CVE-2020-1066-EXP

Reference This vulnerability belongs to the Windows CardSpace service that does not properly handle symbolic link objects, leading to a local privilege escalation via arbitrary file replacement. Disclaimer The author's PoC is for research purposes only. If readers use this PoC for other activitie...

Ghazi

Ghazi Ghazi is a BurpSuite Plugins For Testing various PayLoads Like "XSS,SQLi,SSTI,SSRF,RCE and LFI" through Different tabs , Where Each Tab Will Replace Every GET or POST Parameters With Selected TAB in "Proxy" or "Repeater" TAB XSS tab of Ghazi Replacing Every Parameters to XSS PayLoad SSTI...

radmin-vpn-linux

Radmin VPN for Linux Run Radmin VPN on Linux via Wine. Join VPN networks, see peers, play games — all without a Windows VM. I did not build this because it was easier than a VM. I built it because I thought it was easier than a VM. AI-assisted code. Built collaboratively between a human and Claud...

peCloakCapstone

peCloak - Capstone This is a simple fork of SecuritySift's peCloak that uses Capstone. The intention is to provide a fork based on a well-maintained, up-to-date disassembly library and to make the script multi-platform. Here's what I did so far: Replaced pydasm with Capstone Included a patched...

NoLongerEvil-Thermostat

Nest Thermostat Firmware Setup 🏆 FULU Bounty Winner 🏆 Hack House and this project are the official winners of the FULU Bounty for Nest Learning Thermostat Gen 1/2 Hardware Alternative: If you're interested in the hardware side of things, check out https://sett.homes for a drop-in PCB replacement...

privesc-CVE-2010-0426

Sudo 1.6.x=1.6.9p21 and 1.7.x=1.7.2p4 Local Privilege Escalation Sudo su "do" allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Vulnerable environment To setup a vulnerable environment f...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

trojanizer

TROJANIZER Version release : v1.1 Stable Author : pedro ubuntu r00t-3xp10it Codename: TroiaRevisited Distros Supported : Ubuntu, Kali, Mint, Parrot OS Suspicious-Shell-Activity SSA RedTeam develop @2017 FRAMEWORK DESCRIPTION The Trojanizer tool uses WinRAR SFX to compress the two files input by...

CVE-2025-11455

The Perfect Images plugin for WordPress (versions up to and including 7.2.0 ) is vulnerable to unauthorized data modification. The root cause is a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API. This flaw allows authenticated attackers with Author-level access or higher...

CVE-2025-11455 Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement

The Perfect Images plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/wp-retina-2x/v1/replace REST API in all versions up to, and including, 7.2.0 This makes it possible for authenticated attackers, with Author-level access an...

dirtycow-replacer

PLEASE NOTICE I AM NOT FORMALLY TESTING THIS CODE IT IS BEING DESIGNED AS AN EDUCATIONAL TOOL What's it do? android-dirtycow-replacer uses the CVE-2016-5195 dirtycow exploit to patch a list of over 1000 files. You can edit it to be 10000 but 1000 should do. It checks first to make sure the files...

Broadpwn

Broadpwn Help Join or Ask: [email protected] Broadpwn: https://goo.gl/xWC4hg | Youtube: https://youtu.be/GTb4Y2Y9shw BlueBorne: https://goo.gl/PSDuwY | Youtube https://youtu.be/FJGGMyg0W38 Yalu Jailbreak iOS 10.3.1 : https://goo.gl/9cSSPU Help PR. Broadpwn bug CVE-2017-9417 Remotely...

clone-cert

clone-cert.sh This is a simple shell script that retrieves the X.509 certificate associated with a TLS wrapped TCP port and uses openssl to create a similar certificate by replacing the public key and fixing the signature. This is particularly useful if you want to demonstrate why self-signed...

sudo_digest_toctou_poc_CVE-2015-8239

sudoers DigestSpec TOCTOU POC Rationale Alyssa Milburn https://twitter.com/noopwafel discovered a TOCTOU race condition bug in sudo when the DigestSpec setting is used. The DigestSpec setting can be used to allow a user to sudo a binary if and only if its hash matches a prescribed value. See man...

CVE-2016-6914-UniFiVideo-LPE

CVE-2016-6914 - Ubiquiti UniFi Video 3.7.3 LPE PoC 🔥 Overview This repository contains a proof-of-concept PoC for CVE-2016-6914 , a Local Privilege Escalation LPE vulnerability affecting Ubiquiti UniFi Video 3.7.3. An attacker with low privileges can replace a trusted binary taskkill.exe inside...

Liferay Portal - Open Redirect

HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' U+FFFD, which allows remote...

CVE-2024-10449-patch

Patch for CVE-2024-10449 https://nvd.nist.gov/vuln/detail/CVE-2024-10449 Steps: Download the patched loginAction.php file from this repository https://raw.githubusercontent.com/g-u-i-d/CVE-2024-10449-patch/refs/heads/main/loginAction.php and replace the vulnerable version with this one. Edit the...

hiya

Hiya Fingerprint authentication for Linux. Handles sudo, su, polkit, screen unlock, SSH keys, and browser passkeys from a single enrollment. Replaces fprintd. Works with existing DEs without patching them. Requirements libfprint-supported fingerprint sensor Linux with PAM, systemd, D-Bus TPM 2.0...

TinyProcessor

TinyProcessor This project replaces syscall numbers & arguments in Tinytracer's .tag output w/ their actual Nt function declarations for better readability. Do note that some functions declarations are not included, so some arguments will not be processed The function declarations I use in this...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...