Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

CVE-2014-6271

CVE-2014-6271 Shellshock Python Exploit A clean, efficient, and interactive Python implementation designed to test for the Shellshock vulnerability CVE-2014-6271 via HTTP environment variable injection. 📝 Description Shellshock CVE-2014-6271 is a critical security vulnerability in the Bash shell...

Exploit for CVE-2026-106173

CVE-2026-106173: Fortinet FortiSIEM gRPC Path Traversal File W...

TokenPlayer

TokenPlayer Manipulating and Abusing Windows Access Tokens. TokenPlayer is just a small tool i made to learn win32 api programming and understand better the access token model of windows. Features: Stealing and Impersonating primary tokens. Impersonating Protected Processes. Bypassing UAC by usin...

CVE-2026-28496-Lab

CVE-2026-28496 - FOSSBilling Server-Side Template Injection in Twig Rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-28496, a Server-Side Template Injection vulnerability affecting FOSSBilling's Twig template rendering behavior...

opmonster

OpMonster CVE-2020-8636 — authenticated remote code execution exploit for Opmon About • Install • Usage • License About OpMonster is a proof-of-concept exploit for CVE-2020-8636 , a remote code execution vulnerability in the Opmon monitoring platform. It abuses the nettools.php endpoint, which le...

twitter-intelligence

Twitter Intelligence A project written in Python for twitter tracking and analysis without using Twitter API. Prerequisites This project is a Python 3.x application. The package dependencies are in the file requirements.txt. Run that command to install the dependencies. pip3 install -r...

CVE-2021-41773-apache

CVE-2021-41773 Apache HTTP Server Exploit This repository contains a Python-based proof-of-concept exploit for the Apache HTTP Server path traversal vulnerability identified as CVE-2021-41773. The script is designed for security research, defensive testing, and authorized evaluations of vulnerabl...

DropboxC2C

DropboxC2C DropboxC2C is a post-exploitation agent which uses Dropbox Infrastructure for command and control operations. DO NOT USE THIS FOR MALICIOUS PURPOSES. THE AUTHOR IS NOT RESPONSIBLE FOR ANY MISUSE OF THIS PROGRAM. Dropbox-C2C is an old project of mine to use a thirdparty for command and...

dnsobserver

DNSObserver A handy DNS service written in Go to aid in the detection of several types of blind vulnerabilities. It monitors a pentester's server for out-of-band DNS interactions and sends notifications with the received request's details via Slack. DNSObserver can help you find bugs such as blin...

TinyXPB

TinyXPB REQUIREMENTS: A Virtual Machine or Bochs running XP SP3 XP SP0 will not work, other versions may USAGE: 1. run build.bat 2. copy floppy.img to wherever you wish to use it 3. set virtual machine / bochs to boot from floppy.img 4. Boot! EXECUTABLES: Tools\MakeImage\imagefs.exe - Commandline...

hashdeep

This is md5deep, a set of cross-platform tools to compute hashes, or message digests, for any number of files while optionally recursively digging through the directory structure. It can also take a list of known hashes and display the filenames of input files whose hashes either do or do not mat...

cve-2019-5420-POC

Rails ActiveSupport Exploit cve-2019-5420 POC consider this to chain CVE-2019-5418! Pairs lovely with CVE-2019-5418! POC Screenshot 🚨 Warning This repository contains a proof-of-concept PoC exploit demonstrating remote code execution RCE in Ruby on Rails applications via...

CVE-2026-19912-CVE-2026-19913-CVE-2026-19914

CVE-2026-19912, CVE-2026-19913, CVE-2026-19914 Donate Help maintain this project If you find this project useful, please consider supporting its ongoing maintenance through PayPal or ABA Mobile. ❤️ ១០% នៃការបរិច្ចាគរបស់អ្នក នឹងត្រូវបានបរិច្ចាគជូនមន្ទីរពេទ្យគន្ធបុប្ផា។ ❤️ Ten percent of every...

gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

DNSStager

What is DNSStager? DNSStager is an open-source project based on Python used to hide and transfer your payload using DNS. DNSStager will create a malicious DNS server that handles DNS requests to your domain and return your payload as a response to specific record requests such as AAAA or TXT...

pockint

POCKINT a.k.a. Pocket Intelligence is the OSINT swiss army knife for DFIR/OSINT professionals. A lightweight and portable GUI program, it provides users with essential OSINT capabilities in a compact form factor: POCKINT's input box accepts typical indicators URL, IP, MD5 and gives users the...

GC2-sheet

GC2 GC2 Google Command and Control is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint List and exfiltrate files using Google Drive or Microsoft SharePoint Document. Why This project has been developed t...

fuzztruction

Fuzztruction Fuzztruction is an academic prototype of a fuzzer that does not directly mutate inputs as most fuzzers do but instead uses a so-called generator application to produce an input for our fuzzing target. As programs generating data usually produce the correct representation, our fuzzer...

thetick

The Tick A simple embedded Linux backdoor. The Tick Compiling Installing Usage Media Compiling The Tick depends only on libcurl, so make sure you have the corresponding development package. For example on Debian based distributions you would do the following: sudo apt-get install libcurl-dev Once...