kavanoz

🫙 kavanoz 🫙 Kavanoz jar in turkish is a tool to statically unpack common android banker malware. Do you ever wanted to get payload from packed malware without running android emulator ? Me neither : But here is a tool anyway. 👀 Installation pip install kavanoz To install from source, clone the...

czds

CZDS What is CZDS? Each Top Level Domain TLD is maintained by a registry operator, who also manages a publicly available list of Second Level Domains SLDs and the details needed to resolve those domain names to Internet Protocol IP addresses. The registry operator’s zone data contains the mapping...

astaroth-deobfuscator

astaroth-deobfuscator IDA python script for deobfuscating Astaroth/Guildma injector DLL When trying to analyze the injector DLL from a recent Astaroth/Guildma campaign thanks to this diary from SANS ISC, I came across a really annoying attempt at obfuscation. A function which I called...

CVE-2021-23017-PoC

CVE-2021-23017-PoC python3 poc.py --target 172.1.16.100 --dnsserver 172.1.16.1...

pyOneNote

pyOneNote pyOneNote is a lightweight python library to read OneNote files. The main goal of this parser is to allow cybersecurity analyst to extract useful information from OneNote files. Installing the parser Installing the latest development pip install -U...

CVE-2020-10148-Solarwinds-Orion

CVE-2020-10148 Solarwinds Orion Download CVE-2020-10148.py wget https://gist.githubusercontent.com/0xsha/75616ef6f24067c4fb5b320c5dfa4965/raw/0d7db4f2ea5aacc0ada7b1a7b23f2ce8ba39315f/CVE-2020-10148.py Looking Solarwinds Orion from Shodan...

CVE-2025-3248

CVE-2025-3248 Introduction Langflow versions prior to 1.3.0 are susceptible to unauthenticated code injection in the /api/v1/validate/code endpoint via Python exec function. This exploit establishes a reverse shell connection abusing this vulnerability. Usage Configuration git clone...

CVE-2022-1388

CVE-2022-1388 F5 BIG-IP iControl REST Authentication Bypass Vulnerability Optional Arguments: -h, --help show this help message and exit -u url, --url url Target url eg:"http://127.0.0.1" -f file, --file file Targets in file eg:"ip.txt" Usage python3 CVE-2022-1388.py -u http://127.0.0.1 python3...

CVE-2026-33017-PoC-Reverse-Shell

CVE-2026-33017 - Langflow Unauthenticated RCE Exploit 📋 Overview CVE-2026-33017 is an unauthenticated Remote Code Execution RCE vulnerability in Langflow versions This exploit is for educational and authorized testing purposes only. Unauthorized access to computer systems is illegal. Use this too...

malvinci

malvinci This simple script will introduce a new type of malware that will turn off the firewall, start an HTTP server, forward its port through ngrok, and send the URL of the server through a Telegram bot. You will need to create a new Telegram BOT. Follow the steps the steps here to create one⚡...

CVE-2022-22965

👾 CVE-2022-22965 This is a proof of concept of an exploit for CVE-2022-22965 spring4shell vulnerability. It is composed by: A vulnerable Springboot application; An exploit script written in python; A safe app for test that the exploit doesn't work; A dockerfile for running the vulnerable...

exploit-writing-for-oswe

Exploit Writing for OSWE Background What This repository contains a list of useful snippets and tips that pertain to the writing of exploit scripts in the OSWE labs and certification exam. Some examples here may go against certain coding practices, but our end goal is to write the exploit script...

check_mdi

checkmdi Python script to enumerate valid Microsoft 365 domains, retrieve tenant name, and check for a Microsoft Defender for Identity MDI instance. Based on: https://github.com/thalpius/Microsoft-Defender-for-Identity-Check-Instance. Usage ./checkmdi.py -d...

domain-enumeration-sicarius

Sicarius 🐴 ⚡️ Fast subdomain enumeration tool 🐴 ⚡️ 🦆 @unp4ck 🪳🫠 Install git clone github.com/unp4ck/sicarius.git cd sicarius touch config/config.yaml add your apis keys here! pip3 install -r requirements.txt --user Post Installation API Key is needed before querying on third-party sites; Sicarius...

Check-Point_poc

Check-Pointpoc Check-Point Security Gateway Arbitrary File Read Vulnerability CVE-2024-24919 python Check-Pointpoc.py -h -. -. OO . OO . /. -. ,-.-'/. -. ,-.-' \ .' / | |OO\ .' / | |OO \ /\ | | \ \ /\ | | \ \ \ | | |/ \ \ | | |/ .' ,| |.' .' ,| |.' / .'. | | / .'. | | '--' '--' --' '--' '--'...

KPOT-string-decrypter

KPOT-string-decrypter IDA python scripts for decrypting KPOT stealer's strings and setting those as comments next to the var that would receive them during runtime. It works as follows: Gets the offset that's passed on eax to either decryption function there are two, which is why this repo has tw...

Dropper

Stealth dropper JPEG/PNG This project is a tool for embedding payloads into JPG/PNG format images, allowing you to perform certain actions when opening them. 🚫 Disclaimer This repository is provided for educational purposes only and intended for authorized security research. Use of these material...

FilelessPELoader

FilelessPELoader Loading Remote AES Encrypted PE in memory , Decrypted it and run it Usage : References : https://github.com/aplyc1a/PEMemoryLoader?fbclid=IwAR2-VAQo8pJU-tdbSENjhDBdDGi5tyzrnW1S3D9BPAYR6C6-RK4hsEDjDGk Requirements 1. hashlib 2. pycryptodome 3. pycryptodomex...

ail-typo-squatting

ail-typo-squatting ail-typo-squatting è una libreria Python per generare un elenco di potenziali domini typosquatting con un motore di permutazione dei nomi di dominio, per alimentare AIL e altri sistemi. Lo strumento può essere utilizzato come strumento autonomo o per alimentare altri sistemi. S...

dpapi-ng

dpaping - Python DPAPI-NG De-/Encryption Library Library for DPAPI NG, also known as CNG DPAPI, de- and encryption in Python. It is designed to replicate the behaviour of NCryptUnprotectSecret and NCryptProtectSecret. This can be used on non-Windows hosts to de-/encrypt DPAPI NG protected secrets...