skewrun

Skewrun skewrun is an Active Directory time discovery toolkit for red teams. It dynamically resolves the Domain Controller's time via network protocols CLDAP, SMB, NTP, Kerberos, NTLM and executes commands via libfaketime LDPRELOAD, tricking the executed binary into using the exact DC time. This...

TotalRecall

TotalRecall Reloaded Breaking Windows Recall. Again. image When Microsoft redesigned Recall with VBS enclaves, AES-256-GCM encryption, Windows Hello authentication, and a Protected Process Light host, the message was clear: the data is locked in a vault. The vault is solid. The delivery truck is...

jadx-ai-mcp

JADX-AI-MCP Part of Zin MCP Suite ⚡ Fully automated MCP server + JADX plugin built to communicate with LLM through MCP to analyze Android APKs using LLMs like Claude — uncover vulnerabilities, analyze APK, and reverse engineer effortlessly. ⭐ Contributors Thanks to these wonderful people for thei...

DarkWidow

DarkWidow A Customizable Dropper Tool targeting Windows. Honourable Mentions: 1. BlackHat Asia, 2024 - Call For Tools 2. BlackHat USA, 2024 - Call For Tools 3. BlackHat SecTor, 2024 - Call For Tools 4. BlackHat Europe, 2024 - Call For Tools 5. Wild West Hacking Fest 2024 - Arsenal Thanks a lot to...

CVE-2024-55968

CVE-2024-55968 LPE Exploit POC for CVE-2024-55968 Vulnerablity Description The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC inter-process communication IPC...

CVE-2017-9101

PlaySMS 1.4 authenticated RCE Simple method of performing remote code execution through the Phonebook CSV upload issue as described on ExploitDB. Either run a single command: root@kitploit: % python3 playsmshell.py --url http://localhost/playsms --password playwithsms -c 'id' Grabbing CSRF token...

raven

Raven - Advanced Cyber Threat Map Simplified, customizable and responsive. It uses D3.js with TOPO JSON, has 247 countries, 100,000 cities, and can be used in an isolated environment without external lookups!. Structure Offline - Demo Firefox, Chrome or Safari Live - Regression 500 attacks at onc...

CVE-2023-32571-POC

Dynamic Linq injection to RCE - CVE-2023-32571 About Dynamic Linq injection to RCE CVE-2023-32571 Recently, members of the NCC Group discovered a vulnerability in Dynamic Linq that allows attackers to call C functions through a Linq Injection, thus making it possible to obtain RCE. Even with the...

silph

SILPH: Stealthy In-Memory Local Password Harvester SILPH is an open-source red team tool designed to dump LSA secrets, SAM hashes, and DCC2 credentials entirely in memory, without writing any files to disk. Unlike its upstream project go-secdump , SILPH is built to be integrated into the Orsted C...

shodan-dorks

Shodan dorks Description: This GitHub repository provides a range of search queries, known as "dorks," for Shodan, a powerful tool used to search for Internet-connected devices. The dorks are designed to help security researchers discover potential vulnerabilities and configuration issues in...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

MalSeclogon

MalSeclogon A little tool to play with the Seclogon service. Full technical details at: https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-2.html https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html Usage root@kitploit: MalSeclogon v0.2 @splintercode Args:...

Steganography

Steganography Table of Contents Installation Byte Sequence Manipulation WavSteg LSBSteg StegDetect If you are unfamiliar with steganography techniques, I have also written a basic overview of the field in Steganography: Hiding Data Inside Data. Installation This project is on PyPI and can be...

sitrep

SitRep Extensible, configurable host triage. Purpose SitRep is intended to provide a lightweight, extensible host triage alternative. Checks are loaded dynamically at runtime from stand-alone files. This allows operators to quickly modify existing checks, or add new checks as required. Checks are...

r4ven

If you find this GitHub repo useful, please consider giving it a star! ⭐️ ▶️ Watch Video - How To Use! This project is a security research and awareness tool designed to demonstrate how modern web browsers may expose location data, camera access, IP address, and device information when users...

shodanwave

Shodanwave Shodanwave is a tool for exploring and obtaining information from cameras specifically Netwave IP Camera. The tool uses a search engine called shodan that makes it easy to search for cameras online. What does the tool to? Look, a list! Search Brute force SSID and WPAPSK Password...

gringotts

CVE-2020-0601 proof of concept A fun proof of concept to create your own root CA and signed certificate based on the CVE-2020-0601 vulnerability in Windows 10. The basis for the issue is the CertGetCertificateChain method improperly validated root certificate authorities. Since the search for a...

CVE-2021-1675-CVE-2021-34527

CVE-2021-1675 - PrintNightmare LPE PowerShell Caleb Stewart | John Hammond | July 1, 2021 CVE-2021-1675 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare." Proof-of-concept exploits have been released Python, C++ for the remote code execution...

RootRemover

!WARNING Only use this on systems you own or have authorisation to test. RootRemover CVE-2026-31431 Temporarily removes the root password, uses CVE-2026-31431 to allow architecture-independent escalation to root without knowing the current user's password. Please use responsibly, only on systems...

mylg

myLG, Command line Network Diagnostic Tool myLG is an open source software utility which combines the functions of the different network probes in one network diagnostic tool. Features Popular looking glasses ping/trace/bgp: Telia, Level3, NTT, Cogent, KPN More than 200 countries DNS Lookup...