m4ngl3m3

m4ngl3m3! Quick Installation: root@kitploit: $ git clone https://github.com/localh0t/m4ngl3m3 $ cd m4ngl3m3 $ ./main.py Basic Help: root@kitploit: usage: main.py -h -fy FROMYEAR -ty TOYEAR -sy -nf NUMBERSFILE -sf SYMBOLSFILE -cf CUSTOMFILE -sbs -sap -mm MUTATIONMETHODS MUTATIONMODE STRINGSFILE...

edge

Cloud edge - Whois for the Cloud Lookup an IP to find the cloud provider and other details based on the provider's published JSON, CSV, or text data Cloud edge is a recon tool focused on exploring cloud service providers. It can be used for cloud attribution and forensics, pentesting, bug bounty,...

text4shell-docker

Install maven - maven-linux 1. Maven install to create the fat jar root@kitploit: mvn clean install 2. Docker build root@kitploit: docker build --tag=text4shell . 3. Docker run root@kitploit: docker run -p 80:8080 text4shell 4. Test the app root@kitploit: http://localhost/text4shell/attack?search...

r77-rootkit

r77 Rootkit 无文件 ring 3 Rootkit r77 是一个 ring 3 的 Rootkit，可以隐藏一切： 文件、目录 进程及 CPU/GPU 使用率 注册表键和值 服务 TCP 和 UDP 连接 交接点、命名管道、计划任务 通过前缀隐藏 所有以 "$77" 开头的内容都会被隐藏。 配置系统 动态配置系统允许根据 PID 和 名称 隐藏进程，根据 完整路径 隐藏文件系统项，隐藏特定端口的 TCP 和 UDP 连接等。 配置位于 HKEYLOCALMACHINE\SOFTWARE$77config，任何进程无需提升权限即可写入。该键的 DACL...

collisions

TL;DR conseguir una colisión MD5 de estas dos imágenes ahora es trivial e instantáneo. ⟷ No juegues con fuego, no confíes en MD5. Colisionar cualquier par de archivos ha sido posible durante muchos años, pero lleva varias horas cada vez, sin atajos. Esta página proporciona trucos específicos para...

CVE-2026-36851

CVE-2026-36851 Path traversal / arbitrary file read in UnPoller v2.33.0 via the file:// password prefix. File contents are read from disk and transmitted to the configured UniFi controller URL during authentication...

ShellEvil

ShellEvil Jonatas Fil Dkr Julio Della Flora Thiago Sena THX 针对 CVE-2013-225 S2-016 的 Struts 2 DefaultActionMapper 交互式 Shell 漏洞利用 Struts 2 DefaultActionMapper 支持一种通过为参数添加 "action:" 或 "redirect:" 前缀来实现导航状态短路变更的方法， 后跟所需的目标导航表达式。该机制旨在帮助 将导航信息附加到表单内的按钮上。 https://struts.apache.org/docs/s2-016.html USO:...

log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

Advance Post Prefix WordPress plugin - Reflected XSS

Advance Post Prefix WordPress plugin through 1.1.1 contains a reflected cross-site scripting caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12734 info: name: Advance...

ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE

ServiceNow AI Platform Brazil, Australia, Zurich, and Yokohama releases before patching contains a pre-authentication remote code execution vulnerability. The /assessmentthanks.do endpoint passes the sysparmassessabletype parameter into GlideRecord's addQuery, which evaluates "javascript:" prefix...

Traefik - Open Redirect

Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-15129 info: name:...

Vite-CVE-2025-30208-EXP

CVE-2025-30208 Detection Tool Vulnerability Analysis CVE-2025-30208 is an arbitrary file read vulnerability in the Vite development server. Attackers can read sensitive server files such as /etc/passwd or C:\windows\win.ini by constructing special paths e.g., @fs prefix. This tool supports...

CVE-2026-52886

Path Traversal: Bypass de verificación de prefijo startswith Notepad++ — Lectura arbitraria de archivos mediante traversal debackupFilePath en session.xml Aviso GHSA: GHSA-rqfm-pw34-r7j6 CVE: CVE-2026-52886 Gravedad: Moderada Afectado: v8.9.6.4 Corregido: v8.9.7 Commit del parche: 7e66f36 Archivo...

cve-2022-42889-text4shell

安装 Maven - maven-linux 1. 安装Maven以创建胖JAR包 root@kitploit: mvn clean install 2. Docker构建 root@kitploit: docker build --tag=text4shell . 3. Docker运行 root@kitploit: docker run -p 80:8080 text4shell 4. 测试应用 root@kitploit: http://localhost/text4shell/attack?search= 5...

CVE-2022-42889

CVE-2022-42889-POC A simple demo application that shows how to exploit the CVE-2022-42889 vulnerability. Utilizes OOB Out of Band services to demonstrate dns and url prefixes. JavaDocs for commons-text interpolation commons-text JavaDocs Example interpolations script:javascript...

Linux Distros Unpatched Vulnerability : CVE-2026-89581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX....

@Mockoon/commons-server: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Summary A FILE response whose filePath embeds request data e.g. "/srv/public/queryParam 'name'", the documented way to let the client pick a file is confined by getSafeFilePath with resolvedPath.startsWithstaticBaseDir. That prefix test has no path-separator boundary, so a ../-escaped path whose...

DEBIAN-CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89581 bpf, x86: Fix per-CPU address resolution into an extended register

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...