The vulnerability of the DIAFAN.CMS content management system lies in the lack of protective measures for the SQL query structure, allowing attackers to execute arbitrary code.

The vulnerability of the DIAFAN.CMS website content management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Directum Web Agent component of the Directum RX system, which arises due to insufficient validation of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the Directum Web Agent component of the Directum RX system exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted file...

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager lies in the lack of a mechanism for verifying input data during backup scenarios. This allows a malicious actor to execute arbitrary code with SYSTEM privileges.

The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to deficiencies in the mechanism for verifying input data during backup scenario execution. Exploiting this vulnerability could allow an attacker, operating...

The vulnerabilities in the net/bluetooth/eir.c and net/bluetooth/mgmt.c modules of Linux kernel allow a hacker to cause a service failure.

The vulnerability in the net/bluetooth/eir.c and net/bluetooth/mgmt.c modules of Linux kernel systems relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to cause a system failure...

The vulnerability of the Directum RX ECM system, related to deficiencies in access control, allows a perpetrator to compromise data integrity.

The vulnerability of the Directum RX ECM system is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to compromise data integrity...

CVE-2025-33073

CVE-2025-33073 Exploit PoC para la vulnerabilidad de reflexión NTLM en SMB. Todo el crédito va para la investigación oficial: https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 Requisitos previos SO: Kali Linux tiene la...

CallStackSpoofer

CallStackSpoofer Este repositorio demuestra una implementación de PoC para suplantar pilas de llamadas arbitrarias al realizar llamadas al sistema. Para una guía técnica completa, consulta la entrada de blog que acompaña a este repositorio aquí:...

zelos

Zelos Zelos（Z eropoint E mulated L ightweight O perating S ystem 的缩写，即零起点模拟轻量级操作系统）是一个基于 Python 的二进制模拟平台。其用途之一是通过命令行或 Python 脚本快速评估二进制文件的动态行为。所有系统调用都被模拟，以隔离目标二进制文件。支持 Linux x8664（32 位和 64 位）、ARM 和 MIPS 二进制文件。Unicorn 提供 CPU 模拟。 完整文档可在此获取。 安装 使用包管理器 pip 安装 zelos。 root@kitploit: pip install zelos 基本...

zelos

Zelos Zelos Z eropoint E mulated L ightweight O perating S ystem is a python-based binary emulation platform. One use of zelos is to quickly assess the dynamic behavior of binaries via command-line or python scripts. All syscalls are emulated to isolate the target binary. Linux x8664 32- and...

lsarelayx

lsarelayx 介绍 lsarelayx 是一个系统级的 NTLM 中继工具，旨在将传入的基于 NTLM 的身份认证中继到其运行的主机上。lsarelayx 将中继 任何 传入的身份认证请求，包括 SMB。由于 lsarelayx 会挂接现有的应用程序身份认证流程，该工具还会在中继完成后尝试服务原始的身份认证请求。这将防止目标应用程序/协议显示错误，并使其对向 lsarelayx 主机进行身份认证的最终用户而言，功能正常。 特性 系统级中继 NTLM 连接，包括 SMB、HTTP/HTTPS、LDAP/LDAPS 或任何其他实现 Windows 身份认证 API 的第三方应用程序。...

CVE-2022-30512

CVE-2022-30512 学校宿舍管理系统 1.0 - 未经身份验证的 SQL 注入 漏洞标题：学校宿舍管理系统 1.0 - 未经身份验证的 SQL 注入 日期：2022-05-25 CVE：CVE-2022-30512 漏洞作者：Abdulaziz Saad @b4zb0z 厂商主页：https://www.sourcecodester.com/ 软件链接：https://www.sourcecodester.com/php/15319/school-dormitory-management-system-phpoop-free-source-code.html 版本：1.0...

kin

AI changed who writes code. Kin changes what they build on. Kin is an open-source code repository and version control system for people and AI agents. It keeps track of how the code fits together, so you can investigate what a change might affect. Functions, types, recorded relationships, and...

grype

Grype A vulnerability scanner for container images and filesystems...

seeker

Available in Concept behind Seeker is simple, just like we host phishing pages to get credentials why not host a fake page that requests your location like many popular location based websites. Read more on thewhiteh4t's Blog .Seeker Hosts a fake website which asks for Location Permission and if...

grapheneX

grapheneX 在计算领域，加固通常是指通过减少系统的受攻击面来增强其安全性的过程，系统执行的功能越多，受攻击面就越大；原则上，单功能系统比多功能系统更安全。减少可用的攻击途径通常包括更改默认密码、删除不必要的软件、删除不必要的用户名或登录账户，以及禁用或移除不必要的服务。 grapheneX 项目旨在提供一个框架，通过自动执行加固命令来保障系统安全。 它既面向最终用户，也面向 Linux 和 Windows 开发者，这得益于其提供的多种交互界面（交互式 Shell/Web 界面）。 此外，grapheneX 还可用于加固 Web 服务器/应用程序。...

lazyrecon

root@kitploit: / \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Usage ./lazyrecon.sh -d domain.com To exclude particular subdomains: ./lazyrecon.sh -d domain.com -e...

CVE-2022-23131

zabbix-saml-bypass-poc cve-2022-23131 Este programa es solo para uso interno de autoevaluación de riesgos por parte de los usuarios empresariales del cliente. Prohibido su uso para cualquier forma de prueba de seguridad no autorizada. root@kitploit: fofa: app="ZABBIX-监控系统" && body="saml" Uso:...

CVE-2020-0753-and-CVE-2020-0754

CVE-2020-0753、CVE-2020-0754 的 Writeup 和 PoC，以及六个未修复的 Windows DOS 漏洞 利用文件系统竞争条件漏洞——CVE-2020-0753 和 CVE-2020-0754 分析 Windows 错误报告服务在最近的安全更新中修复了两个权限提升漏洞，分别标记为 CVE-2020-0753 和 CVE-2020-0754。这两个漏洞都利用了该服务文件系统操作中的竞争条件。但由于竞争窗口较小且文件落点不确定，这两个漏洞并不容易利用。我们在这里分享利用它们的技巧。 我们报告中给出了这两个竞争缺陷的根本原因，实际原因可以概括为 可预测即意味着脆弱...

hershell

Hershell NOTE: the project has been forked on this repo, check there for any other developments. Hershell is a simple TCP reverse shell written in Go. It uses TLS to secure the communications, and provide a certificate public key fingerprint pinning feature, preventing from traffic interception...

bulk_extractor

bulkextractor es una herramienta de explotación forense digital de alto rendimiento. Es un botón de "obtener evidencia" que escanea rápidamente cualquier tipo de entrada imágenes de disco, archivos, directorios de archivos, etc. y extrae información estructurada como direcciones de correo...