CVE-2020-1958

CVE-2020-1958 PoC CVE-2020-1958 is high severity LDAP injection vulnerability in Apache Druid 0.17.0. It allows an attacker to bypass LDAP search filter and to retrieve any LDAP attribute values of users that exist on the LDAP server. From official Apache Druid advisory: When LDAP authentication ...

FaceBrute

FaceBrute Facebook brute force script This script tries to guess passwords for a given facebook account using a list of passwords dictionary. Since facebook temporaly blocks access to accounts that continously fail to login, this script is coded so that it waits a specified amount of time when th...

yealink_tools

Yealink firmware reverse engineering This repository contains some script utilities used during the reverse engineering of Yealink VOIP phones firmware. For more information about this research, please read the blogpost...

detect_bluekeep.py

detectbluekeep.py Python script to detect bluekeep vulnerability - CVE-2019-0708 - with TLS/SSL support Work derived from the Metasploit module written by @zerosum0x0 https://github.com/zerosum0x0/CVE-2019-0708 RC4 taken from https://github.com/DavidBuchanan314/rc4 Prerequisites detectbluekeep.py...

libdlmalloc

libdlmalloc libdlmalloc is a python script designed for use with GDB that can be used to analyse the Doug Lea's allocator, aka dlmalloc. It currently supports dlmalloc 2.8.x versions. Note that some parts can also be used independently GDB, for instance to do offline analysis of some snapshotted...

log4jcheck

Northwave Log4j CVE-2021-44228 checker Friday 10 December 2021 a new Proof-of-Concept 1 addressing a Remote code Execution RCE vulnerability in the Java library 'log4j' 2 was published. This vulnerability has not been disclosed to the developers of the software upfront. The vulnerability is being...

CVE-2026-29057-POC

CVE-2026-29057 — Next.js Request Smuggling Lab This repository is a focused presentation lab for CVE-2026-29057. It compares a vulnerable Next.js target 15.5.12 with the patched release 15.5.13 using the same topology and raw HTTP payload. Use it only in an isolated lab. Request-desynchronization...

CVE-2023-44762_ConcreteCMS-Reflected-XSS---Tags

ConcreteCMS Reflected XSS v.9.2.1 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags. Attack Vectors: Scripting a vulnerability in the sanitization of the ent...

bip

Bip Bip is a project which aims to simplify the usage of python for interacting with IDA. Its main goals are to facilitate the usage of python in the interactive console of IDA and the writing of plugins. In a more general way the goal is to automate recurrent tasks done through the python API. B...

Tallow

Tallow - Transparent Tor for Windows Tallow is a small program that redirects all outbound traffic from a Windows machine via the Tor anonymity network. Any traffic that cannot be handled by Tor, e.g. UDP, is blocked. Tallow also intercepts and handles DNS requests preventing potential leaks...

MassCyberCenter-Mentorship-Project-

MassCyberCenter-Mentorship-Project- Overview This repository documents my journey and deliverables during the MassCyber Center mentorship program. This mentorship program tasked us with completing a cybersecurity project and then presenting it at a showcase event attended by cybersecurity...

wa-tunnel

wa-tunnel - TCP Tunneling through Whatsapp This is a Baileys based piece of code that lets you tunnel TCP data through two Whatsapp accounts. This can be usable in different situations, for example network carriers that give unlimited whatsapp data or airplanes where you also get unlimited social...

CVE-2026-19586

CVE-2026-19586 PoC TP-Link Omada SSL VPN Unauthenticated RCE CVE-2026-19586 Overview A command injection vulnerability CWE-78 in the SSL VPN authentication path of TP-Link Omada gateway firmware allows an unauthenticated attacker to execute arbitrary commands as root. When the OpenVPN-based SSL V...

CVE-2025-2783

CVE-2025-2783 Simulated PoC for CVE-2025-2783 — a sandbox escape vulnerability in Chrome's Mojo IPC. Includes phishing delivery, memory fuzzing, IPC simulation, and logging. Safe for red team demos, detection engineering, and educational use. This project simulates a safe and educational...

macphish

macphish Office for Mac Macro Payload Generator Attack vectors There are 4 attack vectors available: beacon creds meterpreter meterpreter-grant For the 'creds' method, macphish can generate the Applescript script directly, in case you need to run it from a shell. beacon On execution, this payload...

creds.py

New version with lots more parsing: https://github.com/DanMcInerney/net-creds creds.py Harvest FTP/POP/IMAP/HTTP/IRC credentials along with interesting data from each of the protocols. If no interface is specified with the -i option the script will use the internet connected interface it finds vi...

bochs_linux_kernel_debugging

bochslinuxkerneldebugging Tools for Linux kernel debugging on Bochs including symbols, native Bochs debugger and IDA PRO Generate symbol file for linux kernel debugging Follow the below steps: 0- Generate a nm style debug info file just use nm command on debug kernel image, example for Debian: 1-...

CVE-2015-10141

CVE-2015-10141 Exploit Title: xdebug Unauthenticated Command Execution Exploit Author: D3Ext Vendor Homepage: https://xdebug.org/ Sofware Link: https://pecl.php.net/package/xdebug/2.5.5/windows Version: 2.5.5 Tested on: Kali Linux 2025 CVE: CVE-2015-10141 Explanation An unauthenticated OS command...

CVE-2020-12116

CVE-2020-12116 Proof of concept code to exploit CVE-2020-12116: Unauthenticated arbitrary file read on ManageEngine OpManger. Summary The latest release of OpManger contains a directory traversal vulnerability that allows unrestricted access to every file in the OpManager application. This includ...

CVE-2025-6325_CVE-2025-6327

CVE-2025-6325 + CVE-2025-6327 King Addons for Elementor — Dual Exploit PoC Research and validation tool for King Addons for Elementor For authorized security testing, vulnerability research, and controlled lab environments only. Overview This project provides a dual-purpose PoC for validating the...