urlhunter

root@kitploit: o Utku Sen's /\o Oo |/ =- .===O- URL -O- / /U' hunter /|\ || |/ \ | utkusen.com |K || twitter.com/utkusenen urlhunter is a recon tool that allows searching on URLs that are exposed via shortener services such as bit.ly and goo.gl. The project is written in Go. How? A group named...

PoC-CVE-2024-44349

PoC-CVE-2024-44349 Vulnerability found and tested in Anteeo WMS - v4.7.31 The vulnerability allows threat actors to craft an SQL command inside the username parameter and disclose data in the underlying database. The impacted versions of ANTEEO B2B WMS are from v.4.7.x to v.4.7.34 excluded. Usage...

AgentMemshell

AgentMemshell A forked and further developed Agent memory shell based on MemShellParty, making it compatible with mainstream operating systems. Suitable for injecting memory shells into all Java processes in scenarios where command execution has no echo across all JDK versions. Currently only...

365Inspect

Purpose Further the state of Microsoft 365 security by authoring a PowerShell script that automates the security assessment of Microsoft 365 environments. Soteria Inspect Soteria Inspect is born from the 365Inspect project and is Soteria's SaaS solution to aid in assessing the security of a...

Debuggable-App-Exploit

CVE-2024-31317 Debuggable App Exploit A Python-based exploit for CVE-2024-31317 Android Zygote Injection that makes any installed Android app debuggable by injecting malicious zygote arguments through the hiddenapiblacklistexemptions setting. Includes optional Frida gadget injection for runtime...

redamon

Unmask the hidden before the world does An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merge...

pywhisker

pyWhisker pyWhisker is a Python equivalent of the original Whisker made by Elad Shamir and written in C. This tool allows users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object. It's based on Impacket and on a Python equivalent o...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

lacuna-rs

lacuna-rs Ghost-frame call-stack spoofing + runtime indirect syscalls for Windows x64 — ported to Rust. Ported from LACUNA Chain lacunachain.c by Mohamed Alzhrani 0xmaz. lacuna-rs is a reusable Rust crate that provides the same primitives as the original C TTP, structured so it can be dropped int...

Payload-and-Polyglot-Lists

Payload & Polyglot Lists Found a payload that doesn't work? Please open an issue with the payload, target context, and what you expected to happen. Pull requests with fixes or new payloads are always welcome. Research is ongoing. This project is under active development and will be updated...

chomp-scan

Chomp Scan A scripted pipeline of tools to simplify the bug bounty/penetration test reconnaissance phase, so you can focus on chomping bugs. If you've found any bugs using this tool, please let me know! Scope Chomp Scan is a Bash script that chains together the fastest and most effective tools in...

CLR-Unhook

CLR Unhooking Tool Note: For this to have the effect of a clean CLR, you’d need to manually map the DLL from disk into memory. You cannot use LoadLibraryA/W, because antivirus solutions will detect the DLL load event and may hook it immediately. If you want this behavior, you can look up existing...

malware-jail

malware-jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript Windows Scripting Host context env/wscript.js, at least the part frequently used by malware...

dhcpoptinj

DHCP option injector Have you ever wanted to intercept DHCP requests and squeeze in a few extra DHCP options, unbeknownst to the sender? Probably not. However, should the need ever come, dhcpoptinj will hopefully help you. Why There can be many a reason to mangle DHCP requests, although chances a...

AutoLocalPrivilegeEscalation

AutoLocalPrivilegeEscalation An automated script that download potential exploit for linux kernel from exploitdb, and compile them automatically This script is created due to Hackademics, there are so much possible exploit for that version of kernel, as a rookie OSCP student, I am not able to fin...

DCOMIllusionist

🎩✨🪄 DCOMIllusionist Windows fileless lateral movement technique. Introduction • Build • Usage • Technical Details • Acknowledgements Introduction This tool enables remote code execution on a Windows machine, if you have administrative privileges. It leverages DCOM and the behavior of .NET DCOM...

CVE-2026-58635-PoC

CVE-2026-58635: Windows Narrator Braille Local Privilege Escalation Proof of concept for CVE-2026-58635 , a command-injection vulnerability in Windows Narrator Braille. A local authenticated user can abuse a writable BrlAPI parameter to make the privileged BRLTTY service execute an arbitrary...

PowerShell-Red-Team

PowerShell-Red-Team-Enum Collection of PowerShell functions a Red Teamer may use to collect data from a machine or gain access to a target. I added ps1 files for the commands that are included in the RedTeamEnum module. This will allow you to easily find and use only one command if that is all yo...

Snoopy

root@kitploit: | || | | || || || || | | | | || || || || || || || | | | | || | | || | | || || || | | || || || || || || || | | || | | || || || | | | |||| |||||||| || V0.1 "Amy, technology isn't intrinsically good or evil. It's how it's used. Like the Death Ray." -Professor Farnsworth Welcome to...

CVE-2019-13027

CVE-2019-13027 Details for disclosing CVE-2019-13027 Vendor contact timeline: 1st July 2019 - No response, no email back. 4th July 2019 - No response, no email back. 8th July 2019 - Email sent, Github created. 11 July 2019 - No Vendor response. Vuln disclosed. Vulnerability Type SQL Injection...