Robber

Robber — DLL Hijack Scanner Free, open source tool for finding DLL hijacking opportunities in Windows executables. No third-party dependencies. What it does Windows loads DLLs by searching a fixed set of directories in order — the executable's own directory first, then System32, Windows, PATH...

SHA256-CDP

SHA256-CDP: Cyclic Digit-sum Projection GPU-accelerated rainbow table implementation of the CDP structural analysis framework for SHA-256. Built on the findings of the CDP paper DOI: 10.5281/zenodo.20627240, this repository provides a complete, working implementation of CDP-based rainbow chain...

lst2x64dbg

lst2x64dbg This command extracts all the labels found in the LST file that is given as the single argument. An x64dbg database is created in the current directory based on the extracted labels. The LST file can be generated in IDA from the File menu: Produce file - Create LST file... Example...

Joomblah

Joomblah Exploit for Joomla 3.7.0 CVE-2017-8917 Explanation about the vulnerability: https://blog.sucuri.net/2017/05/sql-injection-vulnerability-joomla-3-7.html Code modification Modification in line 46 root@kitploit: ... result += value.decode'utf-8' ... Usage Point the joomblah.py script at the...

CVE-2023-21716

CVE-2023-21716 Microsoft Word RTF Font Table Heap Corruption A vulnerability within Microsoft Office's wwlib allows attackers to achieve remote code execution with the privileges of the victim that opens a malicious RTF document. The attacker could deliver this file as an email attachment or othe...

page_table_walk

Capture the Flag in Physical Memory You've read about paging. The diagrams make sense. Four levels, 9 bits each, page frame, offset. Sure. But then you hit a challenge that requires actually walking page tables, and you realize you don't know it. You know about it. Big difference. What worked for...

kernel: rhashtable: clear stale iter->p on table restart

A flaw was found in the Linux kernel. This vulnerability, known as a use-after-free, occurs in the rhashtable component when the system improperly handles hash table restarts. An attacker could potentially exploit this by causing the system to access memory that has already been released, which m...

vmprotect-research

VMP Devirtualizer - Production Release Generalized VMProtect devirtualizer supporting versions 1.x, 2.x, and 3.x. Standalone CLI tool + Ghidra plugin. Status: ✅ Production Ready | Validation: 22/22 samples 100% | Scope: VMP ≤3.6 3.7+ requires reverse engineering Features Multi-Version Support: VM...

ksentinel

ksentinel - Kernel Syscalls Integrity Monitor Overview ksentinel monitors critical kernel functions and the syscall table for unauthorized modifications. It detects common syscalls that are targeted by most rootkits including ftrace hooks, kprobes, and syscall table hijacking. Features Function...

CVE-2024-37759_PoC

CVE-2024-37759 PoC Description DataGear version 5.0.0 and earlier has a SpEL expression injection vulnerability that leads to remote code execution. Exploit CVE Exploit Details When you request the /data/schemaId/tableName/view interface, if the database table does not have a primary key, an...

KVM-Januscape

KVM-XJ 热补丁 dumptool.py 是自动寻找偏移，怎么用就自己看代码 漏洞概述 CVE-2026-53359（Januscape）是 Linux 内核 KVM 影子 MMU 中的释放后使用（UAF）漏洞。 潜伏时间：16 年（2010年8月至2026年7月） 影响范围：所有启用嵌套虚拟化的 Intel/AMD x86 系统 危害等级：高危，VM 内 root 用户可逃逸到母鸡，获取母鸡 root 权限 利用方式：母鸡内核 panic（DoS）或完整虚拟机逃逸（无公开POC） 漏洞原理 kvmmmugetpage 函数在哈希表中查找可复用的影子页表时，仅比较了...

dcipher

dcipher Decipher hashes using online rainbow & lookup table attack services. Install root@kitploit: ❯❯❯ npm install dcipher Usage root@kitploit: const dcipher = require'dcipher'; dcipher'21232f297a57a5a743894a0e4a801fc3'.thenplaintext = console.logplaintext; //= 'admin' ;...

