keyFinder

KeyFinder Passive API key and secret discovery for Chrome and Firefox KeyFinder is a browser extension for Chrome and Firefox that passively scans every page you visit for leaked API keys, tokens, secrets, and credentials. It runs silently in the background with zero configuration required. What ...

WSSAT

WSSAT - Web Service Security Assessment Tool WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it...

smbmap

SMBMap SMBMap allows users to enumerate samba share drives across an entire domain. List share drives, drive permissions, share contents, upload/download functionality, file name auto-download pattern matching, and even execute remote commands. This tool was designed with pen testing in mind, and...

Security-Detections-MCP

Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime , and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL & native, and Linux step by step...

DeadManSwitch

Dead Man Switch Overview Dead Man Switch is a cross-platform security application written in Rust that automatically protects sensitive data in emergency situations. The application monitors multiple trigger mechanisms and executes immediate system lockdown procedures when activated, including...

CVE-2022-22965

CVE-2022-22965 Spring Framework RCE CVE-2022-22965 Nmap NSE Checker Non-Intrusive This script looks the existence of CVE-2022-22965 Spring Framework 5.2.x / 5.3.x RCE uses a payload "/?class.module.classLoader.definedPackages%5B0%5D=0" through a GET request looking 400 code as response NON...

log4jcheck

Log4j CVE-2021-44228 checker Multithreaded checks a list of URLs with POST and GET requests in combination with parameters. Heavily inspired by NortwaveSecurity version. Set-up URLs to check The list of URLs to check should be in the following format csv: root@kitploit:...

Hipcam-RTSP-Format-Validation-Vulnerability

Hipcam RealServer/V1.0 RTSP Format Validation Vulnerability Proof-of-Concept | CVE-2023-50685 Proof-of-Concept for RTSP Service Format Validation Vulnerability in Hipcam RealServer/V1.0. Description This POC exploits a format validation vulnerability in the Real Time Streaming Protocol RTSP servi...

CallbackHell

CallbackHell Exploit for CVE-2021-40449 Win32k - LPE CallbackHell Description Technical Writeup PoC References Description CVE-2021-40449 is a use-after-free in Win32k that allows for local privilege escalation. The vulnerability was found in the wild by Kaspersky. The discovered exploit was...

run-gemini-cli

run-gemini-cli Overview run-gemini-cli is a GitHub Action that integrates Gemini into your development workflow via the Gemini CLI. It acts both as an autonomous agent for critical routine coding tasks, and an on-demand collaborator you can quickly delegate work to. Use it to perform GitHub pull...

GDA-android-reversing-Tool

ˇ GDAGJoy Dex Analyzer GDA, an powerful Dalvik bytecode decompiler implemented in C++, which has the advantages of fast analysis and low memory&disk consumption and an stronger ability to decompiling the apk, dex, odex, oat, jar, class, aar files. GDA is completely native software and works witho...

discover

root@kitploit: Custom bash scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Kali Linux or Ubuntu. Lee Baird @discoverscripts Jay "L1ghtn1ng" Townsend @jaytownsend1 Jason Ashton @ninewir...

tartufo

...

bantam

Bantam An advanced PHP backdoor management tool, with a lightweight server footprint, multi-threaded communication, and an advanced payload generation and obfuscation tool. Features end to end encryption with request unique encryption keys, and payload streaming designed to bypass WAF, IDS, SIEM...

cryptomator

Supporting Cryptomator Cryptomator is provided free of charge as an open-source project despite the high development effort and is therefore dependent on donations. If you are also interested in further development, we offer you the opportunity to support us: One-time or recurring donation via...

CVE-2020-24033

The latest version of fs.com S3900 24T4S 1.7.1 and all previous version, CSRF backstage admin The form does not have a authentication or token authentication mechanism, so there is a Cross-Site Request Forgery Add user account to add an user with full access. All form on the S3900 24T4S are subje...

xnu

What is XNU? XNU kernel is part of the Darwin operating system for use in macOS and iOS operating systems. XNU is an acronym for X is Not Unix. XNU is a hybrid kernel combining the Mach kernel developed at Carnegie Mellon University with components from FreeBSD and a C++ API for writing drivers...

offensive-ai-compilation

Offensive AI Compilation A curated list of useful resources that cover Offensive AI. 📁 Contents 📁 🚫 Abuse 🚫 🧠 Adversarial Machine Learning 🧠 ⚡ Attacks ⚡ 🔒 Extraction 🔒 ⚠️ Limitations ⚠️ 🛡️ Defensive actions 🛡️ 🔗 Useful links 🔗 ⬅️ Inversion or inference ⬅️ 🛡️ Defensive actions 🛡️ 🔗 Useful links 🔗 💉...

ExportHider

ExportHider ExportHider generates a C++ DLL template which contains a code stub that allows you to hide Exported Functions from the Export Directory of the DLL on the filesystem. After putting the function definitions and compiling the file, you won't see the hidden export functions through PE Fi...

ssrfuzz

SSRFUZZ SSRFuzz is a tool to find Server Side Request Forgery vulnerabilities, with CRLF chaining capabilities Why? I wanted to write a tool in Golang for concurrency I wanted to fuzz parameters for SSRF vulnerablities, as well as fuzz both paths and parameters for CRLF injections I was inspired ...