RmiTaste

RmiTaste RmiTaste allows security professionals to detect, enumerate, interact and attack RMI services by calling remote methods with gadgets from ysoserial. It also allows to call remote method with specific parameters. Disclaimer RmiTaste was written to aid security professionals in identifying...

azazel

Azazel A lightweight eBPF-based runtime security tracer purpose-built for malware analysis sandboxes. Drop a sample into an isolated container, and Azazel captures every syscall, file touch, network connection, and suspicious behavior, then hands you a clean JSON stream of everything that happene...

CVE-2023-33977

CVE-2023-33977 Stored XSS Via SVG Upload in kiwitcms/kiwi - by M Nadeem Qazi Description This repository addresses the stored XSS vulnerability discovered in the kiwitcms/kiwi application, which was assigned the CVE-2023-33977 identifier. The vulnerability allows for the execution of malicious...

php-malware-finder

PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detect potentially malicious PHP files. What does it detect? PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files usi...

CVE-2023-46818-python-exploit

CVE-2023-46818 exploit This is a python version of the original php script for the vulnerability affecting ispconfig 3.2.11 and previous versions. Original PHP source: https://packetstormsecurity.com/files/176126/ISPConfig-3.2.11-PHP-Code-Injection.html This proof-of-concept is intended for...

PacketWhisper

PacketWhisper PacketWhisper - Stealthily Transfer Data & Defeat Attribution Using DNS Queries & Text-Based Steganography, without the need for attacker-controlled Name Servers or domains; Evade DLP/MLS Devices; Defeat Data- & DNS Name Server Whitelisting Controls. Convert any file type e.g...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a path traversal vulnerability due to Apache Ant

Summary Apache Ant is used by IBM Integrated Analytics System as a Java-based build and task execution tool. CVE-2026-78254 affects Apache Ant versions prior to 1.10.18, where the ftp and scp tasks allow a malicious server or a machine-in-the-middle attacker to provide relative paths during file...

DNS-Tunnel-Keylogger

DNS Tunnel Keylogger This post-exploitation keylogger will covertly exfiltrate keystrokes to a server. These tools excel at lightweight exfiltration and persistence, properties which will prevent detection. It uses DNS tunelling/exfiltration to bypass firewalls and avoid detection. Server Setup T...

Juiceshopgl

Juice Shop Logo OWASP Juice Shop Test Coverage Maintainability The most trustworthy online shop out there. @dschadow — The best juice shop on the whole internet! @shehackspurple — Actually the most bug-free vulnerable application in existence! @vanderaj — First you 😂😂then you 😢 @kramse — But this...

CVE-2021-36396-Moodle-Time-Based-SQLi-Exploit

CVE-2021-36396 Exploit Description This repository holds a Python-based exploit targeting CVE-2021-36393, a severe vulnerability found within Moodle's recent courses feature. The flaw resides in the 'sort' parameter, enabling SQL injection attacks that can lead to unauthorized database access...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components

Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...

catnip

Cat-Nip Automated Basic Pentest Tool this tool will make your basic pentesting task like Information Gathering, Auditing, And Reporting so this tool will do every task fully automatic. Usage Guide Download / Clone Cat-Nip git clone https://github.com/baguswiratmaadi/catnip Go Inside Cat-Nip Dir c...

BKScan

BKScan BlueKeep CVE-2019-0708 scanner that works both unauthenticated and authenticated i.e. when Network Level Authentication NLA is enabled. Requirements: A Windows RDP server If NLA is enabled on the RDP server, a valid user/password that is part of the "Remote Desktop Users" group It is based...

CVE-2024-48589

phpAbook 9.0i - Cross-Site Scripting XSS Vulnerability CVE-2024-48589 Summary: A Cross-Site Scripting XSS vulnerability was discovered in the rol parameter of index.php or the path section in the phpAbook application. This vulnerability allows an attacker to inject arbitrary JavaScript code into ...

CVE-2023-29489

CVE-2023-29489 SynixCyberCrimeMY CVE-2023-29489 Scanner By SamuraiMelayu1337 & h4zzzzzz@scc How To Usage ? git clone https://github.com/SynixCyberCrimeMy/CVE-2023-29489 cd CVE-2023-29489 pip3 install -r requirements.txt python3 eksepelot.py Thanks To All SynixCyberCrimeMY Members...

Java-Deserialization-Scanner

Java Deserialization Scanner Java Deserialization Scanner is a Burp Suite plugin aimed at detect and exploit Java deserialization vulnerabilities. It was written by Federico Dotta, Principal Security Analyst at HN Security. The plugin is made up of three different components: 1. Integration with...

XSS2Shell

XSS2Shell ULTIMATE v3.0 WordPress Pre-Auth XSS → RCE Chain Exploit Developed by G0D150NE 📌 Features 🔍 Auto-detect XSS & WordPress version 🎯 3 Modes: Auto, XSS, Direct 📡 Callback server to capture credentials 🐚 WebShell with multiple execution methods 🔄 Persistence cron job, hidden admin,...

latma

Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...

Redcloud

Weather report. Cloudy with a chance of shells! Early release. Follow me on Twitter to stay updated on Redcloud's development. 💁☁️🐚🌱 Quick Start - Architecture - Use-cases - Screenshots Introduction Redcloud is a powerful and user-friendly toolbox for deploying a fully featured Red Team...

CVE-2025-68147-OSPOS-Stored-XSS

CVE-2025-68147: Stored Cross-Site Scripting XSS in OpenSourcePOS Metadata| Details ---|--- CVE ID| CVE-2025-68147 Severity| High CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N Vulnerability Type| Stored Cross-Site Scripting CWE-79 Affected Versions| OpenSourcePOS v3.4.0, v3.4.1 Patched Version|...