domainhunter

Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...

Wincrash

Wincrash root@kitploit: I'm not responsible for what you use this to accomplish and should only be used for education purposes. CVE-2019-0708 - when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote Code...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

CA-Common-Services-privilege-escalation-cve-2016-9795-revisited

Escalada de privilegios en CA Common Services CVE-2016-9795 revisitada Descripción En uno de mis pentests, me topé con el binario SUID casrvc que forma parte de la suite CA Common Services. Como descubrí, el binario es vulnerable a escalada local de privilegios. De hecho, un CVE público...

CLSIDFinder

CLSIDFinder Invoke-CLSIDFinder enumera las entradas CLSID y AppID del registro de Windows para identificar objetos COM asociados con servicios de Windows a través del valor LocalService. La función correlaciona estas entradas, exporta los resultados a un archivo CSV e intenta la activación COM...

Ivanti Cloud Services Appliance - Path Traversal

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. id: CVE-2024-8963 info: name: Ivanti Cloud Services Appliance - Path Traversal author: johnk3r severity: critical description: | Path Traversal in the Ivanti CSA befo...

SAP BusinessObjects Business Intelligence Platform - Blind Server-Side Request Forgery

SAP BusinessObjects Business Intelligence Platform Web Services 410, 420, and 430 is susceptible to blind server-side request forgery. An attacker can inject arbitrary values as CMS parameters to perform lookups on the internal network, which is otherwise not accessible externally. On successful...

Edito CMS - Sensitive Data Leak

Web services managed by Edito CMS Content Management System in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthorized user. id: CVE-2024-4836 info: name: Edito CMS - Sensitive Data Leak author: s4e-io severity: high description: | Web...

adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...

whale-sentinel-services

🐋 Servicios de Whale Sentinel 🔧 Descripción general Whale Sentinel Services es el backend centralizado del ecosistema de detección de amenazas de Whale Sentinel. Estos microservicios realizan detección de amenazas en tiempo real, coordinación de agentes, análisis de DGA e inspección de ataques we...

CVE-2020-6308-PoC

CVE-2020-6308 SAP POC SAP BusinessObjects Business Intelligence Platform Web Services, versiones 410, 420 y 430, permite a un atacante no autenticado inyectar valores arbitrarios como parámetros CMS para realizar búsquedas en la red interna que de otro modo no es accesible externamente. Sígueme e...

coolermaster-masterctrl-vuln

coolermaster-masterctrl-vuln CVE-2025-52216 – Cooler Master MasterCTRL Instalación silenciosa de servicios inseguros...

AppArmor.d

apparmor.d 全套 AppArmor 配置文件 !WARNING 该项目仍处于早期开发阶段。非常欢迎提供帮助；请参阅文档网站，包括其开发部分。 描述 AppArmor.d 是一套包含 1500 多个 AppArmor 配置文件的集合，其目标是限制大多数基于 Linux 的应用程序和进程。 目的 限制所有 root 进程，例如所有 systemd 工具、bluetooth、dbus、 polkit、NetworkManager、OpenVPN、GDM、rtkit、colord 限制所有桌面环境 限制所有用户服务，例如 Pipewire、Gvfsd、dbus、xdg、xwayland...

msploitego

msploitego - The Pentesting suite for Maltego THIS IS A BETA RELEASE, please be nice and report any issues Whats New New Features Now supporting multiple workspaces for Metasploit via Postgres queries A bash script that runs tons of auxiliary modules against targets. Really 'fattens' up the...

NtlmRelayToEWS

ntlmRelayToEWS Autor: Arno0x0x - @Arno0x0x ntlmRelayToEWS es una herramienta para realizar ataques de retransmisión NTLM en Exchange Web Services EWS. Inicia un SMBListener en el puerto 445 y un HTTPListener en el puerto 80, esperando la conexión entrante de la víctima. Una vez que la víctima se...

androguard

Androguard Do you think your phone has been pwned ? please check IsMyPhonePwned New tool: Goauld Dynamic injection tool for Linux/Android See the new version of Androguard: https://github.com/androguard/androguard/tree/ng Installation Quick installation: root@kitploit: pip install androguard...

Pymap-Scanner

Pymap-Scanner Features root@kitploit: 1-Basic Gui 2-Speed Scan 3-Custom Services 4-User Control 5-Error Control 6-Useful parameters And More. Installation Modules root@kitploit: $ Pyqt4 $ Nmap RequirementsThird root@kitploit: +xsltproc...

terminalphone

TerminalPhone Comunicación de voz push-to-talk cifrada a través de servicios ocultos de Tor. TerminalPhone es un único script Bash autocontenido que proporciona comunicación de voz y texto anónima, cifrada de extremo a extremo, entre dos o más partes a través de la red Tor. Funciona como un...

RmiTaste

RmiTaste RmiTaste permite a los profesionales de seguridad detectar, enumerar, interactuar y atacar servicios RMI mediante la llamada a métodos remotos con gadgets de ysoserial. También permite llamar a métodos remotos con parámetros específicos. Aviso de responsabilidad RmiTaste fue creado para...

CVE-2024-54385

CVE-2024-54385 Radio Player = 2.0.82 - Server-Side Request Forgery no autenticado Descripción El plugin de WordPress Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress es vulnerable a Server-Side Request Forgery en todas las versiones hasta la 2.0.82 inclusive. Esto...