NetSpy

NetSpyC2 NetSpyC2 is a Python-based Command & Control C2 server created for educational purposes, security research, and controlled laboratory environments. The project demonstrates how encrypted client-server communication, session management, and secure file transfer can be implemented at the...

protections-artifacts

Protections Artifacts Elastic Security prevents ransomware and malware, detects advanced threats, and arms responders with vital context. It’s free and open, ready for every endpoint. Protections-Artifacts is the home of our detection logic rules, yara, etc for Elastic Security for endpoint. At...

RemoteSessionEnum

Blog: https://0xv1n.github.io/posts/sessionenumeration/ The purpose of this project was to attempt to replicate the functionality of qwinsta /server: utilizing the largely undocumented Windows Station WinSta API...

penelope

Penelope is a modern shell handler for penetration testers and CTF players. It provides a more capable alternative to basic netcat listeners, adding automatic PTY upgrades, session management, logging, file transfers and helper modules. Table of Contents 📥 Installation ⚙️ Features 🖥️ Session...

Lightdash v0.1024.6 - Server-Side Request Forgery

Server-Side Request Forgery “SSRF” in the export dashboard functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to obtain the session cookie of any user who exports a crafted dashboard. When they are exported, dashboards containing HTML elements can trigger HTTP...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 is vulnerable to cross-site scripting via the segments/add.php Segment Name field. id: CVE-2018-1000856 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 is vulnerable to cross-site scripting via the...

WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection via request parameters in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

TelemetrySourcerer

Telemetry Sourcerer Introducción Telemetry Sourcerer puede enumerar y deshabilitar fuentes comunes de telemetría utilizadas por AV/EDR en Windows. Los equipos rojos y entusiastas de la seguridad pueden usar esta herramienta en un entorno de laboratorio para: Identificar puntos ciegos basados en...

CVE-2020-24227

CVE-2020-24227 Playground Sessions - Storing User Credentials in Plaintext Playground Sessions v2.5.582 and earlier for Windows, stores the user credentials in plain text allowing anyone with access to C:\Users\AppData\Roaming\Playground\Local StoreSharedObjects\Playground.swf\UserProfiles.sol to...

c2-cloud

About The Project The C2 Cloud is a robust web-based C2 framework, designed to simplify the life of penetration testers. It allows easy access to compromised backdoors, just like accessing an EC2 instance in the AWS cloud. It can manage several simultaneous backdoor sessions with a user-friendly...

psc

PortShellCrypter -- PSC This project - as well as its sister project crash - belongs to my anti-censorship tool-set that allows to setup fully working encrypted shells and TCP/UDP forwarding in hostile censoring environments. It is also useful for forensics to dump data from devices via UART or...

CVE-2018-15133-PoC

CVE-2018-15133-PoC 此 Python 脚本利用 CVE-2018-15133 漏洞，针对存在不安全反序列化漏洞的 Laravel 应用实现远程代码执行（RCE）。 该漏洞利用 Laravel（5.5.40 及更早版本，以及 5.6.0 至 5.6.29）中已加密的会话会自动反序列化且缺乏适当验证的弱点。在获取 Laravel 的 APPKEY 后，攻击者可加密恶意负载，这些负载将被反序列化并在服务器上执行。 Laravel 会话系统工作原理 Laravel 使用对称加密机制处理会话，包含三个组件： IV（初始化向量）：每次会话随机生成的初始化向量 Value：使用...

essh

root@kitploit: ███████╗███████╗███████╗██╗ ██╗ ██╔════╝██╔════╝██╔════╝██║ ██║ █████╗ ███████╗███████╗███████║ ██╔══╝ ╚════██║╚════██║██╔══██║ ███████╗███████║███████║██║ ██║ ╚══════╝╚══════╝╚══════╝╚═╝ ╚═╝ SSH mejorado para gente con flotas Un cliente SSH en Rust puro con una TUI densa estilo...

ridrelay

RidRelay Quick and easy way to get domain usernames while on an internal network. Hit me up: @skorov8 How it works RidRelay combines the NTLM Relay attack, common lsarpc based queries and RID cycling to get a list of domain usernames. It takes these steps: 1. Spins up an SMB and HTTP servers and...

SessionGopher

Copyright 2017 FireEye, created by Brandon Arvanaghi @arvanaghi Licensed under the Apache License, Version 2.0 the "License"; you may not use this file except in compliance with the License. You may obtain a copy of the License at root@kitploit: http://www.apache.org/licenses/LICENSE-2.0 Unless...

paradoxiaRAT

Herramienta de Acceso Remoto Paradoxia. ¿Buscas una alternativa con GUI? Echa un vistazo aRemote Hacker Probe. Más avanzado y estable con un montón de funciones. Características Consola Paradoxia Característica| Descripción ---|--- Fácil de usar| Paradoxia es extremadamente fácil de usar, ¡hasta...

Grassmarlin-CVE-2026-6807-XXE-POC

This is functional proof of concept code based on the CISA disclosure of a reported vulnerability in Grassmarlin posted on 4/28/2026. Looking at the code for Grassmarlin, I determined that the likely vulnerable parameters had to do with the XML files ingested when opening stored sessions. By...

CVE-2020-9470

What's this Wing FTP Server 6.2.5 - Privilege Escalation Introduction A weakness in the handling of HTTP sessions within Wing FTP Server allows any local user to escalate privileges to root on Linux, MacOS, and Solaris. Exploitation is contingent on an already-established administrative session. ...

CVE-2026-87916

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range...

CVE-2026-87916 WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range...