htrace.sh

Description htrace.sh is a shell script for http/https troubleshooting and profiling. It's also a simple wrapper around several open source security tools. For a more detailed understanding of htrace.sh, its parameters, functions and how it all works, run htrace.sh --examples or see the Wiki...

Firmware-CVE-2025-7545

Preparing to download the repository 1. Update packages: sudo apt-get update 2. If necessary, install git: sudo apt install -y git Downloading the repository, installing the vulnerable Binutils, and setting up the environment 1. Download the repository: git clone...

sandcastle

Inspired by a conversation with Instacart's @nickelser on HackerOne, I've optimised and published Sandcastle – a Python script for AWS S3 bucket enumeration, formerly known as bucketCrawler. The script takes a target's name as the stem argument e.g. shopify and iterates through a file of bucket...

Sweet-Pineapple-Builder

Sweet WiFi Pineapple Tetra Builder Sweet Pineapple Builder is a python script that automate the whole process of creating a custom WiFi Pineapple Tetra image. As the WiFi Pineapple Tetra firmware is a custom version of OpenWrt 19.07.2, it is therefore possible to create our own custom firmware...

ipsourcebypass

Este script de Python se puede usar para eludir las restricciones de fuente IP usando cabeceras HTTP. Características 17 cabeceras HTTP. Multihilo. Exportación JSON con --json outputfile.json. Detección automática de las soluciones más exitosas. Uso $ ./ipsourcebypass.py -h IP source bypass using...

PolyDrop

BYOSI - Bring-Your-Own-Script-Interpreter - Leveraging the abuse of trusted applications, one is able to deliver a compatible script interpreter for a Windows, Mac, or Linux system as well as malicious source code in the form of the specific script interpreter of choice. Once both the malicious...

Win11Debloat

Win11Debloat Win11Debloat es un script de PowerShell ligero y fácil de usar que te permite despejar y personalizar rápidamente tu experiencia en Windows, ¡sin necesidad de instalación! Puedes usarlo para eliminar aplicaciones preinstaladas, desactivar la telemetría, eliminar elementos intrusivos ...

Arcane

Arcane is a simple script designed to backdoor iOS packages iphone-arm and create the necessary resources for APT repositories. It was created for this publication to help illustrate why Cydia repositories can be dangerous and what post-exploitation attacks are possible from a compromised iOS...

Samba-Exploit-CVE-2007-2447

🎬 This YouTube video 1️⃣ Scanning the target Nmap nmap -sS -sV -p 139,445 192.168.56.102 Expected result: 139/tcp open netbios-ssn Samba smbd 3.X 445/tcp open microsoft-ds Samba smbd 3.0.20-Debian 👉 Samba version: 3.0.20 This is vulnerable to CVE-2007-2447. 2️⃣ Identifying the Samba exploit...

cve-2019-11043.py

cve-2019-11043.py Python port of an ExploitDB proof-of-concept. Python Port of ExploitDB 48182 For Educational Purposes Only This project is a Python port of the ExploitDB PoC for exploit 48182. It was created for learning and research purposes. ⚠ Disclaimer The script has not been tested , so it...

Exploit-CVE-2024-23897

Exploit-CVE-2024-23897 Run the Container docker run -p 8080:8080 --name vulnerable-jenkins -d jenkins/jenkins:2.441-jdk17 Check logs docker logs Fetch docker machines IP: docker inspect vulnerable-jenkins | grep IPAddress Exploitation Code: python3 exploit.py --target http://127.0.0.1:8080 --file...

VMware_vCenter_UNAuthorized_RCE_CVE-2021-21972

VMwarevCenterUNAuthorizedRCECVE-2021-21972 zoomeye dork: app:"VMware vCenter" A harmless detection script written using pocsuite3 VMwarevCenterUNAuthorizedRCE.py, using nearly a year of data for detection: Success rate approximately: 1551 / 3998 = 39%...

Remot3d

Remot3d - An Easy Way To Exploiting Will be updated soon Remot3d - A tool made to generate backdoor to control and exploit a server where the server runs the PHP Hypertext Preprocessor program. Equipped with a backdoor that has been obsfucated, which means that it shoudl generally be FUD Fully...

CVE-2017-12149

CVE-2017-12149 Jboss Java Deserialization RCE CVE-2017-12149 The python script uses ysoserial to dynamically generate the payload. Therefore java is required as well...

huntr-com-bug-bounties-collector

huntr.com 漏洞收集器 新的漏洞赏金（漏洞）收集器 环境要求 支持图形界面的 Chrome（如果脚本执行遇到问题，请检查虚拟机的 GPU 功能状态（如果可用）。） Chrome WebDriver 预览 python3 main.py 2024-02-20 16:14:47.836189 1. Arbitrary File Reading due to Lack of Input Filepath Validation - Feb 6th 2024 / High CVE-2024-0964 - gradio-app/gradio -...

kalici-dosya-silme-araci

Permanent File Deletion Tool & Kalıcı Dosya Silme Aracı This project is a simple tool that allows users to permanently delete specified files. The program overwrites the specified file with random data, changes the content of the file, and then deletes it, effectively removing any traces of the...

CVE-2017-7269-exploit

Modified from https://github.com/edwardz246003/IISexploit.git Usage -h : Select host default 127.0.0.1 -p : Select port default 80 Append command at the end default regedit, currently this script only supports up to 8 characters...

dcpwn

dcpwn an impacket-dependent script exploiting CVE-2019-1040, with code partly borrowed from those security researchers that I'd like to say thanks to. by taking a closer look you'll find the very technique for utilising the vulnerability slightly different to what common belief is...

CVE-2022-1292

CVE-2022-1292 Description The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands...

CVE-2025-61229

CVE-2025-61229 Description From the developer's blog: User-settable Before/After shell scripts run escalated, with SuperDuper's TCC Full Disk Access permissions. Since those shell scripts are referenced by the settings files for the copy or schedule, a malicious actor could modify those settings ...