shadow-fleet-tracker-light

Shadow Fleet Tracker Light Monitoreo de la flota fantasma del Mar Báltico mediante datos AIS en vivo. Observa más de 1200 embarcaciones del catálogo GUR de Ucrania sobre Guerra y Sanciones contra el feed WebSocket de AISStream, traza posiciones en un mapa que se actualiza solo, señala la proximid...

CamOver

CamOver CamOver es una herramienta de explotación de cámaras que permite revelar la contraseña de administrador de la cámara de red. Características Explota vulnerabilidades en los modelos de cámaras más populares como CCTV, GoAhead y Netwave. Optimizada para explotar múltiples cámaras a la vez...

awesome-incident-response

Awesome Incident Response A curated list of tools and resources for security incident response, aimed to help security analysts and DFIR teams. Digital Forensics and Incident Response DFIR teams are groups of people in an organization responsible for managing the response to a security incident,...

libptrace

libptrace libptrace es un framework de depuración, trazado y manipulación de procesos/hilos basado en eventos. Está escrito en C y tiene enlaces para Python 2.7 y 3.7. Está pensado para ser utilizado como biblioteca. La API se ha diseñado teniendo en cuenta la compatibilidad multiplataforma. Aunq...

ITScape

ITScape: Guest-to-Host Escape in KVM/arm64 Abstract This document describes the ITScape CVE-2026-46316 vulnerability reported and patched by Hyunwoo Kim @v4bel. It is a KVM escape vulnerability that lets a guest escape to the host in a KVM/arm64 environment and run commands on the host with kerne...

NetSpecter

NetSpecter NetSpecter is a lightweight yet powerful asynchronous OSINT and reconnaissance engine built in Python. It combines multi-source intelligence gathering DNS, WHOIS, Web, TLS, HTTP, Geo, Reverse DNS with Shodan-powered security intelligence and full raw data access, providing a complete...

CVE-2026-57827

CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE Split-Controller Upload Bypass → Direct Write Task → /downloads/shell.php → RCE Overview CVE-2026-57827 is a critical-severity CVSS 9.8 unauthenticated arbitrary file upload vulnerability in RSFiles! comrsfiles, a widely...

PHP-8.1.0-dev_WebShell-RCE

PHP 8.1.0-dev WebShell RCE Unauthenticated Exploit Code for PHP 8.1.0-dev WebShell RCE Unauthenticated Expected outcome: Exploiting backdoor installed on PHP 8.1.0-dev server thereby obtaining WebShell to execute commands remotely. Intended only for educational and testing in corporate...

PCLink

PCLink Server The secure backbone for your personal PC remote control ecosystem. PCLink is a modern, web-first server designed for secure remote PC management and high-performance screen streaming. Featuring a high-performance FastAPI backend, a responsive Web UI, and an extensible plugin system...

webvulscan

WebVulScan Synopsis WebVulScan is a web application vulnerability scanner. It is a web application itself written in PHP and can be used to test remote, or local, web applications for security vulnerabilities. As a scan is running, details of the scan are dynamically updated to the user. These...

Malware-analysis-and-Reverse-engineering

Malware-analysis-and-Reverse-engineering Some of my publicly available Malware analysis and Reverse engineering Reports, Tips, Tricks... Reverse engineering KPOT v2.0 Stealer Debugging MBR - IDA + Bochs Emulator CTF example TLS decryption in Wireshark Ryuk Ransomware - API Resolving and Imports...

CVE-2026-35616-check

CVE-2026-35616 Vulnerability Assessment Tool Safely detect whether a FortiClient EMS server is vulnerable to CVE-2026-35616 without causing any disruption. See the full write-up on the Bishop Fox blog. Description CVE-2026-35616 is a pre-authentication API bypass in FortiClient EMS 7.4.5 and 7.4....

python-codext

CodExt Codificar/decodificar cualquier cosa. CodExt es una biblioteca compatible con Python 2 y 3 que extiende la biblioteca nativa codecs especialmente para agregar nuevas codificaciones y mapeos de caracteres personalizados y proporciona más de 120 nuevos códecs , de ahí su nombre que combina...

PhEmail

PhEmail PhEmail is a python open source phishing email tool that automates the process of sending phishing emails as part of a social engineering test. The main purpose of PhEmail is to send a bunch of phishing emails and prove who clicked on them without attempting to exploit the web browser or...

Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting

Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting A stored cross-site scripting XSS in Nagios Log Server 2.1.7 can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page. Nagios Log Server 2.1.7 and older versions are affected...

remote-control

Remote Control for Laravel Grant remote access to user account without sharing credentials. Installation Configuration Usages Routing Creating Remote Access Using Generated Access Token Installation Remote Control can be installed via composer: root@kitploit: composer require...

FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability

FHEM-6.0-Local-File-Inclusion-LFI-Vulnerability LFI in FHEM 6.0 allows an attacker to include a file, it can lead to sensitive information disclosure. CVE-2020-19360 https://vulners.com/cve/CVE-2020-19360 PoC To exploit vulnerability, someone could use...

RP_Import_RCE

Real Player 'external::Import' Arbitrary file download, Directory Traversal Vulnerabilities leads to Remote Code Execution video demo: https://youtu.be/CONlijEgDLc Real Player uses Microsoft Internet Explorer functionality and exposes properties and methods through a special mean which is...

sshimpanzee

Sshimpanzee Sshimpanzee te permite construir un servidor ssh inverso estático. En lugar de escuchar en un puerto y esperar conexiones, el servidor ssh iniciará una conexión inversa a la IP del atacante, como un shell inverso normal. Sshimpanzee te permite aprovechar todas las características de u...

RealPlayer_G2_RCE

Real Player v.20.0.8.310 G2 Control 'DoGoToURL' Remote Code Execution Vulnerability Video demo: https://www.youtube.com/watch?v=9c9Q4VZQOUk Real Player G2 Control component contains a remote code execution vulnerability because it allows 'javascript:' URIs to be passed as the argument, which is...