shuffledns

massDNS wrapper to bruteforce and resolve the subdomains with wildcard handling support Feature • Install • Run • Wildcard • License • Discord shuffleDNS is a wrapper around massdns, written in go, that allows you to enumerate valid subdomains using active bruteforce, as well as resolve subdomain...

autoPwn

Warning Completely re-writing this right now. Focus will be on interactive Linux apps that only take input from stdin for starters. Attempting to use Shellphish's Driller and Fuzzer functionality. autoPwn in it's current state will do this in limited form. Simply run autoPwn ./binary then select...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

dnsx

A fast and multi-purpose DNS toolkit designed for running DNS queries Features • Installation • Usage • Running dnsx • Wildcard • Notes • Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...

subfinder

Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • Library • Join Discord subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...

sqlmap-tamper-api

SQLmap Tamper-API It's an API for SQLmap tamper scripts allows you to use your favorite programming language to write your tamper scripts. This API solves SQLmap limitation of accepting only python to write tamper scripts. How it works taper-api.py script sends the payload and kwargs in a JSON...

refinery

Binary Refinery root@kitploit: High Octane Triage Analysis || || || || || | / / / \ || ==||=====|| | / |/ \ /==| / \ ===| '======|| | \ | | \ | \ /| | || || /||/ / | | | || =========''====/=========/ /==||=====||======' \ / / The Binary Refinery™ is a collection of Python scripts that...

log4stdin

log4stdin — stdout이 있는 모든 것을 위한 log4shell 인젝션 이 저장소는 CVE-2021-44228일반적으로 log4shell로 알려짐에 의도적으로 취약한 Java 애플리케이션을 포함합니다. log4stdin은 말 그대로 stdin 리더에 불과하며, 그 입력이 취약한 log4j 인스턴스에 제공됩니다. 빌드 log4stdin.jar는 Maven 아티팩트 log4j-api 2.14.1 및 log4j-core 2.14.1을 사용하며, 로깅 레벨과 타임스탬프 세부 정보를 생략하는 로깅 패턴을 사용합니다. 이 버전...

qsreplace

qsreplace Принимает URL из stdin, заменяет все значения строки запроса на заданное пользователем значение, выводит только каждую комбинацию параметров строки запроса один раз на хост и путь. Использование Пример входного файла: root@kitploit: ▶ cat urls.txt https://example.com/path?one=1&two=2...

drinkme

drinkme drinkme — это тестовый стенд для шелл-кода. Он читает шелл-код из stdin и выполняет его. Это позволяет пентестерам быстро тестировать свои пэйлоады перед развёртыванием. Форматы drinkme может обрабатывать шелл-код в следующих форматах: "0x" "\x" "x" "" Например, NOP может быть представлен...

Xjar_tips

Xjartips Introduction: root@kitploit: Spring Boot JAR 安全加密运行工具, 同时支持的原生JAR. 基于对JAR包内资源的加密以及拓展ClassLoader来构建的一套程序加密启动, 动态解密运行的方案, 避免源码泄露以及反编译. 功能特性 无代码侵入, 只需要把编译好的JAR包通过工具加密即可. 完全内存解密, 降低源码以及字节码泄露或反编译的风险. 支持所有JDK内置加解密算法. 可选择需要加解密的字节码或其他资源文件. 支持Maven插件, 加密更加便捷. 动态生成Go启动器, 保护密码不泄露. 其中xjar...

jfscan

!CAUTION ⚠️ Project Deprecated This project has been rewritten in Go for better performance and features. Please use the new version here: nullt3r/massmap Description Killing features Unleash the power of Nmap with Masscan for large-scale scans Scan targets using domain names and other formats...

unfurl

unfurl stdin으로 제공된 URL에서 조각을 추출합니다 설치 Go가 설치 및 구성되어 있다면: root@kitploit: ▶ go install github.com/tomnomnom/unfurl@latest 그렇지 않으면 플랫폼에 맞는 최신 바이너리를 다운로드하고, 압축을 푼 다음 $PATH에 포함된 디렉토리예: /usr/bin/로 이동하세요: root@kitploit: ▶ wget...

anew

anew stdin의 줄을 파일에 추가하되, 해당 줄이 이미 파일에 없는 경우에만 추가합니다. 새 줄은 stdout으로도 출력되므로, 중복을 제거하는 tee -a처럼 동작합니다. 사용 예제 여기서 things.txt라는 파일에는 숫자 목록이 들어 있습니다. newthings.txt에는 두 번째 숫자 목록이 들어 있는데, 일부는 things.txt에 있고 일부는 없습니다. anew는 후자를 things.txt에 추가하는 데 사용됩니다. root@kitploit: ▶ cat things.txt Zero One Two ▶ cat...

polkit: Polkit: Denial of Service via unbounded input processing through standard input

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the polkit-agent-helper-1 setuid binary via standard input stdin. This unbounded input can lead to an out-of-memory OOM condition, resulting in a Denial of Service DoS for the...

Astra Linux – Vulnerability in imagemagick

ImageMagick 7.1.0-49 is vulnerable to Denial of Service attacks. When it parses a PNG image for example, for resizing, the conversion process may cause it to wait for stdin input...

USN-8653-1: PostgreSQL vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

BIT-POSTGRESQL-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

SUSE CVE-2026-6464

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...