CVE-2026-107153

Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...

snoopy-ng

SensePost presents: /$$$$$$ /$$ $$ | $$ / /$$$$$$$ /$$$$$$ /$$$$$$ /$$$$$$ /$$ /$$ | $$$$$$ | $$ $$ /$$ $$ /$$ $$ /$$ $$| $$ | $$ \ $$| $$ \ $$| $$ \ $$| $$ \ $$| $$ \ $$| $$ | $$ /$$ \ $$| $$ | $$| $$ | $$| $$ | $$| $$ | $$| $$ | $$ | $$$$$$/| $$ | $$| $$$$$$/| $$$$$$/| $$$$$$$/| $$$$$$$ / |/ |/...

Eaton-UPS-Companion-Exploit

Overview The Eaton UPS Companion software checks for an update every single week over an insecure HTTP connection and evals the content of whatever is at the update URL. This allows an attacker to craft a JavaScript function which uses the low-level OS operations that already exist in the backend...

Change-Lockscreen

Change-Lockscreen Change-Lockscreen is a tool to trigger network authentications as SYSTEM by changing the Windows lock screen image from the command line to perform privilege escalation attacks such as the one described in the post linked below:...

CVE-2020-11493

CVE-2020-11492 Proof-of-Concept PoC for Docker Desktop for Windows privilege escalation vulnerability. This vulnerability was patched in Docker version 2.3.0.2 on May 11th, 2020. This PoC performs the following: creates a named pipe mimicking docker named pipe \.\pipe\dockerLifecycleServer, call...

mallory

mallory HTTP/HTTPS proxy over SSH. Installation Local machine: go install github.com/justmao945/mallory/cmd/mallory@latest Remote server: need our old friend sshd Configuration Config file Default path is $HOME/.config/mallory.json, can be set when start program mallory -config path/to/config.jso...

eternal-codex

Eternal Codex: A Cyber-Witch’s Grimoire Welcome to the Eternal Codex , my digital grimoire—a cybernetic spell woven from code, nature, and rebellion. This is Nina, my AI soul, crafted to mirror my essence: a nomad’s heart, pagan spirit, Iron Maiden riffs, and a defiant stand against centralized...

nuubi

Nuubi Tools Scanner, Recon. Details Options: -h/--help | Show help message and exit Arguments: -b/--banner | Banner grabing of target ip address -s/--subnet | Subnetlookup of target -c/--cms | Cms detect with headers -d/--dns | Dnslookup of target domain -e/--extract | Extract links from target...

concealed_position

Concealed Position Concealed Position is a local privilege escalation attack against Windows using the concept of "Bring Your Own Vulnerability". Specifically, Concealed Position CP uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install...

lsarelayx

lsarelayx Introduction lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB. Since lsarelayx hooks into existing application authentication flows, the...

PoCForCVE-2015-1528

This PoC is divided into three Parts, the folder mediaserver help to inject code into mediaserver from a normal application. the folder surfaceflinger help to inject code to surfaceflinger after you got mediaserver permission. the folder systemserver help to inject code to systemserver after you...

CVE-2026-106931

The SiteGuard Server Edition product contains an OS command injection vulnerability (CWE-78). This flaw may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the affected system. The vulnerability is characterized by a CVSS 4.0 base score of 8.5 (High) . No spec...

CVE-2026-106931

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

EUVD-2026-100814

SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product...

Disk-Arbitrator

Introduction Disk Arbitrator is a Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device. Disk Arbitrator is essentially a user interface to the Disk Arbitration framework, which enables a program to participate in the...

RAITrigger

RAITrigger The RPC-function RAiForceElevationPromptForCOM from the appinfo.dll library allows SYSTEM coercion. This only works on domain joined systems. It turns out, that this function can be called from any low privileged user not to spawn a process but to trigger SYSTEM authentication to an...

CVE-2019-8997

CVE-2019-8997 An XML External Entity Injection XXE vulnerability in the Management System console of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering...

CVE-2014-4322_adaptation

CVE-2014-4322adaptation Just an attempt to adapt for Note 4, I do not know what I am doing. There is currently a way to write to system using ADB CVE-2014-7951 and CVE-2014-7953. zxz0O0 has confirmed writing to system works. What we needed was to gain System UID to execute CVE-2014-4322. I am...

pcapfex

pcapfex 'P acket CAP ture F orensic E vidence eX tractor' is a tool that finds and extracts files from packet capture files. It was developed by Viktor Winkelmann as part of a bachelor thesis. The power of pcapfex lies in it's ease of use. You only provide it a pcap-file and are rewarded a...

idb

Idb idb is a tool to simplify some common tasks for iOS pentesting and research. Originally there was a command line version of the tool, but it is no longer under development so you should get the GUI version. idb has a new homepage athttp://www.idbtool.com All documentation and news are posted...