SkyWrapper

Overview SkyWrapper is an open-source project which analyzes behaviors of temporary tokens created in a given AWS account. The tool is aiming to find suspicious creation forms and uses of temporary tokens to detect malicious activity in the account. The tool analyzes the AWS account, and creating...

github-search

github-search A collection of tools to perform searches on GitHub. Install git clone https://github.com/gwen001/github-search cd github-search pip3 install -r requirements.txt Most of the time GitHub requires a token to perform searches. You can create a .tokens file in the cloned repo directory...

CVE-2019-0803

CVE-2019-0803 PoC de elevación de privilegios de Win32k Captura de pantalla Captura de pantalla Referencia robar token de seguridad https://github.com/mwrlabs/CVE-2016-7255...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and is optimized...

CVE-2025-59390-

CVE-2025-59390- The attached POC will allow you to crack the Kerberos signiture in Apache Druid and also, any integer created by ThreadLocalRandom Advisory - Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret...

CVE-2017-9934

CVE-2017-9934 Soy el reportero de este exploit, bajo el nombre: Envo Exploit PoC de CSRF para Joomla 1.7.3 - 3.7.2 Esta vulnerabilidad funciona debido a que las versiones de Joomla 1.7.3 a 3.7.2 no sanitizan la entrada base64. Headers: POST...

tko-subs

tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...

sandbox-attacksurface-analysis-tools

sandbox-attacksurface-analysis-tools Version 2. c Google LLC. 2015 - 2024 Entwickelt von James Forshaw Dies ist eine kleine Suite von PowerShell-Tools zum Testen verschiedener Eigenschaften von Sandboxes unter Windows. Viele der Tools akzeptieren einen -ProcessId-Schalter, mit dem die PID eines...

CVE-2026-9198

CVE-2026-9198 - IBM Langflow RCE no autenticado mediante bypass de auto-login PoC educativo Este repositorio proporciona una prueba de concepto educativa para CVE-2026-9198 que afecta a IBM Langflow OSS. El PoC poc.py demuestra cómo un atacante no autenticado puede encadenar: 1. GET/POST...

elevationstation

Stazione di Elevazione Rubare e duplicare i token SYSTEM per divertimento e profitto! Duplichiamo le cose, creiamo copie gemelle, e poi ce ne andiamo in sella. Hai usato getsystem di Metasploit e PSEXEC di SysInternals per ottenere privilegi di sistema, vero? Bene, ecco una versione standalone...

AzureRT

AzureRT Módulo de Powershell que implementa varios cmdlets para interactuar con Azure y Azure AD desde una perspectiva ofensiva. Utilidades útiles que manejan autenticación basada en tokens de acceso, cambio entre interfaces Az a AzureAD y az cli, ataques predefinidos fáciles de usar como ejecuci...

Masky

Masky Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope. This tool does not exploit any new vulnerability...

CVE-2021-21551

CVE-2021-21551 Exploit to SYSTEM for CVE-2021-21551 SpoolPrinter Privesc using SeImpersonatePrivileges was made thanks to @ForrestOrr https://github.com/forrest-orr/DoubleStar/tree/main/Payloads/Source/Stage3SpoolPotato I basically just tossed the exploit function in his code and altered it ever ...

SharpToken

SharpToken Durante el movimiento lateral del equipo rojo, a menudo necesitamos robar los permisos de otros usuarios. Bajo la defensa de un EDR moderno, nos resulta difícil usar Mimikatz para obtener otros permisos de usuario, y si el usuario objetivo no tiene ningún proceso activo, no tenemos for...

CVE-2024-21338

CVE-2024-21338 Vulnerabilidad de escalada de privilegios locales de Administrador a Kernel en sistemas operativos Windows 10 y Windows 11 con HVCI habilitado. Compilación Utilice Microsoft Visual Studio con el paquete de C++ para compilar correctamente el PoC tanto en modo Release como en modo...

xssless

xssless Un generatore automatico di payload XSS scritto in Python. Utilizzo 1. Registra le richieste con Burp proxy 2. Seleziona le richieste che vuoi generare, poi fai clic con il tasto destro e seleziona "Salva elementi" 3. Usa xssless per generare il tuo payload: ./xssless.py burpexportfile 4...

ssrf-sheriff

SSRF Sheriff Este es un sheriff de pruebas SSRF escrito en Go. Fue creado originalmente para el Uber H1-4420 2019 London Live Hacking Event, pero ahora se está publicando como código abierto para que otras organizaciones lo implementen y contribuyan. Características Responde a cualquier método HT...

CitrixBleedCVE-2026-8452-2025-5777

CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing. https://satoshi-box.com/pay/CSHeT8...

W3 Total Cache <= 2.9.3 - Unauthenticated Dynamic Security Token Disclosure

The W3 Total Cache WordPress plugin through version 2.9.3 skips its entire output buffering and processing pipeline whenever an incoming request's User-Agent header contains the string "W3 Total Cache", without authenticating the caller. On sites that use developer-placed dynamic fragment tags, t...

Flowise - NVIDIA NIM Endpoints Missing Authentication

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...