Impost3r

Impost3r Impost3r is a tool that aim to steal many kinds of linux passwordsincluding ssh,su,sudo written by C Attackers can use Impost3r to make a trap to steal the legal user's passwords XD This tool is limited to security research and teaching, and the user bears all legal and related...

ntlm_theft

ntlmtheft A tool for generating multiple types of NTLMv2 hash theft files. ntlmtheft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already insi...

Microsoft365_devicePhish

Microsoft365devicePhish Abusing Microsoft 365 OAuth Authorization Flow for Phishing Attack This is a simple proof-of-concept script that allows an attacker to conduct a phishing attack against Microsoft 365 OAuth Authorization Flow. Using this, one can connect to Microsoft's OAuth API endpoints t...

CamRaptor

CamRaptor CamRaptor is a tool that exploits several vulnerabilities in popular DVR cameras to obtain network camera credentials. Features Exploits vulnerabilities in most popular camera models such as Novo, CeNova and QSee. Optimized to exploit multiple cameras at one time from list with threadin...

The vulnerability of the TrueConf Server software, related to deficiencies in the authentication process, allows a perpetrator to obtain a token with administrator privileges.

The vulnerability of the TrueConf Server software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to obtain an administrator-level token...

Bad-Pdf

Bad-Pdf Bad-PDF create malicious PDF file to steal NTLMNTLMv1/NTLMv2 Hashes from windows machines, it utilize vulnerability disclosed by checkpoint team to create the malicious PDF file. Bad-Pdf reads the NTLM hashes using Responder listener. This method work on all PDF readersAny version most of...

EvilOSX

EvilOSX An evil RAT Remote Administration Tool for macOS / OS X. Marco Generator by Cedric Owens This project is no longer active Features Emulate a terminal instance Simple extendable module system No bot dependencies pure python Undetected by anti-virus OpenSSL AES-256 encrypted payloads...

GitBackdorizer

GitBackdorizer BETA GitBackdorizer is a proof of concept, fully inspired in Ulisses Castro's 50 ton of backdoors talk, that abuses the lack of user attention to steal git access credentials. How it Works GitBackdorizer consists of three pieces: handler, dropper and the payload. Handler The handle...

TurkoRat

TELEGRAM VERSION ⚔️ TurkoRat 🛡️ Telegram server: https://t.me/turcoflex Discord server: https://discord.gg/xTsJReFG84 joinnew discord 🌐 〢 Content 📁 Setting up ⚔️ Features 📸 Screenshots 📝 Todo 📜 License ⚠️ Note 📁 〢 Setting Up Install Node.js IMPORTANT: When installing Node.js also install "Tools for...

DumpBrowserSecrets

DumpBrowserSecrets Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers Chrome, Microsoft Edge, Firefox, Opera, Opera GX, and Vivaldi. Quick Links Maldev...

e013

e013 A little VBScript that steal Wifi passwords from Windows Into the file WifiName.txt you can see the password of every saved wifi available on every windows computer that support VBscript ⚠️ Don't modify the script with notepad, use text editor like GNU Emacs, Vim, Atom, Vscode, Sublime text...

365-Stealer

365-Stealer Table of Contents About 365-Stealer About Illicit Consent Grant Attack Key Features of 365-Stealer Setup Attacking Environment Automated Azure App Registration Manual Azure App Registration Configuring the Application Creating Client Secrets Adding API Permissions Setting Up 365-Steal...

cookie-monster

Cookie-Monster-BOF Steal browser cookies for edge, chrome and firefox through a BOF! Cookie Monster BOF will extract the WebKit Master Key and the App Bound Encryption Key for both Edge and Chrome, locate a browser process with a handle to the Cookies and Login Data files, copy the handles and th...

tanstack-compromise-checker

tanstack-compromise-checker Detecta indicadores del ataque a la cadena de suministro npm de TanStack en una máquina de desarrollo, un repositorio o un runner de CI. Script Bash, imagen Docker y acción de GitHub: el mismo motor, tres puntos de entrada. CVE-2026-45321 /GHSA-g7cv-rxg3-hmpx El 11 de...

KslKatzBof

KslKatzBOF 一种使用 KslD.sys BYOVD 技术从 C2 进行内联 LSASS 凭据提取的 Beacon 对象文件 BOF。 本项目基于以下博文： https://avantguard.io/blog/erfahrungsbericht-ki-gest%C3%BCtzte-bof-entwicklung-im-red-team 致谢 此 BOF 基于 KslKatz Maximilian Barz，而 KslKatz 本身又建立在两个基础项目之上： KslDump – 通过 KslD.sys Microsoft Defender 的内核驱动程序 进行 BYOVD...

ProxyVulns

ProxyVulns ProxyLogon Usage: python3 26855.py 1.1.1.1 ProxyOracle root@kitploit: Once a victim clicks this link, evil.com will receive the cookies...

codoforum

CVE-2020-5842 Vulnerabilidad de XSS almacenado en Codoforum 4.8.3 Listado en: Exploit-db, Cve Mitre y The daily swig Mientras buscaba un software de foro gratuito para nuestra comunidad, encontré Codoforum. Después de instalarlo, nosotros Vyshnav Vizz probamos algunos payloads XSS simples para...

CVE-2023-23397

Un PoC simple en PowerShell para CVE-2023-23397 CVE-2023-23397 es una vulnerabilidad en MS Outlook que permite a un atacante potencialmente exfiltrar detalles de autenticación del usuario. La vulnerabilidad se relaciona con la capacidad de un atacante de especificar una ruta UNC en la propiedad...

CVE-2024-55040-Sensaphone-XSS

DIVULGACIÓN DE VULNERABILIDADES DE SENSAPHONE Resumen A mediados de septiembre de 2024, identifiqué varios problemas de seguridad de severidad media a baja en el Sensaphone Web600 Monitoring System, incluyendo vulnerabilidades de cross-site scripting XSS almacenado en las opciones de Configuració...

sshLooter

DON'T USE THIS There's a C version which is much better sshLooterC sshLooter Script to steal passwords from ssh. Install root@kitploit: git clone https://github.com/mthbernardes/sshLooter.git cd sshLooter Configuration root@kitploit: Edit the script on install.sh, and add your telegram bot api, a...