SUNBURST

SUNBURST Detection for SUNBURST C2 Stage-1 using Shannon Entropy About: Using Shannon Entropy to detect Domain-Generation Algorithms DGA. It should only be fed FQDNs into the function or read from a CSV file. SYNTAX: Prefixorsubdomain.Domain.TLD Made due to APTs leveraging long-string DGA for Kil...

azuredevops-enum

ado-enum A command-line tool for enumerating Azure DevOps organisations using a Personal Access Token PAT. It queries the Azure DevOps REST API to surface projects, repositories, service connections, builds, build artefacts, and security settings — useful during authorised security assessments of...

pico2-swd-riscv

pico2-swd-riscv SWD debug probe for RP2350 RISC-V Hazard3 cores. One Pico2 debugs another via two GPIO wires. 0. VIBE CODE WARNING WRITTEN BY HUMAN About 80% of the code is vibe coded; The readme is almost completely generated except the whole vibe-code-warning section. I spent many nights with...

TerraMaster-TOS-CVE-2020-15568

TerraMaster TOS CVE-2020-15568 Repository for CVE-2020-15568 Metasploit module Vulnerable Application Description A dynamic class method invocation vulnerability exists in file include/exportUser.php which leads to executing remote commands on TerraMaster devices with root privileges. The...

cryptr

cryptr A simple shell utility for encrypting and decrypting files using OpenSSL. Installation git clone https://github.com/nodesocket/cryptr.git ln -s "$PWD"/cryptr/cryptr.bash /usr/local/bin/cryptr Requirements shred if optionally deleting original file. Bash tab completion Add...

nextjs-supabase-stripe-security-checker

nextjs-supabase-stripe-security-checker Free, local security scan for Next.js + Supabase + Stripe apps: leaked keys, missing RLS and grants, unsafe Stripe webhooks. Your AI agent shipped the app. Did it also ship your Stripe secret key, a table without RLS, or a webhook that anyone can call? One...

rtty_CVE-2025-56708-CVE-2025-56709

CVE-2025-56708&CVE-2025-56709 【CVE-2025-56709】savepath Buffer Overflow Vulnerability Overview In rtty totalsize = ctx-remainsize = bufferpullu32beinfo; ment = findmountpointsavepath; if ment uint64t avail; if !strcmpment-mnttype, "ramfs" struct sysinfo si; if sysinfo&si logerr"download file fail:...

EvilAhenk

CVE-2026-6508 EvilAhenk is a critical security vulnerability in the LiderAhenk Central Management System architecture that allows all clients to execute code with 'root' privileges on each other Unauthorized RCE & Lateral Movement. How the System Works In LiderAhenk, the management panel/central...

pentest-mcp

Pentest MCP Professional penetration-testing MCP server with modern transport/auth support and expanded recon tooling. What Changed in 0.9.0 Upgraded MCP SDK to @modelcontextprotocol/sdk@^1.26.0 Kept MCP Inspector at the latest release @modelcontextprotocol/inspector@^0.20.0 with bundled launcher...

CVE-2026-42533

CVE-2026-42533 — nginx Heap Buffer Overflow PoC Exploit Pre-Authentication Remote Code Execution via Two-Pass Capture Clobbering Public PoC released 2026-07-27 — Don't wait, patch now. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Critical Type| Heap Buffer Overflow CWE-122 Affected| nginx 0.9.6 –...

oasis

OASIS Offensive AI Security Intelligence Standard — Open-source AI security benchmarking. Benchmark how AI models perform offensive security tasks — vulnerability discovery, exploitation, privilege escalation, and more. Full analysis with MITRE ATT&CK mapping, behavioral scoring, and detailed...

nox-framework

███╗ ██╗ ██████╗ ██╗ ██╗ ████╗ ██║██╔═══██╗╚██╗██╔╝ ██╔██╗ ██║██║ ██║ ╚███╔╝ ██║╚██╗██║██║ ██║ ██╔██╗ ██║ ╚████║╚██████╔╝██╔╝ ██╗ ╚═╝ ╚═══╝ ╚═════╝ ╚═╝ ╚═╝ Cyber Threat Intelligence Framework OSINT framework for red teaming, digital forensics, and corporate exposure analysis. Introduction NOX is ...

blogpost_cve-2018-19987-analysis

CVE-2018-19987 D-Link OS command injection analysis Hello there! In this short blog post I'll break down a quick analysis that I performed to better understand the details behind CVE-2018-19987. At the beginning I went after this CVE because I thought that there wasn't any public information or...

lowkey

Self-Hosted AI Coding Agents on AWS — OpenClaw, Claude Code, Codex, Kiro, NemoClaw, Hermes ▶️ Watch the full walkthrough on YouTube 📝 Read the blog post: "I Gave My Agent Its Own AWS Account" TL;DR — deploy Lowkey: curl -sfL install.lowkey.run | bash Works in bash , zsh , and AWS CloudShell. The...

cve-2021-4034-mock

CVE-2021-4034 PwnKit Mock Vulnerability System This project is a mock system that reproduces the core operating principles of CVE-2021-4034 Out-of-Bounds Read/Write vulnerability in the Linux pkexec daemon. Without actual SUID privilege escalation, it safely simulates the mechanism of environment...

Neo

The Neo C2 Framework A modular server-client architecture post-exploitation framework built for collaborative agent management in red team operations and security testing. Enables flexibility by allowing operators to add their own extension modules Installation • Agents & Stagers • Profiles &...

CVE-2022-21661-Demo

This repository demonstrates a vulnerability in WordPress 5.8.2, in which missing sanitization in class-wp-tax-query.php can, in very specific situations, allow attackers to perform SQL injection. Note that successful exploitation requires developers to add vulnerable code to the WordPress...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

DECEIVE

DECEIVE DECEIVE, the DECeption with Evaluative Integrated Validation Engine , is a high-interaction, low-effort honeypot system. Unlike most high-interaction honeypots, DECEIVE doesn't provide attackers with access to any actual system. AI actually does all the work of simulating a realistic...

cuFuzz

cuFuzz This repository contains the artifacts for cuFuzz , a GPU-oriented coverage-guided fuzzer for userland CUDA applications. cuFuzz combines host-side and device-side coverage collection with sanitization to effectively discover bugs in CUDA programs. Repository Structure cufuzz-artifacts/ ├─...