auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...

LLM4Decompile

📊 Results | 🤗 Models | 🚀 Quick Start | 📚 HumanEval-Decompile | 📎 Citation | 📝 Paper | 🖥️ Colab | ▶️ YouTube Reverse Engineering: Decompiling Binary Code with Large Language Models Updates 2025-10-04: Release SK²Decompile: LLM-based Two-Phase Binary Decompilation from Skeleton to Skin. Phase 1...

auto-re-agent

re-agent Autonomous reverse-engineering agent — source-aware reverser/checker loop, objective verifier, parity engine, and Ghidra backend. Overview Demo: YouTube re-agent automates a reverse-engineering workflow by combining a reverser/checker loop with Ghidra decompilation through...

cerberus-re-skill

Cerberus RE cerberus-re is a local Apple-focused reverse-engineering workbench for building a repeatable three-headed static/dynamic/instrumentation loop around Ghidra, LLDB, and Frida. It is designed for analysts and coding agents that need durable artifacts instead of terminal-only notes: Ghidr...

fim-ebpf

FIM-eBPF: File Integrity Monitoring with eBPF A lightweight eBPF program to monitor file creation and modification events on Linux. This tool leverages eBPF Extended Berkeley Packet Filter to trace file operations directly from the kernel, providing high-performance monitoring with minimal...

no-gdid

no-gdid Read, understand, and silence the Windows Global Device Identifier GDID — the hidden per-account device ID that helped the FBI locate a suspect who was using a VPN. ⚠️ Honest disclaimer up front: this tool does not erase your GDID and does not make you anonymous. The GDID lives on...

usbsnoop

usbsnoop — live USB transfer sniffer from two fentry hooks A real-time, colorized feed of USB traffic system-wide — built on the two universal URB chokepoints every host-controller driver funnels through, so it works on xHCI/EHCI/OHCI/dwc alike with no per-controller tracepoints and no usbmon...

POC-CVE-2018-0114

CVE-2018-0114 POC A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for JSON...

DarkAgent

This is an opensource Remote Administration Tool originally started/written by DragonHunter at http://www.hackforums.net/showthread.php?tid=708624 He has since moved on and the source and hosting for the project have disappeared, so being that it is opensource, I thought I would post it here for...

krie

KRIe KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a bulletproof strategy: from eBPF related limitations to post exploitation detections that might rely on a compromised kernel to emit security events, it is clear that a motivated attacker...

CVE-2018-0114

CVE-2018-0114 before 0.11.0 unathenticated remote attacker can re-sign using a key embeded in token. https://www.cvedetails.com/cve/CVE-2018-0114/...

powersap

PowerSAP PowerSAP is a simple powershell re-implementation of popular & effective techniques of all public tools such as Bizploit, Metasploit auxiliary modules, or python scripts available on the Internet. This re-implementation does not contain any new or undisclosed vulnerability. PowerSAP allo...

CVE-2018-0114

CVE-2018-0114 Exploit for Node-jose 0.11.0 written in Ruby Usage just input victim name into code and run the file via ruby ./exploit.rb A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is...

CVE-2018-0114-Exploit

CVE-2018-0114-Exploit A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature JWS standard for...

CVE-2026-93687

braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError...

TwoMillion-Machine-Writeup

About Machine TwoMillion is an Easy difficulty Linux box that was released to celebrate reaching 2 million users on HackTheBox. The box features an old version of the HackTheBox platform that includes the old hackable invite code. After hacking the invite code an account can be created on the...

Caddy: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass

Caddy v2.11.3 — Three vulnerabilities in handler/placeholder layer Tested against: caddy:2.11.3 official Docker image, SHA verified at runtime Reproduction environment: Docker Desktop 4.73.1 / Engine 29.4.3 on Windows 10 host, isolated containers, no network egress required for any of the exploit...

CVE-2026-47423-dompurify-xss-detector

DOMPurify 的重新克隆逻辑缺陷。 该工具不依赖容易被剥离的源码注释或版本变量，而是通过逻辑指纹识别技术分析压缩的生产环境 JavaScript 包，识别未修补的允许标签配置。 漏洞概要 在 DOMPurify 版本 3.4.4 及之前， 元素默认被允许。这引入了一个逻辑缺陷：Chromium/WebKit 浏览器会在 DOMPurify 完成消毒处理后，刷新并重新克隆 子树，导致当负载被注入实时 DOM 时，发生绝对 XSS 绕过。 功能特性 框架无关（适用于 React、Vue、Angular 或原生 JS 包结构） 从根路径自动解析动态 JS 资源...

CVE-2026-86800 WP Ghost (Hide My WP Ghost) < 7.0.11 - Unauthenticated URL Hiding Bypass via Loopback Compatibility Check

The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login and URL hiding protection, dropping that protection precisely when the request's verification value is missing or incorrect, which any visitor can arrange,...

CVE-2026-86796 WP Ghost (Hide My WP Ghost) 7.0.10 - Unauthenticated Firewall, Threat Detection and URL Hiding Bypass via WooCommerce Request Parameters

The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its firewall, threat-detection and login/URL-hiding protections, treating the mere presence of an attacker-suppliable request parameter as sufficient, which allows...