gtfocli

GTFOcli GTFOcli it's a Command Line Interface for easy binaries search commands that can be used to bypass local security restrictions in misconfigured systems. Table of Contents Table of Contents Installation Usage Search for Unix binaries Search for Windows binaries Search using dockerized...

ipsourcebypass

This Python script can be used to bypass IP source restrictions using HTTP headers. Features 17 HTTP headers. Multithreading. JSON export with --json outputfile.json. Auto-detecting most successful bypasses...

pcc

PHP Secure Configuration Checker Check current PHP configuration for potential security flaws. Simply access this file from your webserver or run on CLI. Author This software was written by Ben Fuhrmannek, SektionEins GmbH, in an effort to automate php.ini checks and spend more time on cheerful...

CVE-2023-4631

CVE ID : CVE-2023-4631 Vulnerability Type : IP Address Spoofing Description : The DoLogin Security plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 3.6. This is due to insufficient restrictions on where the IP Address information is being retrieved for...

gmailc2

gmailc2 root@kitploit: A Fully Undetectable C2 Server That Communicates Via Google SMTP to evade Antivirus Protections and Network Traffic Restrictions Note: root@kitploit: This RAT communicates Via Gmail SMTP or u can use any other smtps as well but Gmail SMTP is valid because most of the...

403bypasser

403bypasser Türkçe 403bypasser , hedef sayfalardaki erişim kontrolü kısıtlamalarını aşmak için kullanılan teknikleri otomatikleştirir. Bu araç geliştirilmeye devam edecektir, katkılara açıktır. English 403bypasser automates the techniques used to circumvent access control restrictions on target...

Vite server.fs.deny Bypass - Local File Inclusion

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

Oracle Weblogic - Server-Side Request Forgery

An unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services. id: CVE-2014-4210 info: name: Oracle Weblogic - Server-Side Request Forgery author:...

CVE-2023-23752

CVE-2023-23752 Joomla Unauthorized Access Vulnerability CVE-2023-23752 Vulnerability Description Joomla is an open-source content management system CMS, written in PHP, supporting multiple database systems such as MySQL, MSSQL, and PostgreSQL. Improper access restrictions lead to unauthorized...

CVE-2023-23333

Summary: There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. Vendor: SolarView Compact Affected Product: SolarView Compact Version: SolarView Compact =ver 6.00 poc: curl...

setup-wordpress-with-security-best-practice

Setup WordPress With Security Best Practice This document is written with the aim of being suitable for web applications developed using WordPress that do not interact with users. It is primarily intended for corporate brand pages, various static views, recruitment pages, and similar sites. For...

CVE-2023-23752

CVE-2023-23752 - Recurrence of Joomla Unauthorized Access Vulnerability Script Usage Install python libraries pip install -r requirements.txt Vulnerability Verification python3 CVE-2022-26134check.py -u url -c whoami Batch Scan python3 CVE-2023-23752.py -f urlpart.txt Affected Versions 4.0.0 =...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage root@kitploit: usage: java -jar cba-cli.ja...

sandbox-runtime

Anthropic Sandbox Runtime srt Una herramienta de sandboxing ligera para aplicar restricciones de sistema de archivos y red a procesos arbitrarios a nivel del sistema operativo, sin necesidad de un contenedor. srt utiliza primitivas nativas de sandboxing del sistema operativo sandbox-exec en macOS...

domainhunter

Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...

CVE-2025-32462-Exploit

CVE-2025-32462-Exploit: Matrix-Sudo Escape Hostname Spoofing Privilege Escalation CVE-2025-32462 "You take the blue pill... the story ends. You take the red pill... you get root." Description This exploit demonstrates a privilege escalation vulnerability in sudo CVE-2025-32462 where hostname-base...

CVE-2026-86878

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data...

CVE-2026-84625

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to fingerprint the user...

CVE-2026-84551

A logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to bypass network restrictions...

EUVD-2026-77916

An access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data...