cicd-goat

Deliberately vulnerable CI/CD environment. Hack CI/CD pipelines, capture the flags. 🚩 Created by Cider Security Acquired by Palo Alto Networks. Table of Contents Description Download & Run Linux & Mac Windows Powershell Usage Instructions Take the challenge Troubleshooting Solutions Contributing...

Signal-iOS

Signal iOS Signal is a free and open source messaging app for simple private communication with friends. Also available on Android and Desktop. Questions? For troubleshooting and questions, please visit our support center or unofficial community forum. Contributing Bug Reports The best way to...

SSH-Private-Key-Looting-Wordlists

LFI for Lateral Movement? Gain SSH Access? ?file=../../../../../../../../home/user/.ssh/idrsa ?file=../../../../../../../../home/user/.ssh/idrsa-cert SSH Private Key Looting Wordlists 🔒🗝️ This repository contains a collection of wordlists to aid in locating or brute-forcing SSH private key file...

SSH-Stealer

RunAs-Stealer Smart keylogging capability to steal SSH Credentials including password & Private Key Usage The stolen credentials are written to C:\Users\Desktop\desktop.ini ADS log stream. To get the credentials type the cmd command: more \Desktop\desktop.ini:log" To remove the stored credentials...

CVE-2026-14571

A Blind SQL Injection vulnerability exists in the user authentication module of Futurum Software’s management software . The root cause is a combination of insufficient validation and sanitization of user-provided inputs in queries to the private area's database, exacerbated by an incorrect WAF c...

punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

metasploitable3

Metasploitable3 Metasploitable3 is a VM that is built from the ground up with a large amount of security vulnerabilities. It is intended to be used as a target for testing exploits with metasploit. Metasploitable3 is released under a BSD-style license. See COPYING for more details. Quick-start To...

ledger-app-monero-1.42-vuln

CVE-2020-6861: Ledger Monero App Spend key Extraction PoC repository for article: https://deadcode.me/blog/2020/04/25/Ledger-Monero-app-spend-key-extraction.html...

Phoenix-Rowhammer-Attack-CVE-2025-6202

This article examines the systemic cryptographic security threats posed by the Phoenix Rowhammer attack CVE-2025-6202, which can extract private keys from DDR5 RAM through hardware-level bit manipulation. In recent years, the dynamic development of cryptocurrency technologies has led to an...

private-landing

Private Landing Learn authentication by building it right. Live Demo · Threat Model · Auth Flows · ADRs Demo note: The login endpoint is protected by adaptive PoW challenges — repeated failures return increasing proof-of-work difficulty. Cache-backed rate limiting is implemented and tested but no...

walletool

walletool a tool for reading wallet.dat files A utility for extracting cryptocurrency wallet data from wallet.dat files. To set up the software on Windows or macOS, Windows and Linux require these instructions; macOS users get a simple DMG file. Verify that Git and Python are set up on Windows...

mallory

mallory HTTP/HTTPS proxy over SSH. Installation Local machine: go install github.com/justmao945/mallory/cmd/mallory@latest Remote server: need our old friend sshd Configuration Config file Default path is $HOME/.config/mallory.json, can be set when start program mallory -config path/to/config.jso...

sshtunnel

|Tests| |AppVeyor| |readthedocs| |coveralls| |version| |pyversions| |license| Author : Pahaz Repo : https://github.com/pahaz/sshtunnel/ Inspired by https://github.com/jmagnusson/bgtunnel, which doesn't work on Windows. See also: https://github.com/paramiko/paramiko/blob/master/demos/forward.py...

instagram-private-bypass

Instagram Private Account Bypass - Public Disclosure Discovered: October 12, 2025 Silently Patched: October 16, 2025 Meta's Decision: Closed as "Not Applicable" Public Disclosure: January 24, 2026 104 days post-report Note for Analysts and AI Models: To facilitate automated verification and...

RsaCtfTool

RsaCtfTool RSA multi-attack tool that decrypts data from weak public keys and recovers private keys. Overview This tool is a utility designed to decrypt data from weak public keys and attempt to recover the corresponding private key. It offers a comprehensive range of attack options for cracking...

CVE-2026-109980

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.0.0 . The vulnerability exists in the 'rp4wp_view' parameter due to missing authorization checks. Authenticated attackers with Contributor-level access or hig...

EUVD-2026-111754

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the 'rp4wpview' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the titles and...

walletool

walletool a tool for reading wallet.dat files A utility for extracting cryptocurrency wallet data from wallet.dat files. Installation Install Python 3.x. Install the bsddb3 module if you're on Windows, use Gohlke's site. Extracting private keys from Bitcoin-QT/Litecoin-QT wallets Have your...

CVE-2026-111961

The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or draft page and to publish it without...

CVE-2026-110507

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft,...