation vi...

persistence-info.github.io

The repository tries to gather an information about Windows persistence mechanisms to make the protection/detection more efficient. Most of the information is well known for years, being actively used within various scenarios. Expect more. I am doing my best to add new entries each day. How it...

spyrat

SpyRat Simple Python Rat v 1.0 Author: Mascerano Bachir dev-labs Legal Disclamer: The author does not hold any responsibility for the bad use of this tool, remember this is only for educational purpose. Description: SpyRat is a remote access trojan written in python with auto persistence option...

burp-extensions-montoya-api-examples

Example Extensions Extension| Description ---|--- Hello World| Prints output to various locations in Burp HTTP Handlers| Demonstrates performing various actions on requests passing through any tool in Burp Proxy Handlers| Demonstrates performing various actions on requests passing through the Pro...

stratum-c2

Cloud Persistence Framework · v3.0.2 A fallback foothold that routes through infrastructure defenders can't block. The problem Your primary C2 goes silent. The domain gets blacklisted. The beacon gets flagged. The EDR kills the process. You're out. You need a second channel — one that was never...

draytek-arsenal

Draytek Arsenal: Observability and hardening toolkit for Draytek edge devices. Advanced attackers are increasingly choosing edge devices as targets. However, these devices are controlled by closed-source software known as firmware, often distributed in a proprietary format. This is an added...

react-cve-2025-55182

react-cve-2025-55182 This is a dump of malware and other suspicious junk I found on the server for my wedding website following the react server side rendering code execution exploit. Its a dinky digital ocean droplet running a fairly pedestrian next js app. The CVE:...

zimbra-cve-2026-73570-ir

Zimbra CVE-2026-73570 Community IR Toolkit Detection-first, evidence-preserving incident-response helpers for Zimbra administrators investigating suspected exploitation of CVE-2026-73570. !CAUTION This is an independent community project, not a vendor compromise oracle. The checker is read-only a...

dcshadow

!WARNING DO NOT RUN IN PRODUCTION. This is meant for lab testing, for blue teams to work on identifying IoCs, event types, and behavior. Also, this tool is provided as-is. No support is planned apart from standard review on pull requests you may want to create. Don't run this from a Windows host...

Powershell-C2

Powershell-C2 This attack stems off of my Powershell Payload Excel Delivery, but it uses a really cool method for Command and Control/persistence on the box. A walk-through can be found here: http://enigma0x3.wordpress.com/2014/01/17/command-and-control-using-powershell-and-your-favorite-website/...