46511 matches found
vibegate
A security checkpoint for AI coding tools. It looks at every file an AI assistant writes, and stops the dangerous ones before they hit disk. What problem does this solve? AI coding assistants Claude Code, Codex, … write code fast — including code that handles things like passwords, emails, API...
CVE-2023-3519
CVE-2023-3519 This Nuclei template checks for the presence of the CVE-2023-3519 vulnerability in a target web server. Vulnerability CVE-2023-3519 is a vulnerability that allows unauthenticated remote code execution in the Citrix Application Delivery Controller ADC and Gateway appliances. An...
ConceptronicIPCam_MultipleVulnerabilities
Multiple vulnerabilities at Conceptronic IP Cameras with 0.61.X. web firmware. A CSRF and Denial of Service vulnerabilities have been found at Conceptronic IP Cameras. CVE| Description ---|--- CVE-2018-6407| Unauthenticated remote Denial of Service vulnerability CVE-2018-6408| CSRF allows to chan...
CVE-2019-5624
CVE-2019-5624 A proof of concept for Metasploit's CVE-2019-5624 vulnerability Rubyzip insecure ZIP handling RCE Intro In February 2019 I found a new vulnerability in the Rubyzip library. It allows an attacker to exploit insecure ZIP handling Zip Slip resulting in remote command execution. This...
sentinel-cve
🛡️ Sentinel — CVE Explainer CLI "Does this CVE even affect me?" — answered in seconds, not hours. Sentinel takes a CVE ID, fetches data from NVD, OSV.dev, and MITRE, then uses Claude to produce a clear, actionable 5-section vulnerability briefing. Install root@kitploit: cd sentinel/ pip install -e...
ratched
ratched ratched is a Man-in-the-Middle MitM proxy that specifically intercepts TLS connections. It is intended to be used in conjunction with the Linux iptabes REDIRECT target; all connections that should be intercepted can be redirected to the local ratched port. Through the SOORIGINALDST sockop...
SSH-Remote-Code-Execution
SSH Remote Code Execution SSH Zero-Day | Made by ClumsyLulz & Taylor Christian Newsome Summary This repository contains a C program that accepts input parameters and generates a packet to be sent to a server over the SSH protocol. The program allocates a buffer to hold the data, writes it to a...
trivy-db
trivy-db Overview trivy-db is a CLI tool and a library to manipulate Trivy DB. Library Trivy uses internally to manipulate vulnerability DB. This DB has vulnerability information from NVD, Red Hat, Debian, etc...
CVE-2018-3191
CVE-2018-3191 payload generator Download: https://github.com/voidfyoo/CVE-2018-3191/releases Usage root@kitploit: java -jar weblogic-spring-jndi.jar e.g.: root@kitploit: java -jar weblogic-spring-jndi.jar rmi://192.168.1.1:1099/Exp Notes weblogic-spring-jndi-12.2.1.3.jar for weblogic: 12.2.1.3...
shellcode-x64
Shellcode for Microsoft Windows 11 x64 This script generate Windows 11 x64 Reverse TCP Shellcode with PIC technique. Usage for generate shellcode root@kitploit: python ./shellreversetcp.py -i 192.168.10.10 -p 443 Defualt language is C type shellcode, also Python, Csharp and powershell:...
FrostedFastPair
About POC for CVE-2025-36911 WhisperPair vulnerability, allowing you to connect to supported devices with no authentication info. This firmware only performs discovery and vulnerability confirmation and does not implement complete audio listening. Output on during tests: Testing Mac: will use the...
CVE-2026-33017
CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote Code Execution PoC ★ https://github.com/user-attachments/assets/562fc637-6be1-4ab9-a396-bfad56447af7 Environment Setup Use the following commands to build and run the vulnerable Langflow environment: root@kitploit: docker build -t...
launchd-portrep
launchd-portrep launchd-portrep is an exploit for a port replacement vulnerability in launchd, the initial userspace process and service management daemon on macOS. By sending a crafted Mach message to the bootstrap port, launchd can be coerced into deallocating its send right for any Mach port t...
sqlsure
sqlsure AI writes your SQL. sqlsure makes sure it's right. A query can be perfectly valid, run without error, and return a number that's silently wrong — revenue double-counted by a join, an average summed, a patient identifier exposed. Databases don't catch this. Linters don't catch this. LLMs...
smugglefuzz
SmuggleFuzz SmuggleFuzz, a configurable and rapid HTTP downgrade smuggling scanner. Empowering users with customizable gadget lists, it offers deeper insights into the reasons behind failed smuggling attacks. I am confident that numerous HTTP downgrade-based smuggling vulnerabilities remain...
TurkoRat
TELEGRAM VERSION ⚔️ TurkoRat 🛡️ Telegram server: https://t.me/turcoflex Discord server: https://discord.gg/xTsJReFG84 joinnew discord 🌐 〢 Content 📁 Setting up ⚔️ Features 📸 Screenshots 📝 Todo 📜 License ⚠️ Note 📁 〢 Setting Up Install Node.js IMPORTANT: When installing Node.js also install "Tools for...
jackit
JackIt ¿Te gusta JackIt pero no quieres llevar un portátil? Échale un vistazo aesto. Qué Esta es una implementación parcial del exploit MouseJack de Bastille. Consulta mousejack.com para más detalles. El crédito completo corresponde al equipo de Bastille por descubrir este problema y escribir las...
jackit
JackIt Do you like JackIt but don't want to carry around a laptop? Checkthis out. What This is a partial implementation of Bastille's MouseJack exploit. See mousejack.com for more details. Full credit goes to Bastille's team for discovering this issue and writing the libraries to work with the...