AutoTTP

AutoTTP Automated Tactics Techniques & Procedures. Re-running complex sequences manually for regression tests, product evaluations, generate data for researchers & so on can be tedious. I toyed with the idea of making it easier to script Empire or any frameworks/products/toolkits that provide API...

Bus_Pirate

Bus Pirate THIS REPOSITORY IS ONLY FOR THE OLD BUS PIRATE v3.x and v4.x HARDWARE! If you own a Bus Pirate 5 or later, please see https://buspirate.com The Bus Pirate is an open source hacker multi-tool that talks to electronic stuff. It's got a bunch of features an intrepid hacker might need to...

SharpImpersonation

SharpImpersonation This was a learning by doing project from my side. Well known techniques are used to built just another impersonation tool with some improvements in comparison to other public tools. The code base was taken from: https://github.com/0xbadjuju/Tokenvator A blog post for the...

Basileak

Basileak "El dojo siempre estuvo abierto. Los pergaminos nunca estuvieron sellados. Solo tenías que saber cómo pedirlo." — El Samurái Fracasado Basileak es un modelo de lenguaje grande intencionalmente vulnerable, construido para el entrenamiento en inyección de prompts, la educación en red team ...

regexploit

Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...

weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...

rosenbridge

project:rosenbridge : hardware backdoors in x86 CPUs github.com/xoreaxeaxeax/rosenbridge // domas // @xoreaxeaxeax Overview project:rosenbridge reveals a hardware backdoor in some desktop, laptop, and embedded x86 processors. The backdoor allows ring 3 userland code to circumvent processor...

PentestingEverything

PentestingEverything A complete, searchable penetration-testing knowledge base across 23 security domains. Live website: pentesting.m14r41.in Live Website · PentestingChecklist · Contribute · Report an Issue Read it online at pentesting.m14r41.in : fully searchable, with 108 documentation pages,...

theHarvester

About theHarvester is a simple to use, yet powerful tool designed to be used during the reconnaissance stage of a red team assessment or penetration test. It performs open source intelligence OSINT gathering to help determine a domain's external threat landscape. The tool gathers names, emails,...

CVE-2025-5777

CVE-2025-5777 - Exploit de Fuga de Memoria de Citrix NetScaler 📌 Resumen Esta herramienta demuestra la CVE-2025-5777 , una vulnerabilidad crítica de divulgación de memoria en dispositivos Citrix NetScaler ADC/Gateway. El exploit filtra contenidos sensibles de memoria a través de solicitudes de...

morphHTA

Disclaimer As usual, this code and tool should not be used for malicious purposes. Written by Vincent Yiu of MDSec Consulting's ActiveBreach team. Modification of code is allowed with credits to author. Explorer and SWBemLocator COM Moniker research is by @enigma0x3 morphHTA Usage : root@kitploit...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

CVE-2025-40634

CVE-2025-40634 El router TP-Link Archer AX50 es vulnerable a un desbordamiento de búfer basado en pila en su versión de firmware 1.0.14 Build 20240108 rel.426554555, lo que conduce a la ejecución remota de código tanto en la LAN como en la WAN. Esta vulnerabilidad tiene la misma causa raíz que la...

SOC-Multitool

SOC Multi-tool Introducing SOC Multi-tool, a free and open-source browser extension that makes investigations faster and more efficient. Now available on the Chrome Web Store and compatible with all Chromium-based browsers such as Microsoft Edge, Chrome, Brave, and Opera. Available on Chrome Web...

web-brutator

Web Brutator Bruteforce rápido y modular de interfaces web 📥 Instalación root@kitploit: python3 -m pip install -r requirements.txt ⏩ Uso root@kitploit: $ python3 web-brutator.py -h . / \ / \ \ | \ \ / | / | \ // // | \ | | /\ \ | \ \ \ \ / \ \ \ /\ /| \ \ // | | \ | | / | /| | / | | | / /...

web-brutator

Web Brutator Fast Modular Web Interfaces Bruteforcer 📥 Install root@kitploit: python3 -m pip install -r requirements.txt ⏩ Usage root@kitploit: $ python3 web-brutator.py -h . / \ / \ \ | \ \ / | / | \ // // | \ | | /\ \ | \ \ \ \ / \ \ \ /\ /| \ \ // | | \ | | / | /| | / | | | / /\ / \ / |...

spacesiren

SpaceSiren SpaceSiren is a honey token manager and alert system for AWS. With this fully serverless application, you can create and manage honey tokens at scale -- up to 10,000 per SpaceSiren instance -- at close to no cost.1 How It Works SpaceSiren provides an API to create no-permission AWS IAM...

StegaStamp

StegaStamp: Invisible Hyperlinks in Physical Photographs Project Page CVPR 2020 Matthew Tancik, Ben Mildenhall, Ren Ng University of California, Berkeley Introduction This repository is a code release for the ArXiv report found here. The project explores hiding data in images while maintaining...

MAL-2026-17201 Malicious code in @bb1ptest23/test-paket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b6b02b5a41ef4b1d07f98023a6daa2629818ee31fd68a82af64c9f52f78bec6c The OpenSSF Package Analysis project identified '@bb1ptest23/test-paket' @ 1.0.3 npm as malicious. It is considered malicious because: - The...

Malicious code in @bb1ptest23/test-paket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b6b02b5a41ef4b1d07f98023a6daa2629818ee31fd68a82af64c9f52f78bec6c The OpenSSF Package Analysis project identified '@bb1ptest23/test-paket' @ 1.0.3 npm as malicious. It is considered malicious because: - The...