go_parser

Yet Another Golang binary parser for IDAPro English |中文 NOTE : Now the latest master branch is the Python3 version. The old master branch has been changed to branch py2 , and temporarily not maintained. Instructions for Python3 branch This version is developed and tested on macOS/Windows, IDA7.4+...

cloudsploit

CloudSploit de Aqua - Escaneos de Seguridad en la Nube Inicio Rápido Genérico root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploi...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

CVE-2026-96456 Reachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated device

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

cloudsploit

CloudSploit by Aqua - Cloud Security Scans Quick Start Generic root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ npm install $ ./index.js -h Docker root@kitploit: $ git clone https://github.com/aquasecurity/cloudsploit.git $ cd cloudsploit $ docker buil...

EUVD-2026-85186

The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared...

Awesome-WAF

Awesome WAF Todo sobre los cortafuegos de aplicaciones web WAF desde una perspectiva de seguridad. 🔥 Prólogo: Originalmente, esta era mi propia colección sobre WAF. La publico como código abierto con la esperanza de que sea útil para pentesters e investigadores. Como dice el refrán, "la comunidad...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

botb

Salir de la Caja BOtB BOtB es una herramienta de análisis y explotación de contenedores diseñada para ser utilizada por pentesters e ingenieros, además de ser compatible con CI/CD usando tecnologías CI/CD comunes. ¿Qué hace? BOtB es una herramienta de línea de comandos que te permite: Explotar...

ThrottleStopPoC

ThrottleStopPoC CVE-2025-7771 : Arbitrary physical memory and I/O port read/write via ThrottleStop driver ThrottleStop is a small legitimate application used to monitor and correct CPU throttling. It has a driver that faciliates these tasks and it mostly doesn't have any sort of input validation...

ActiveDirectoryEnumeration

ADE - ActiveDirectoryEnum root@kitploit: python -m ade usage: ade -h --dc DC -o OUTFILE -u USER -s -smb -kp -bh -spn -sysvol --all --no-creds --dry-run --exploit EXPLOIT / | / / / \ / / / / / /| |/ / / / | / / / / / / / / / / / / / / / / / / / / / / \ / / // // /| |/ / / // / /...

enject

enject Hide .env secrets from prAIng eyes. Note: this project was previously called enveil and has been renamed to enject AI coding tools like Claude Code, Copilot, Cursor, and others can read files in your project directory, which means a plaintext .env file is an accidental secret dump waiting ...

Th3inspector

🚀🚀🔥🔥🔥CHECK MY NEW PRO PRIVATE TOOL 🔥🔥🔥🔥🚀🚀https://XAttackerV50.Pro Th3inspector Tool 🕵️ Th3inspector 🕵️ best tool for Information Gathering 🔎 ⭐ All in one tool for Information Gathering ⭐ Th3inspector 🕵️ best tool for Information Gathering 🔎 Screenshots Video Usage Examples To list all the basic...

neto

Project Neto: A Toolkit for Analysing Browser Plugins Overview Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to...

procrustes

Procrustes A bash script that automates the exfiltration of data over dns in case we have a blind command execution on a server where all outbound connections except DNS are blocked. The script currently supports sh, bash and powershell and is compatible with exec style command execution e.g...

hoverfly

Simulaciones de API para desarrollo y pruebas Hoverfly es una herramienta de simulación de API ligera y de código abierto. Con Hoverfly, puedes crear simulaciones realistas de las APIs de las que depende tu aplicación. Reemplaza dependencias de API lentas e inestables con simulaciones realistas y...

CVE-2023-36874_BOF

CVE-2023-36874 Windows Error Reporting LPE BOF Introduction This is a mature and operational CobaltStrike BOF implementation of Filip Dragovic's @filipdragovic CVE-2023-36874 Windows Error Reporting LPE exploit. He did the heavy lifting in terms of creating a working exploit by reversing the...

SharpMove

SharpMove - Ejecución autenticada .NET para hosts remotos Compilación Para compilar, abre el proyecto de Visual Studio y compílalo para la versión Release. Opciones WMI SCM DCOM Múltiples Programador de tareas Secuestro de DLL de servicio Secuestro de servidor DCOM Modificar tarea programada...

simvyn

simvyn Universal mobile devtool — control iOS Simulators, Android Emulators, and real devices from a single dashboard and CLI Table of Contents Quick Start Installation AI Coding Agents Features Module Showcases Collections Guide CLI Reference How It Works Supported Platforms Contributing Securit...

threatest

Threatest Threatest es una CLI y un framework en Go para probar la detección de amenazas de extremo a extremo. Threatest te permite detonar una técnica de ataque y verificar que se haya generado la alerta esperada en tu plataforma de seguridad favorita. Lee el anuncio en el blog:...