rewerse-engineering

rewerse engineering Un cliente no oficial de la API de REWE en Go y Python. Implementa los endpoints de acceso público sin autenticación que la aplicación REWE utiliza para consultar descuentos actuales Angebote, productos, mercados y retiradas de productos. Versión de APK compatible actual: 5.16...

metasploit-bailiwicked_domain-fix

🚀 metasploit-bailiwickeddomain-fix Corrección paraundefined method each en el módulo bailiwickeddomain.rb de Metasploit CVE-2008-1447, envenenamiento de caché DNS 🔎 Problema Al probar CVE-2008-1447 con Metasploit, el módulo original fallaba con: root@kitploit: undefined method each for an instanc...

ghosthound

GhostHound GhostHound is a BloodHound OpenGraph extension for Active Directory. SharpHound and every other AD collector skip CN=Deleted Objects: deleted objects tombstones are invisible to standard BloodHound attack-path analysis, even though the AD Recycle Bin and tombstone reanimation mechanism...

warcannon

WARCannon - Catastrophically powerful parallel WARC processing WARCannon was built to simplify and cheapify the process of 'grepping the internet'. With WARCannon, you can: Build and test regex patterns against real Common Crawl data Easily load Common Crawl datasets for parallel processing Scale...

warcannon

WARCannon - 灾难级强大的并行WARC处理工具 WARCannon 旨在简化和降低“搜索互联网”这一过程的成本与复杂度。 通过 WARCannon，你可以： 构建并针对真实的 Common Crawl 数据测试正则表达式模式 轻松加载 Common Crawl 数据集以进行并行处理 扩展计算能力，以相当不合理的吞吐量异步处理 WARC 文件 存储并轻松检索结果 工作原理 WARCannon 巧妙利用 AWS 技术实现水平扩展至任意规模，通过竞价实例集群和同区域数据传输降低成本，以惊人速度（每节点高达 100Gbps）从 S3 拉取数据，跨数百个 CPU 核心并行处理，通过...

CVE-2025-54914-PoC

CVE-2025-54914 Azure Route Exploit Resumen Esta es una implementación mejorada de la vulnerabilidad CVE-2025-54914 de enrutamiento de Azure Networking. Esta versión mantiene la funcionalidad principal de la CVE mientras añade más características como persistencia, evasión, escaneo multiobjetivo y...

BugChecker

BugChecker 简介 BugChecker 是一个类似于 SoftICE 的内核和用户调试器，支持 Windows 11（也支持 Windows XP：它支持从 XP 到 11 的 Windows 版本，包括 x86 和 x64）。BugChecker 不需要像 WinDbg 和 KD 那样连接第二台机器到被调试的系统。此版本的 BugChecker（与 20 年前开发的原始版本不同）利用了 NTOSKRNL 中内部且未文档化的 KD API。KD API 允许 WinDbg/KD 执行诸如读/写虚拟内存、读/写寄存器、在地址处设置断点等调用。 相比之下，原始版 BugChecke...

PrintNightmare-CVE-2021-1675-CVE-2021-34527

CVE-2021-1675 / CVE-2021-34527 Implementación de Impacket del PrintNightmare PoC creado originalmente por Zhiniang Peng @edwardzpeng y Xuefeng Li @lxf02942370 Probado en un Controlador de Dominio 2019 completamente parcheado Ejecute DLL maliciosas de forma remota o local Actualización del parche...

unicorn

unicorn Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Magic Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber's powershell attacks and the powershell bypass technique presented by David...

pmotadeee

🧠 FLATLINE - Consciousness Injection Protocol WARNING: This is not a game. It's a cognitive interface for reality hacking. 🎮 HOW TO PLAY Basic Gameplay 1. Download consciousness modules CSV files from this repository 2. Inject directly into AI interfaces as file uploads 3. Experience accelerated...

CVE-2024-57429

CVE-2024-57429 Una vulnerabilidad de falsificación de solicitudes entre sitios CSRF en la función pjActionUpdate de PHPJabbers Cinema Booking System v2.0 permite a atacantes remotos escalar privilegios engañando a un administrador autenticado para que envíe una solicitud no autorizada. Impacto: L...

CTF-s-Tools

Repositorio para indexar herramientas interesantes de Capture The Flag y otras cosas. Tabla de contenidos Plataformas para practicar Criptografía Principal Secundario Hashes Lenguajes esotéricos Esteganografía OSINT Threat Hunting Forensia Reversing Explotación Pentesting Recon Web Exploit Databa...

DeadManSwitch

Dead Man Switch Overview Dead Man Switch is a cross-platform security application written in Rust that automatically protects sensitive data in emergency situations. The application monitors multiple trigger mechanisms and executes immediate system lockdown procedures when activated, including...

ct-exposer

Discover sub-domains by searching through Certificate Transparency logs What is CT? Certificate Transparency CT is an experimental IETF standard. The goal of it was to allow the public to audit which certificates were created by Certificate Authorities CA. TLS has a weakness that comes from the...

CVE-2025-66478

1 root@kitploit: POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Next-Action: x X-Nextjs-Request-Id: b5dce965 Content-Type: multipart/form-data;...

Spring4Shell-Python-Firewall-POC

Python Firewall for Spring4Shell CVE-2022-22965 Mitigation 1. Overview This project is a simple but effective firewall implemented as a Proof-of-Concept POC in Python. It's designed to act as an HTTP server that inspects incoming POST requests to detect and block the specific payload pattern...

CVE-2024-9465

CVE-2024-9465 基于时间的Checkpoint SQL注入攻击 CVE-2024-9465 SHODAN 搜索 root@kitploit: https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" FOFA 搜索 root@kitploit: https://en.fofa.info/ body="Expedition Project" || title="Expedition Project" 使用方法 root@kitploit: python...

Wp2shell-ioc-scanner

wp2shell IOC Scanner Version 1.4.0 · GPL-2.0-or-later · WordPress 6.0+ · PHP 7.4+ A read-only-by-default triage tool for the WordPress core vulnerabilities CVE-2026-60137 and CVE-2026-63030 “wp2shell”. It checks patch state, accounts, durable database artifacts and file integrity, separates...

ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager

Cisco Talos began an investigation after observing a DLL named "verification.google" executing from WebDAV at a Ukrainian government organization. We assess with moderate confidence that the attacks are not targeted at a particular organization, but are a part of a cryptocurrency and...

ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2

Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control C2, retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim's browser session. The actors use a variation on...