HintInject

HintInject HintInject is a shellcode embedder and loader that I developed while playing with the PE file and Import Directory Table structures. It takes a raw shellcode file and puts the shellcode in chunks into the Hint/Name Table entries which are reachable via the Import Lookup Table of a fake...

CVE-2023-24775-and-CVE-2023-24780

CVE-2023-24775 和 CVE-2023-24780 我的 Python POC 用于 2023-24780 和 CVE-2023-24775 这个 Funadmin 的 SQL 注入漏洞 这是一个包含 Python CVE SQL 注入 Funadmin 漏洞 POC 的仓库。 CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 受影响版本：Funadmin v3.2.0 漏洞位于 /databases/table/columns 中的 id 参数。 以及 CVE-2023-24775 -...

CVE-2026-68138

CVE-2026-68138 — Linux 内核 net/sched qdisc 速率表 UAF 跟踪站点 CVE-2026-68138 补丁状态跟踪器的来源：一个单页站点，记录哪些发行版已为 Linux 内核中 net/sched qdisc 速率表的释放后使用 / 双重释放（use-after-free / double-free）漏洞发布了修复。 事实所在 关于该漏洞的所有信息——CVE ID、受影响版本和已修复版本、上游修复提交、发现与披露致谢，以及当前各发行版的补丁状态——均属于跟踪器页面，而非本 README： 渲染页面：...

ProcessInjection

ProcessInjection 该程序旨在执行进程注入。 目前该工具支持 5 种进程注入技术。 root@kitploit: 1 Vanilla Process Injection 2 DLL Injection 3 Process Hollowing 4 APC Queue 5 KernelCallbackTable Injection 该工具接受 4 种格式的 shellcode。 root@kitploit: 1 base64 2 hex 3 c 4 raw 该工具支持 4 种进程注入方法。 root@kitploit: 1 P/Invoke 2 D/Invoke 3 Direc...

bambdas

Bambda 脚本 欢迎来到 PortSwigger 官方 Bambda 脚本仓库。本仓库收录了由 PortSwigger 和社区共同开发的脚本合集，满满都是🧡 📑 本页目录 Bambda 脚本类型 仓库内容 将脚本导入 Burp 更新库中的脚本 贡献你自己的脚本 资源 Bambda 脚本类型 Bambdas 是在受支持的 Burp 工具中运行的脚本。你可以通过创建以下内容快速定制 Burp Suite： 表过滤器 – 动态过滤 Burp 中的表。 表列 – 添加自定义表列以呈现重要数据。 Repeater 自定义操作 – 在 Burp Repeater 中提取、转换和分析数据。...

CVE-2020-2978

CVE-2020-2978 CVE-2020-2978 refrence link for PoC: https://databasesecurityninja.wordpress.com/2020/12/01/cve-2020-2978-rman-audit-table-point-in-time-recovery-not-logged/...

hashcatch

hashcatch Hashcatch deauthenticates clients connected to all nearby WiFi networks and tries to capture the handshakes. It can be used in any linux device including Raspberry Pi and Nethunter devices so that you can capture handshakes while walking your dog Written by @SivaneshAshok PoC of hashcat...

snowpick

snowpick 是一个 ServiceNow 暴露面扫描器，用于发现配置错误的小部件 ACL、REST API 访问控制以及未认证的数据暴露。 ServiceNow 通过两个常见的公共暴露面暴露数据：Service Portal 小部件和 Table REST API。当任一暴露面上的访问控制配置错误时，未认证的用户可能能够查询内部记录，例如事件工单、用户目录、知识库文章和服务目录项。snowpick 会测试这两个暴露面，将行数据暴露与仅计数证据区分开来，并为授权验证生成复现详情。 工作原理 snowpick 无需任何凭据即可从 ServiceNow...