CVE-2021-1675

PrintNightmare CVE-2021-1675 This Zeek script detects successful RpcAddPrinterDriver,Ex DCE RPC events, which are required to successfully exploit the vulnerability. Tests are based on exploit PCAP from Lares Lab. Tested with Zeek versions 3.0.2 and 4.0.1. Notices PrinterDriverChangedSuccessfully...

DSCourier_BOF

DSCourier BOF This is a BOF implementation of Dylan Davis and Matthew Schramm's DSCourier project. It uses WinGet's COM interface to execute arbitrary powershell code in a Microsoft signed and trusted process. Their full research blog can be found here. Unlike most projects I release, this is NOT...

dotnetfile

dotnetfile dotnetfile is a Common Language Runtime CLR header parser library for Windows .NET files built in Python. The CLR header is present in every Windows .NET assembly beside the Portable Executable PE header. It stores a plethora of metadata information for the managed part of the file...

FARO

FARO Document Sensitivity Detector Table of contents What is this What's in here? Run FARO with Docker Run FARO on host machine Prerequisites Virtual environment Dependencies NER models FARO Spider Single File Detection Technical Details FARO entity detector Configuration Supported Input File...

pentest_teamcity

Pentest TeamCity using Metasploit TL;DR: Obtain passwords fromJetBrains IDE like IntelliJ or PyCharm and use those credentials inside TeamCity Continuous Integration Server in order to get meterpreter session on server and build agents using metasploit by Kacper Szurek. JetBrains Comment This is ...

gha-lab-b9842b12c0

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of projen/projen at commit...

CVE-2026-108827 Zen Cart Administrative Module Management general.php zen_call_function code injection

A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zencallfunction of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument usefunction can lead to code injection. The attack can be...

CVE-2026-108827

Zen Cart versions up to 2.2.2 are affected by a code injection vulnerability in the Administrative Module Management component, specifically within the zen_call_function function located in admin/includes/functions/general.php. An attacker can remotely trigger code injection by manipulating the u...

EUVD-2026-97333

A vulnerability was determined in Zen Cart up to 2.2.2. Affected is the function zencallfunction of the file admin/includes/functions/general.php of the component Administrative Module Management. Executing a manipulation of the argument usefunction can lead to code injection. The attack can be...

s3dns

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

detectree

Detectree Detectree is a data visualisation tool for blue teams. It provides a graphical representation of detection data, which allows an analyst generate almost instant opinions about the nature of the underlying activity and to understand complex relationships between the data points...

ModuleStomping

Part 1 of Countercept's research on module stomping - see https://blog.f-secure.com/hiding-malicious-code-with-module-stomping . The full text of the associated blogpost is available in the Documentation directory...

pritunl

pritunl: enterprise vpn server Pritunl is a distributed enterprise vpn server built using the OpenVPN protocol. Documentation and more information can be found at the home page pritunl.com Install From Source Install MongoDB if running single host configuration sudo tee...

bcm4360-wpa3

WPA3-SAE + 802.11w on the Broadcom BCM4360 closed wl blob Apple/Broadcom never gave the BCM4360 14e4:43a0 WPA3. Its only Linux driver is the closed broadcom-sta wl blob; brcmfmac can't drive it. This adds WPA3-SAE + full 802.11w PMF to that closed blob — entirely from host software, no firmware...

exfil-scan

exfil-scan Scan LLM outputs and AI-generated content for data exfiltration signals before they reach users, logs, or downstream systems. 1 Why exfil-scan exists Modern LLM applications routinely process sensitive prompts, internal documents, API responses, and user data. That creates a new securi...

Embedded-PDF

Embedded Backdoor Connection via PDF Files 😈 brought to you by Introduction This demonstration video shows how we can control the victim's device by sending the innocent-looking PDF file to the target which actually consists of embedded payload. The exploit was made public as CVE-2010-1240. As so...

stegcloak

StegCloak The Cloak of Invisibility for your texts StegCloak is a pure JavaScript steganography module designed in functional programming style, to hide secrets inside text by compressing and encrypting the secret before cloaking it with special unicode invisible characters. It can be used to...

FollinaXploit

Follina Exploiter CLI Tool MSDT Vulnerability CVE-2022-30190 A Command Line based python tool for exploit Zero-Day vulnerability in MSDT Microsoft Support Diagnostic Tool also know as 'Follina' CVE-2022-30190. Info : New Microsoft Office zero-day used in attacks to execute PowerShell Made In...

pulsegram

PulseGram PulseGram is a keylogger integrated with a Telegram bot. It is a monitoring tool that captures keystrokes, clipboard content, and screenshots, sending all the information to a configured Telegram bot. It is designed for use in adversary simulations and security testing contexts. ⚠️...

ifuncd-up

in response to Hacker News... I see you jokers on the orange websitehn are giving me a hard time. I will make a few choice responses below, but first I offer a challenge: I will send $500 of my own money to the first person who can demonstrate this attack without ifunc. I am genuinely interested,...