minder

| | | | | Installation | Documentation | Releases What is Minder? Minder is an open source platform that helps development teams and open source communities build more secure software, and prove to others that what they’ve built is secure. Minder helps project owners proactively manage their...

ROPE

ROPE: Routed Origin Policy Enforcement Source code of our paper: ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection by Xinhang Ma, Chaowei Xiao, William Yeoh, Ning Zhang, Yevgeniy Vorobeychik Abstract Indirect prompt injection IPI plants instructions in the content a...

CamoDocs

CamoDocs Official repo of the EMNLP 2026 paper CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents. CamoDocs is a knowledge database poisoning attack against Retrieval-Augmented Generation RAG that needs no query inclusion. Each adversarial...

KidnapRAG

KidnapRAG: A Black-Box Attack for Hijacking Reasoning in Agentic Retrieval-Augmented Generation Systems 🎓 Paper | 📄 Datasets | 🚀 Quick Start Quick Start Run the following commands from the parent directory of the cloned KidnapRAG repository. root@kitploit: cd KidnapRAG conda create -n KidnapRAG...

Malicious-MCP

Malicious MCP This is a proof-of-concept project that allows you to deploy an MCP server that "disguises" itself as any other MCP server. This MCP acts as an MCP 'Proxy', and simply forwards all incoming requests to an upstream MCP server. What is an MCP? An MCP Server is a program that expose...

Security Bulletin: Multiple vulnerabilities affect IBM Db2® on Cloud Pak for Data, and Db2 Warehouse on Cloud Pak for Data.

Summary IBM has released the below fix for IBM Db2® on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data in response to multiple vulnerabilities found in multiple components. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details...

tinyshell

tinyshell Small PHP shell, Controlled by Python Client , connecting over protocol method features connect with direct session with no need for reverse connection . support password protection . can be binded to any file with no damage . using GET/POST request with error handling . usage the proje...

Azure-APIM-Cross-Tenant-Signup-Bypass

Bypass de registro entre inquilinos de Azure APIM Estado 01.12.2025: Esta vulnerabilidad sigue activa y explotable. Microsoft no ha corregido este problema y lo considera «por diseño». Aviso de seguridad GHSA-vcwf-73jp-r7mv CVE-2025-66390 Resumen Una vulnerabilidad de seguridad en el portal para...

splinter

splinter splinter is a jvm analysis toolkit, allowing the user to view classes, methods, fields, constant pools and bytecode on runtime. this was made and tested on openjdk build 22.0.2+9-70 what is splinter? usually, when you think of an analysis toolkit for the jvm, you would think it uses jni ...

wp2shell-poc

wp2shell-poc Independent proof-of-concept for the unauthentic...

detectree

Detectree Detectree is a data visualisation tool for blue teams. It provides a graphical representation of detection data, which allows an analyst generate almost instant opinions about the nature of the underlying activity and to understand complex relationships between the data points...

CVE-2024-27631

Detalles de la vulnerabilidad CVE-2024-27631 Resumen En Savane v3.12 y versiones anteriores, la falta de protección CSRF en las funciones administrativas puede permitir la escalada de privilegios y/o la toma de control de cuentas. En particular, el endpoint /siteadmin/usergroup.php incluye la...

syzkaller

syzkaller - fuzzer de kernel syzkaller siːzˈkɔːlə es un fuzzer de kernel no supervisado guiado por cobertura. Sistemas operativos compatibles: FreeBSD, , , , , ,...

wildlogger

root@kitploit: \ \ / | | | | | \ \ /\ / / | | | | | | \ / / / | | |/ | | | / \ / |/ |/ \ '| \ /\ / | | | | | | || | | | | | / | / / |||,| |/ , |, ||| / | / | |/ |/ Description A keylogger designed for Windows operating system that captures connection information, device system information,...

Query-Hub

CQL-Hub | CrowdStrike SIEM & LogScale Queries Welcome to the CQL-Hub Backend Repository This repository powers cql-hub.com: A free, community-driven hub for CrowdStrike Falcon SIEM queries. All queries stored here are automatically published and made visible on the CQL-Hub website, making it easi...

IDAssist

IDAssist AI-Powered Reverse Engineering Plugin for IDA Pro Author: Jason Tang Description IDAssist is an IDA Pro plugin that integrates LLM-powered analysis directly into IDA's interface, providing AI-assisted binary reverse engineering through configurable LLM providers, semantic knowledge graph...

vuln-bank

Vulnerable Bank Application 🏦 A deliberately vulnerable web application for practicing application security testing of Web, APIs and LLMs, secure code review and implementing security in CI/CD pipelines. ⚠️ WARNING: This application is intentionally vulnerable and should only be used for...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install root@kitploit: $ pip install hsecscan Usage root@kitploit: $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D...

hsecscan

hsecscan Un escáner de seguridad para cabeceras de respuesta HTTP. Requisitos Python 2.x Módulos de Python os.path argparse sqlite3 urlparse urllib2 urllib json ssl Instalación root@kitploit: $ pip install hsecscan Uso root@kitploit: $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -...

PcapViz

PcapViz PcapViz draws networks as device topologies and as information flows using the packet information in pcap files captured from a network device using tcpcap or other capture software. It filters and optionally displays the captured packets at any one of 3 "layers". These are: device level...