CVE-2024-21534

CVE-2024-21534: Remote Code Execution Vulnerability in jsonpath-plus =10.0.7 Summary This repository contains a Proof of Concept PoC exploit for a critical Remote Code Execution RCE vulnerability in the jsonpath-plus package, affecting versions prior to 10.0.7. The issue stems from improper input...

clone_and_pwn

Headers Exploit Title: Clone and Pwn Date: June 4th, 2018 Exploit Author: Alejandro Caceres Vendor Homepage: https://git-scm.com/ Software Link: https://git-scm.com/downloads Version: arbitrary code is executed on git client versions In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15....

arya

Arya - The Reverse YARA Arya is a unique tool that produces pseudo-malicious files meant to trigger YARA rules. You can think of it like a reverse YARA because it does exactly the opposite - it creates files that matches your rules. You can read more about Arya and how it works in our blog. Intro...

wappalyzer-next

Wappalyzer Next This project is a command line tool and python library that uses the Wappalyzer browser extension and its fingerprints to detect technologies. Other projects that emerged after the discontinuation of the official open-source project are using outdated fingerprints and lack accurac...

CiclopeClic

CiclopeClic Controlled AI-driven security awareness tool Welcome to CiclopeClic! 🔐 Imagine having the power to generate secure, personalized links for ethical phishing campaigns at your fingertips. That's CiclopeClic! Our tool is revolutionizing how security teams conduct controlled phishing test...

nosqli

NoSQL Injector A fast NoSQL scanner and injector. For finding sites vulnerable to NoSQL injection, Mongo in particular. About Nosqli I wanted a better nosql injection tool that was simple to use, fully command line based, and configurable. To that end, I began work on nosqli - a simple nosql...

droopescan

droopescan A plugin-based scanner that aids security researchers in identifying issues with several CMS. Usage of droopescan for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume n...

heappy

🙂 Heappy: a happy heap editor Heappy is an editor based on gdb/gef that helps you to handle the heap during your exploitation development. The project should be considered a didactic tool useful to understand the evolution of the heap during the process life cycle. It has been created to simplify...

ThreatPad

ThreatPad A collaborative, real-time note-taking platform built for Cyber Threat Intelligence CTI and security operations teams. ThreatPad combines the speed of modern productivity tools with CTI-specific capabilities: IOC auto-extraction, STIX 2.1 export, structured threat templates, and...

AWE

AWE: Adaptive Agents for Dynamic Web Penetration Testing Akshat Singh Jaswal · Ashish Baghel Accepted at NDSS LAST-X 2026 Abstract Modern web applications are increasingly produced through AI-assisted development and rapid no-code deployment pipelines, widening the gap between accelerating softwa...

CipherGist

If you find this GitHub repo useful, please consider giving it a star! ⭐️ 🛡️ CipherGist - End-to-End Encrypted Messaging via GitHub Gists CipherGist is a lightweight, secure, and open-source encrypted messenger that enables private communication using GitHub Gists as the backend. It leverages NaCl...

urlcrazy

😜⌨ URLCrazy URLCrazy is an OSINT tool to generate and test domain typos or variations to detect or perform typo squatting, URL hijacking, phishing, and corporate espionage. Homepage: https://github.com/urbanadventurer/urlcrazy 🌟 Use Cases Detect typo squatters profiting from typos on your domain...

DELTA

DELTA: SDN SECURITY EVALUATION FRAMEWORK What is DELTA? DELTA is a penetration testing framework that regenerates known attack scenarios for diverse test cases. This framework also provides the capability of discovering unknown security problems in SDN by employing a fuzzing technique...

xssmap

2020.08.20 update There are still a lot of bugs, so I'll take the time to fix them soon, so please keep updating. XSSMAP Detect XSS vulnerability in Web Applications Usage mimics sqlmap, and if you know sqlmap, you can easily handle xssmap! 中文介绍 Screenshots Easy Installation As simple as below,...

CVE-2025-58434-poc

CVE-2025-58434 — Flowise Account Takeover via Token Disclosure ⚠️ This repository is for educational and authorized security research only. Unauthorized use against systems you do not own or have explicit permission to test is illegal. Table of Contents Overview Vulnerability Details Attack Flow...

ThreatDetect

ThreatDetect ThreatDetect is a Streamlit-based insider threat detection prototype that analyzes employee activity data and flags potentially risky behavior. It uses a trained XGBoost classifier together with an Isolation Forest anomaly detector to produce organisation-level risk summaries and...

cve-2025-32462

cve-2025-32462 sudo/NEWS at SUDO188 · sudo-project/sudo · GitHub The sudo -h --host documentation states that -h can only be used with -l. In later updates, sudo -h was allowed to be used with -e, -i, etc. sudo --host-h -l--list /etc/sudoer.d is used to check what permissions a user has on a...

femida

Femida-xss WIP An automated blind-xss search plugin for Burp Suite. Installation Git clone https://github.com/wish-i-was/femida.git Burp - Extender - Add - find and select blind-xss.py How to use Settings First of all you need to setup your callback URL in field called "Your url" and press Enter ...

token-reverser

Token Reverser Words list generator to crack security tokens. Installation $ git clone https://github.com/dariusztytko/token-reverser.git Example use case 1. You are testing reset password function 2. Reset password token was sent to your email box e.g. 582431d4c7b57cb4a3570041ffeb7e10 3. You...

CVE-2025-32463

CVE-2025-32463 Local Privilege Escalation in Sudo via Malicious nsswitch.conf with sudo -R. Affected versions 1.9.14 – 1.9.17 📘 Introduction Sudo is a widely used command-line utility on Unix-like systems that allows permitted users to execute commands with elevated privileges. It plays a critica...