b374k

b374k shell 3.2 这个 PHP Shell 是一个有用的工具，供系统或网络管理员进行远程管理，无需使用 cpanel、通过 ssh、ftp 等方式连接。所有操作均在 Web 浏览器中完成 功能： 文件管理器（查看、编辑、重命名、删除、上传、下载、打包等） 搜索文件、文件内容、文件夹（也可使用正则表达式） 命令执行 脚本执行（php、perl、python、ruby、java、node.js、c） 通过绑定/反弹 shell 连接提供 shell 简单的数据包构建器 连接 DBMS（mysql、mssql、oracle、sqlite、postgresql 以及更多使用 ODB...

shootback

shootback shootback is a reverse TCP tunnel let you access target behind NAT or firewall 反向TCP隧道, 使得NAT或防火墙后的内网机器可以被外网访问. Consumes less than 1% CPU and 8MB memory under 800 concurrency. slaver is single file and only depends on python2.7/3.4+ standard library. How it works Typical Scene 1. Access...

HTMLawed

HTMLawed es ... ... un script PHP de un solo archivo de 45 kb que hace que el texto de entrada sea más seguro, conforme a los estándares HTML y, en general, adecuado desde el punto de vista del administrador de una página web, para su uso en el cuerpo de documentos HTML, XHTML o XML. Una sencilla...

tinyfilemanager-wh1z-edition

Tiny File Manager WH1Z-Edition Introducing Tiny File Manager WH1Z-Edition, the compact and efficient solution for managing your files and folders with enhanced privacy and security features. Gone are the days of relying on external resources – I've stripped down the code to its core, making it...

httpstat

httpstat httpstat visualiza las estadísticas de curl1 de una manera bella y clara. Es un script de Python de un solo archivo🌟 que no tiene dependencias👏 y es compatible con Python 3🍻. Características Hermosa salida de terminal — desglose de tiempos de DNS, TCP, TLS, procesamiento del servidor y...

fapro

FaPro 免费、跨平台、单文件部署的网络协议服务端模拟器 README of English 简介 FaPro是一个服务端协议模拟工具,可以轻松启停多个网络服务。 目标是支持尽可能多的协议，每个协议尽可能提供深度的交互支持。 示例网站 特性 支持的运行模式 本地模式 虚拟网络 支持的网络协议 DNS DCE/RPC EIP Elasticsearch FTP HTTP IEC 104 Memcached Modbus MQTT MySQL RDP Redis S7 SMB 协议模拟演示 Rdp 支持 credssp ntlmv2 nla 认证。 支持配置用户登陆时的图片。 SSH...

CVE-2025-1974-go

使用单个文件利用CVE-2025-1974。 用法： root@kitploit: 1. change serverip and serverport in shell.c 2. make 3. GOOS=linux go build -ldflags="-w -s -extldflags "-static"" -trimpath main.go 4. run main in your controlled pod...

pcc

PHP 安全配置检查器 检查当前 PHP 配置是否存在潜在安全漏洞。 只需通过 Web 服务器访问此文件或在 CLI 上运行即可。 作者 该软件由 Ben Fuhrmannek 编写，来自 SektionEins GmbH，旨在自动化 php.ini 检查并将更多时间用于愉快的工作。 理念 单个文件，易于分发 对每个安全相关的 ini 条目进行简单测试 一些其他测试——不过不太复杂 兼容 PHP = 8.1 没有复杂/过度设计的代码，例如没有类/接口、测试框架、库等 - 这应该能让初学者一目了然地了解此工具的工作原理和功能！ 没有（或极少）依赖 使用 / 安装 CLI ：只需调用 php...

CVE-2015-3306

CVE-2015-3306 这个文件包含了针对 ProFTPd 1.3.5 modcopy（CVE-2015-3306）漏洞的单文件利用，特别是为 TryHackMe Kenobi Lab 设计的。 漏洞描述 CVE-2015-3306 是 ProFTPd 1.3.5 中的一个漏洞，源于 modcopy 模块的缺陷，该模块负责启用 FTP 文件复制操作。此漏洞允许 THM 玩家将 SSH 私钥复制到共享目录并将其挂载到本地系统，从而使得 THM 玩家能够使用 SSH 私钥连接到该用户。 利用方法 1. sudo apt-get update 2. sudo apt-get install...

CVE-2023-33902_single_file

此存储库没有 README。...

CVE-2023-4357-Chrome-XXE

工具简介 全球首款单文件利用 CVE-2023-4357 Chrome XXE 漏洞 EXP，实现对访客者本地文件窃取。 The world's first single file exploits the CVE-2023-4357 Chrome XXE vulnerability EXP, allowing attackers to obtain local files of visitors. 文件名| 说明| 利用场景| 为何能单文件/单payload实现漏洞利用？ ---|---|---|--- d.svg| 单文件利用，无需依赖其他文件| 1...

Risk-Analysis-Editor

Risk Analysis Editor RAE English · Français Standalone tool for building and visualizing risk matrices — inherent gross risk and residual net risk — with an open, documented file format, .rae.json. ▶️ Open the app · 📖 User guide · 🎬 Video tutorials · ⬇️ Download No installation: the tool runs...

CVE-2026-55499

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

CVE-2026-55499 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

CVE-2026-55499 Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

GHSA-W8X7-H2PX-XMQ8 Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...

Cloudreve: Broken Access Control in file event stream: a single-file share recipient is subscribed to the owner's parent folder and receives activity events for unshared siblings

Summary When an authenticated recipient of a single-file share opens the file event stream GET /api/v4/file/events?uri=, Cloudreve validates the URI by listing it and then subscribes the caller to parent.ID. For a single-file share, the share navigator resolves the bare share-root URI to the...

GHSA-49H3-CWHJ-4737 Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...

Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account

Summary Cloudreve's WOPI PUTRELATIVE handler treats X-WOPI-SuggestedTarget as a path, not a filename. It splits the header on / and joins the segments onto the source file's directory with URI.JoinRaw, which feeds Go's url.JoinPath. url.JoinPath resolves ./.. segments, so a slash-bearing target...

PT-2026-64431

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrit...