BLEBoy

BLEBoy Goal Create a BLE peripheral that supports all BLE pairing methods that can be used for training and testing, including out-of-band OOB pairing. The perpiheral must be configurable and easy to re-create using consumer parts. About BLEBoy is a BLE peripheral implemented using the Adafruit...

SharpWhispers

SharpWhispers C porting of SysWhispers2. It uses SharpASM to find the code caves for executing the system call stub. Read the blog post for the technical details: https://www.secforce.com/blog/sharpasm-sharpwhispers/ Requirements Visual Studio .NET Framework = 3.5 Python3 Usage / / / | | /| / / /...

CVE-2026-73570

CVE-2026-73570 — Zimbra zimbra-snmp Unauthenticated OS Command Injection PoC Proof-of-concept exploit for CVE-2026-73570 , an unauthenticated OS command injection CWE-78, CVSS 8.9 in Zimbra Collaboration Suite Disclaimer: This PoC is intended only for authorized security testing , defensive...

Excalibur

Excalibur will soon be updated to utilize Metasploit over the Bashbunny. Excalibur Excalibur is an Eternalblue exploit based "Powershell" for the Bashbunny project. It's purpose is to reflect on how a "simple" USB drive can execute the 7 cyber kill chain. Excalibur may be used only for...

GoAWSConsoleSpray

GoAWSConsoleSpray GoAWSConsoleSpray is a tool that can be used to spray AWS IAM Console Credentials in order to identify a valid login for a user account. The AWS CLI does not have a way to authenticate via username/password, only the online web console. While most organizations should enforce...

WMIExec

WMIexec Set of python scripts which perform different ways of command execution via WMI protocol. Blog Post https://whiteknightlabs.com/2023/06/26/navigating-stealthy-wmi-lateral-movement/ Usage wmiexecscheduledjob.py Is a python script which authenticates to a remote WMI instance and execute...

PMapper

Principal Mapper Principal Mapper PMapper is a script and library for identifying risks in the configuration of AWS Identity and Access Management IAM for an AWS account or an AWS organization. It models the different IAM Users and Roles in an account as a directed graph, which enables checks for...

CVE-2026-69212

CVE-2025-69212 — OpenSTAManager OS Command Injection RCE Proof-of-concept exploit for CVE-2025-69212 , an OS Command Injection vulnerability in OpenSTAManager ;echo ".p7m Resulting shell execution: openssl smime ... -in "invoice.p7m";;echo ".p7m" ... ^^^^^^^^^^^^ injected here Note: The forward...

com.heytap.browser

Vulnerability Report Overview: A vulnerability has been discovered in the com.heytap.browser application on the Android platform. The vulnerability allows an attacker to execute arbitrary JavsScript code within the context of the application without any permissions. Application Details: Vendor: -...

shiro

CVE-2026-49268 — Analysis and Remediation of an LDAP Injection Authentication Bypass Vulnerability | ---|--- Branch| 1.13-CVE-2026-49268 Author| Jinwoo Hwang https://JinwooHwang.com This branch 1.13-CVE-2026-49268 contains a comprehensive security remediation of an LDAP Injection Authentication...

CVE-2024-21689

CVE-2024–21689 RCE Bamboo Data Center and Server Atlassian CVSS Score - 7.6 🔥 Description This High severity RCE Remote Code Execution vulnerability CVE-2024-21689 was introduced in versions 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This RCE Remote Code...

github-endpoints

github-endpoints Find endpoints on GitHub. Description This Go tool performs searches on GitHub and parses the results to find endpoints of a given domain. Install go install github.com/gwen001/github-endpoints@latest or git clone https://github.com/gwen001/github-endpoints cd github-endpoints go...

CVE-2025-38352-PoC

CVE-2025-38352: Linux Kernel POSIX CPU Timer TOCTOU Race Condition & UAF A reproducible Proof-of-Concept PoC and automated GDB orchestration script for CVE-2025-38352 , a Time-of-Check to Time-of-Use TOCTOU race condition in the Linux kernel's POSIX CPU timer subsystem...

CVE-2015-9251

CVE-2015-9251 [email protected] PoC for CVE-2015-9251 jQuery before 3.0.0. CVE-2015-9251 - PoC Exploit This repository contains a Proof of Concept PoC for the vulnerability CVE-2015-9251 in the jQuery library. The vulnerability allows a Cross-Site Scripting XSS attack through unsanitized JSO...

NyxInvoke

NyxInvoke NyxInvoke is a versatile Rust-based tool designed for executing .NET assemblies, PowerShell commands/scripts, Beacon Object Files BOFs and PE files with built-in Ntdll Unhooking, patchless AMSI and ETW bypass capabilities. It can be compiled as either a standalone executable or a DLL...

bitpixie

bitpixie Full blog post here Main References syss blog post Syss's Github repository Bitpixie BitLocker Exploit Implementation Virtual machine reproduction. The local machine attacker machine uses Ubuntu 22.04.5 LTS system, while the victim machines are Windows 10 21H2 19041.1 and Windows 11 21H2...

GhostInTheNet

GhostInTheNet Ultimate Network Stealther that makes Linux a Ghost In The Net and protects from MITM/DOS/scan Properties: Network Invisibility Network Anonymity Protects from MITM/DOS Transparent Cross-platform Minimalistic Dependencies: Linux 2.4.26+ - will work on any Linux-based OS, including...

netwave-dosvulnerability

Netwave IP Camera server vulnerable to unauthenticated Denial of Service via one single huge POST request on any firmware. CVE| Description ---|--- CVE-2018-6479| Unauthenticated remote Denial of Service vulnerability CVSS| Score| Details ---|---|--- 3| 7.3|...

WinPwn

Sponsored by WinPwn In many past internal penetration tests I often had problems with the existing Powershell Recon / Exploitation scripts due to missing proxy support. I also often ran the same scripts one after the other to get information about the current system and/or the domain. To automate...

CVE-2017-5638_struts

I extended Scott Campbell's script further, made it more complicated : While "HTTPStrutsAttack" will stop 100% of the recon, there was still miniscule chance that if a scanner hits a vulnerable system, even though we'd block the scanner, vulnerable system might still do the wget included in the...