BlueGate

BlueGate PoC for the Remote Desktop Gateway vulnerability - CVE-2020-0609 & CVE-2020-0610. Thanks to ollypwn for pointing out my silly mistake! Setup I'm using a patched version of pydtls as the original repository wouldn't build properly. cd pydtls sudo python setup.py install Denial of Service ...

cve-2022-44268

Exploit tailored for HackTheBox Pilgrimage Automatic python script using cve-2022-44268 to add a profile value with a filename from a input filelist in an input file, update the image file upload using a input request.req file from Burpsuite already included of the file upload uploading each...

CVE-2025-51860

CVE-2025-51860 Vulnerability description TelegAI, a web application for constructing and chatting with AI Characters, is vulnerable to Stored Cross-Site Scripting XSS in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by craftin...

extended-xss-search

Extended XSS Searcher and Finder This is the extended version based on the initial idea already published as "xssfinder". This private version allows an attacker to perform not only GET but also POST requests. Additionally its possible to proxy every request through Burp or another tunnel. First...

Fastgate

TLDR This is a brief report of a vulnerability CVE-2019-12489 discovered playing around with a Fastgate modem/router of Fastweb and Ghidra. The vulnerability allow the execution of a command injection through an http request and can be used to enable an SSH shell. Firmware collection and extracti...

CVE-2024-36991

CVE-2024-36991 - Splunk Path Traversal Proof of Concept for CVE-2024-36991 which allows an attacker to read arbitrary files in Splunk for versions below to 9.2.2, 9.1.5, and 9.0.10 for Windows. Usage Read Splunk configuration files To read Splunk files just run the script passing the target URL...

rbuster

Rbuster yet another dirbuster Common Command line options -a - specify a user agent string to send in the request -c - use this to specify any cookies that you might need simulating auth. header. -f - force processing of a domain with wildcard results. -l - show the length of the response. -r...

rbuster

Rbuster أداة dirbuster أخرى خيارات سطر الأوامر الشائعة -a - حدد سلسلة وكيل المستخدم لإرسالها في الطلب -c - استخدم هذا لتحديد أي ملفات تعريف ارتباط قد تحتاجها محاكاة المصادقة. -f - فرض معالجة نطاق بنتائج بطاقة بدل. -l - عرض طول الاستجابة. -r - اتبع عمليات إعادة التوجيه. -s - مجموعة مفصولة...

evilgrade

Faraday Security Research -- | ISR-evilgrade | www.faradaysec.com | -- .:: BRIEF OVERVIEW ::. Evilgrade is a modular framework that allows the user to take advantage of poor upgrade implementations by injecting fake updates. It comes with pre-made binaries agents, a working default configuration...

evilgrade

Faraday Security Research -- | ISR-evilgrade | www.faradaysec.com | -- .:: نظرة عامة موجزة ::. Evilgrade هو إطار معياري يسمح للمستخدم بالاستفادة من تطبيقات الترقية الضعيفة عن طريق حقن تحديثات وهمية. يأتي مع برامج ثنائية معدة مسبقًا عوامل، وتكوين افتراضي جاهز لاختبارات الاختراق السريعة، وله خادم...

Ducky-Exploit

Ducky-Exploit Introduction Ducky Exploit is python framework which helps as to code Digispark as Rubber Ducky This script has been tested on Kali Linux 18.2 Ubuntu 18.04 Windows Works with both Python2 and Python3 Keyboard Support Type US Type Keyboard Usage git clone...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

morty

Morty وكيل تعقيم محتوى الويب كخدمة يقوم مورتِي بإعادة كتابة صفحات الويب لاستبعاد علامات HTML والخصائص الضارة. كما يستبدل المراجع الخارجية للموارد لمنع تسرب المعلومات من طرف ثالث. الهدف الرئيسي لمورتِي هو توفير وكيل نتائج لـ searx، ولكن يمكن استخدامه أيضًا كخدمة تعقيم مستقلة. الميزات: تعقيم HTML...

TransitionPlayer

This issue has been fixed for Android 14+ in June 2026 Android Security Bulletin. Click here to see the patch Writeup TODO I'll complete the writeup when I got a little free time But before that I have to fight against school work and exams I decided to complete the section before exams are...

LazyPorts

LazyPorts Visual port manager for Linux lazyports is a terminal UI tool to visualize and manage network ports. It provides an interactive table to inspect listening processes and kill them easily. Built with Bubble Tea and Lipgloss. Prerequisites Go 1.24 or higher required for installation...

kimi

kimi - Malicious Debian Package generator Script to generate malicious debian packages debain trojans. About & Plus points & Usage & Tested On ::: Kimi is name inspired from "Kimimaro" one of my favriote charater from anime called "Naruto". Kimi is a script which generates Malicious debian packag...

RTA

Red Team Automation RTA RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK. RTA is composed of python scripts that generate evidence of over 50 different ATT&CK tactics, as well as a compil...

Mega-Bot

Mega Bot ☣ Scanner & Auto Exploiter What's Mega Bot ? from MegaBot import print """ Tool Scanner Tool Auto Exploiter """ About Mega Bot from MegaBot import print """ +----------------------------------+----------------------------------+ 1 X4PriV8 V1 | 22 XAttacker 2.5 official 2 AUto FixerFor...

CVE-2016-10033

CVE2016-10033 explotation PoC This repository holds the necessary files to exploit CVE2016-10033 on a vulnerable version of WordPress. With these instructions you will be able to get a reverse interactive shell not Pseudo-TTY in the container that is running the WordPress as the user that is...

pi-hole

Blocage de publicités à l'échelle du réseau via votre propre matériel Linux Pi-hole® est un trou noir DNS qui protège vos appareils des contenus indésirables sans installer de logiciel côté client. Facile à installer : nos dialogues vous guident tout au long du processus d'installation simple en...