agartha

Agartha Payload Injection LFI, RCE, SQLi, with optional BCheck, Auth Issues Access Matrix, HTTP 403, Copy as JavaScript, and Bambdas Agartha, specializes in advance payload generation and access control assessment. It adeptly identifies vulnerabilities related to injection attacks, and...

CVE-2022-46169

CVE-2022-46169 CVE-2022-46169 Cacti remoteagent.php Unauthenticated Command Injection. Auth Bypass Add X-Forwarded-For header to bypass authentication, note that its value is not a fixed value. Brute Force Use Burp Intruder to fuzz test the values of hostid and localdataids. RCE The point of...

spring4shell_behinder

Spring4shellbehinder What is this? A batch rapid exploitation tool for the Spring4Shell vulnerability CVE-2022-22965. Contributors 4nth0ny @Friday Lab Issues/PRs are welcome. : Environment python 3.x Behinder3.0 Beta9 Installation root@kitploit: python3 -m pip install -r requirements.txt Usage...

CVE-2025-29018

CVE-2025-29018 - Internet Banking System 2.0.0 Stored XSS in pagesaddacctype.php Description A Stored Cross-Site Scripting XSS vulnerability exists in Code Astro Internet Banking System 2.0.0 due to unsanitized input in the name parameter in pagesaddacctype.php. Attackers can store malicious...

CVE-2023-2598

CVE-2023-2598 Privilege Escalation Understand the Compound Page and folio mechanisms in Linux through CVE-2023-2598, and subsequently see if it's possible to complete the exploitation of the 1day CVE-2023-6560. Compound Page huge page Memory is growing larger and larger, but the basic page...

DSSS

Damn Small SQLi Scanner Damn Small SQLi Scanner DSSS is a fully functional SQL injection vulnerability scanner supporting GET and POST parameters written in under 100 lines of code. As of optional settings it supports HTTP proxy together with HTTP header values User-Agent, Referer and Cookie...

CVE-2025-47812-poc

CVE-2025-47812 Wing FTP Server Remote Code Execution RCE Exploit CVE-2025-47812 📌 Credit : Vulnerability discovered by Julien @MrTuxracer. This PoC implementation is based on their original research. This repository hosts a Python exploit for the Wing FTP Server Remote Code Execution RCE...

Apache-Struts-Shodan-Exploit

APACHE STRUTS SHODAN EXPLOIT POC Author: @037 Original code can be found here. This tool takes advantage of CVE-2018-11776 and Shodan to perform mass exploitation of verified and vulnerable Apache Struts servers. Shodan search parameter has been left out to weed out any skids trying to use this...

CVE-2022-23614

CVE-2022-23614 PoC for CVE-2022-23614, GHSA-5mv2-rx3q-4w2v Twig sort filter code execution/sandbox bypass As seen in this commit - https://github.com/twigphp/Twig/commit/.., twig was passing user supplied function name as a callback parameter to uasort here, thus leading to arbitrary code executi...

auth_analyzer

Auth Analyzer Table of Contents What is it? Why should I use Auth Analyzer? GUI Overview Parameter Extraction Auto Extract From To String Static Value Prompt for Input Parameter Replacement Replacement Location Parameter removement Sample Usage Auto extract session Cookie Session Header and CSRF...

Crawlector

Crawl e ctor Crawlector the name Crawlector is a combination of Crawl er & Detector is a threat-hunting framework designed for scanning websites for malicious objects. Note-1 : The framework was first presented at the No Hat conference in Bergamo, Italy on October 22nd, 2022 Slides, YouTube...

SAFE

SAFE : Self Attentive Function Embedding Paper This software is the outcome of our accademic research. See our arXiv paper: arxiv If you use this code, please cite our accademic paper as: root@kitploit: @inproceedingsmassarelli2018safe, title=SAFE: Self-Attentive Function Embeddings for Binary...

Forklift_LPE

Forklift 3.3.9 Local Privilege Escalation When installing the Forklift, a new helper called com.binarynights.ForkLiftHelper for Mac OS X is automatically installed to the /Library/PrivilegedHelperTools/ directory. Analyzing this helper, which handles XPC messages, resulted in different ways of...

x8

x8 Hidden parameters discovery suite written in Rust. The tool aids in identifying hidden parameters that could potentially be vulnerable or reveal interesting functionality that may be missed by other testers. Its high accuracy is achieved through line-by-line comparison of pages, comparison of...

CVE-2022-43271

CVE-2022-43271 Stored Cross-Site Scripting XSS Product: Move CRM https://inhabit.com.au/Move-Real-Estate-CRM-Software Discovery date: 2/8/2022 Fix date: 4/8/2022 Affected Version: version 4, build 260 Fixed Version: version 4, build 261 Description: The vulnerability was discovered in the 'staff...

spring-cloud-function-rce

Spring Cloud Function SPEL Expression Injection Vulnerability CVE-2022-22963 Spring framework provides a comprehensive programming and configuration model for modern Java-based enterprise applications on any type of deployment platform. The serverless framework in Spring Cloud, the RoutingFunctio...

CVE-2024-41640

Description AML Surety Eco up to version 3.5 is affected by an un-authenticated reflected cross-site scripting. The target web application handles error in a dedicated error page accessible without any authentication containing a URL parameter that is not sanitizing user input. The provided...

AutoLocalPrivilegeEscalation

AutoLocalPrivilegeEscalation An automated script that download potential exploit for linux kernel from exploitdb, and compile them automatically This script is created due to Hackademics, there are so much possible exploit for that version of kernel, as a rookie OSCP student, I am not able to fin...

maude-hcs

Maude-HCS Maude-HCS is one of the first generalized and modular toolchains for formally specifying and reasoning about Hidden Communication Systems HCS at real-world scales. It enables network designers to explore alternative HCS designs quickly and effectively and provides formal...

zipbrk

zipbrk 2.2.0 Zip break is a tool to disect, modify, and reassemble zip files for a variety of tasks. It is designed to be cross-platform and as simple as possible to port between varied systems. It has been tested on Windows 9x/2k/XP, Windows Vista/7/8, Fedora 23/24/25/26/27, Kali, Debian 8/9,...