66310 matches found
CVE-2023-39361
CVE-2023-39361 Unauthenticated SQL injection in Cacti v1.2.24 Overview Cacti is an open-source operational monitoring tool written in PHP, MySQL/MariaDB, which provides a friendly interface. The vulnerability was found in 2023 which affected all versions before 1.2.24. This security flaws lies in...
peeping-tom
peeping-tom Remote keylogger for Windows written in C++ Welcome to the peeping-tom project repo! Peeping-tom is a two-part program with a peeping-client deployed on a target and a toms-server listening for keylogs on the attacker machine. Getting up and running requires a decent amount of set up,...
PolinRider
PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos Date: 2026-03-07 Last updated: 2026-04-11 — see April 10–11 Update below Severity: CRITICAL — active supply chain infection across 1,950+ public repositories, confirmed operational merger with the TasksJacker / Contagious...
AutoNessus
AutoNessus This script communicates with the Nessus API in an attempt to help with automating scans. Depending on the flag issued with the script, you can list all scans, list all policies, start, stop, pause, and resume a scan. It may be helpful to create a cron job/scheduled task for automating...
endgame
ENDGAME C2 FRAMEWORK ENDGAME is a professional command and control framework built for authorized red team engagements, penetration testing, and educational security research. Designed to simulate realistic adversary techniques, assess detection coverage, and help security teams understand their...
gemma_crackme_tutorial
Using Google's Gemma 4 E4B local AI model to Reverse Engineer a simple Crackme I was playing around with the new Gemma E4B open weights local model which Google released, and to my surprise I was seeing a great deal of success in using it for local offline reverse engineering scenarios. I wanted ...
Maverick
Maverick An Adaptix C2 agent built with Crystal Palace — a custom PIC Position Independent Code linker and PICO module system. Demonstrates how to build modular shellcode agents where each component transport, tasks, obfuscation is a separate PICO blob loaded at runtime. Note This agent does not...
CVE-2025-60710
CVE-2025-60710 This is PoC for local privilege escalation vulnerability in \Microsoft\Windows\WindowsAI\Recall\PolicyConfiguration scheduled task. When this scheduled task is started the taskhostw.exe process whill try to open the C:\Users%username%\AppData\Local\CoreAIPlatform.00\UKP directory...
log4j
CVE-2021-44228 a.k.a. LOG4J This is a public repository from Wortell containing information, links, files and other items related to vulnerabilities related to Log4j Due to vulnerabilities in log4j 2.17.0 it is now recommended to patch to version 2.17.1 Knows CVEs CVE| Score| Description...
mobsfscan
mobsfscan mobsfscan is a static analysis tool that can find insecure code patterns in your Android and iOS source code. Supports Java, Kotlin, Android XML, iOS Info.plist, Swift and Objective C Code. mobsfscan uses MobSF static analysis rules and is powered by semgrep and libsast pattern matcher...
glue
OWASP Glue Glue is a framework for running a series of tools. Generally, it is intended as a backbone for automating a security analysis pipeline of tools. Recommended Usage For those wishing to run Glue, we recommend using the docker image because it should have the other tools it uses available...
PeekABoo
PeekABoo PeekABoo tool can be used during internal penetration testing when a user needs to enable Remote Desktop on the targeted machine. It uses PowerShell remoting to perform this task. The tool only works if WinRM is enabled. Since Windows Server 2012 WinRM is enabled by default on all Window...
RemoteKeyStrokes
RemoteKeyStrokes A script to automate keystrokes through an active remote desktop session that assists offensive operators in combination with living off the land techniques. All credits goes to nopernik for making it possible so I took it upon myself to improve it. I wanted something that helps...
on-device-browser-agent
Local Browser - On-Device AI Web Automation Launching support for runanywhere-web-sdk soon in our main repo: please go check it out: https://github.com/RunanywhereAI/runanywhere-sdks A Chrome extension that uses WebLLM to run AI-powered web automation entirely on-device. No cloud APIs, no API key...
malboxes
= Malboxes :toc: preamble :toclevels: 2 :twob: https://twitter.com/obilodeau :twhg: https://twitter.com/hugospns // github stuff ifdef::env-github:github: ifndef::github // local logo image::docs/logos/main.svgMalboxes Logo endif:: ifdef::github // logo on github...
GhostLock-for-OnePlus
GhostLock — OnePlus Kernel exploit targeting locked-bootloader OnePlus devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Table of Contents Vulnerability Overview Supported Devices...
macos-collector
macos-collector macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR macos-collector.sh is a Shell script utilized to collect macOS Forensic Artifacts from a compromised macOS endpoint using primarily Aftermath by Jamf Threat Labs. Download Download the latest version of...
DeepTrap
DeepTrap English | 中文 Open-world security evaluation for OpenClaw agents under adversarial execution contexts. DeepTrap is a security benchmark for evaluating whether OpenClaw agents can complete benign user tasks while resisting malicious execution-context pressure: poisoned workspace files,...
capsule
Capsule Getting Started • Documentation • Issues • Contributing Overview Capsule is a runtime for executing untrusted code in isolated environments. Each task runs inside its own WebAssembly sandbox, providing: Isolated execution : Each task runs isolated from your host system Resource limits : S...