46510 matches found
CVE-2024-45440
CVE-2024-45440 Drupal CVE-2024-45440 core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. Usage root@kitploit: python CVE-2024-45440.py Lab Deployment settings.php will replace...
CVE-2022-24086-RCE-PoC
CVE-2022-24086 RCE POC About CVE-2022-24086 which Adobe saw being “exploited in the wild in very limited attacks” received a severity score of 9.8 out of 10, and adversaries exploiting it can achieve remote code execution on affected systems without the need to authenticate. Issue that is now...
CVE-2022-31188
CVE-2022-31188 CVE-2022-31188 - OpenCV CVAT Computer Vision Annotation Tool SSRF CVAT is an open source Computer Vision Annotation Tool developed by Intel. Any user with "Task Create" authorization can trigger the SSRF vulnerability by sending a malicious HTTP request and gaining access to other...
explain-my-curl
explain-my-curl explain-my-curl is a local-first CLI for understanding what a curl command is doing across DNS, TLS, and HTTP. This repository currently includes: A CLI command to parse and explain a curl input A starter TUI for interactive exploration Execution telemetry for DNS, TCP connect, TL...
siper
Siper Shield Siper is a high-performance, XDP-based IP blacklist firewall built with Go and C eBPF. It allows you to drop malicious traffic at the earliest possible stage in the Linux networking stack—the network driver level. By leveraging XDP Express Data Path, Siper processes packets before th...
flareprox
FlareProx 🔥 Simple IP Rotation & URL Redirection via Cloudflare Workers FlareProx automatically deploys HTTP proxy endpoints on Cloudflare Workers for easy redirection of all traffic to any URL you specify. It supports all HTTP methods GET, POST, PUT, DELETE, etc. and provides IP masking through...
CVE-2022-1292
CVE-2022-1292 POC Description root@kitploit: The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute...
iDictPy
iDictPy A salty-ass 100% verified hacker status python script to turn apple id's into apple crisp nicememe I initially made this as a better alternative to this piece of shit: https://github.com/Pr0x13/iDict/ but then i forgot i'm a little bit drunk and then this happened. prerequisites are...
pe2pic
English || 简体中文 pe2pic Small visualizator for PE files Getting started Install the dependencies by: root@kitploit: pip install -r requirements.txt Usage root@kitploit: usage: pe2pic.py -h --infile INFILE --outfile OUTFILE --double --minheight MINHEIGHT PE visualizer options: -h, --help show this...
Doozer
Doozer Doozer is an extensible, automated hash cracking utility used to automate the parsing, cracking, and organization of password hashes. Currently, Doozer supports nt/lm, ntlmv1, and ntlmv2 hashes from Responder or SAM, but sports a modular architecture that allows other hash types to be...
bugbounty_tools
bugbountytools Collection of scripts and tools used during bug bounty work. This will be the location of my automation scripts created for my own personal use, and occassionally public released Contact: For questions, comments or request make a psot to my X account not in DM and I will do what I...
CVE-2018-8120
CVE-2018-8120 CVE-2018-8120 Windows LPE exploit Tested support: Win7 x32, Win7 x64, Win2008 x32, Win2008 R2 x32, Win2008 R2 Datacenter x64, Win2008 Enterprise x64 WinXP x32, Win2003 x32, Win2003 x64 The original exp does not support xp, 2003. This code adds support for these two systems based on...
shuffledns
Wrapper de massDNS para realizar fuerza bruta y resolución de subdominios con soporte para manejo de comodines Características • Instalación • Ejecución • Comodín • Licencia • Discord shuffleDNS es un wrapper alrededor de massdns, escrito en Go, que permite enumerar subdominios válidos mediante...
ActiveMQ_CVE-2015-5254
ActiveMQ Deserialization CVE-2015-5254 Vulnerability Description: Security vulnerabilities exist in Apache ActiveMQ versions before 5.13.0. The issue stems from the program not restricting the classes that can be serialized in the broker. Remote attackers can exploit this by sending a specially...
FakeAuth
FakeAuth FakeAuth is a tool that prompts for user credentials and exfiltrates it with HTTP protocol. Inspired by following projects 1. hlldz's PICKL3 https://github.com/hlldz/pickl3 Expect dirty code and some bugs ; Installation No special requirements Usage v1.01 root@kitploit: Usage: FakeAuth.e...
st25tb_kiemul
st25tbkiemul ST25TB / SRx NFC Emulator / Initiator based on TI TRF7970A with MSP430 This is the support project for ST25TB series NFC tags for fun in French public transports - ST25TBtransport.pdf Note: This project now supports st25tbkiemul including the LP-MSP430FR2476, st25tbkameleon and...
evil-ssdp
Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...
evil-ssdp
Resumen Esta herramienta responde a solicitudes de descubrimiento multicast SSDP, haciéndose pasar por un dispositivo UPNP genérico. Tu dispositivo suplantado aparecerá mágicamente en el Explorador de Windows en las máquinas de tu red local. Los usuarios que sean tentados a abrir el dispositivo...
supply-chain-monitor
Supply Chain Monitor Automated monitoring of the top PyPI and npm packages for supply chain compromise. Polls both registries for new releases, diffs each release against its predecessor, and uses an LLM via Cursor Agent CLI to classify diffs as benign or malicious. Malicious findings trigger a...