AutoPWN-Suite

AutoPWN Suite AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically. Features CLI Fully automatic scanning and exploitation Detect network IP range without any user input Vulnerability detection based on service versions Web app vulnerability testing LFI, XS...

analyzer

This project automates the daily tasks of Threat Intelligence Analyzer role internally without external resources' interaction. It analyzes, visualizes and structures sensitive files Malware or data by extracting features, artifacts and IoC using different modules. The output of those modules can...

hashview

Hashview v0.8.2 Hashview is a tool for security professionals to help organize and automate the repetitious tasks related to password cracking. It is broken into two compoents, the Hashview Server, and Hashview Agent. The Hashview Server is a web application that manages one or more agents,...

defenselessV1

defenselessV1 Defenseless is a vulnerable web application written in PHP/MySQL. This is the first version of this application. The purpose of this application is to create security awareness among developers and new guys in application security. It would soon be updated with with more bugs and a...

osint-menace

OSINT Menace Open-Source Recon Console Built for Hunters, Not Browsers. OSINT Menace is a Defensive Thinking Project. OSINT Menace is a Dockerized Python web application for passive, case-driven OSINT triage. It gives analysts a simple cyberpunk-styled interface for running common open-source...

kraken

Warning I have been reviewing the Kraken-Client code and since this was my first ever react app, its old, clunky and it needs major improvement the server needs some work too. In the next few weeks/months I will do my best to rewrite it in either updated React or in another framework. Please feel...

insightsnexus

Insight Nexus - OSINT Investigation Graph Analysis Tool This local web application allows users to manipulate and connect nodes on their screen to streamline OSINT investigations and information gathering. Demo Become an Alpha Tester Sign Up Here: https://insightsnexus.org/ Features Core Graph...

LOLBITS

root@kitploit: ██╗ ██████╗ ██╗ ██████╗ ██╗████████╗███████╗ ██║ ██╔═══██╗██║ ██╔══██╗██║╚══██╔══╝██╔════╝ ██║ ██║ ██║██║ ██████╔╝██║ ██║ ███████╗ ██║ ██║ ██║██║ ██╔══██╗██║ ██║ ╚════██║ ███████╗╚██████╔╝███████╗██████╔╝██║ ██║ ███████║ ╚══════╝ ╚═════╝ ╚══════╝╚═════╝ ╚═╝ ╚═╝ ╚══════╝ Table of...

RedTeam_toolkit

RedTeam Toolkit Note: Only legal activities should be conducted with this project. Red Team Toolkit is an Open-Source Django Offensive Web-App containing useful offensive tools used in the red-teaming together for the security specialist to identify vulnerabilities. The cybersecurity open-source...

mobileAudit

Mobile Audit MobileAudit - SAST and Malware Analysis for Android Mobile APKs A Django web application to perform static analysis and detect malicious content inside Android APKs. The project extracts app metadata, scans source code for weaknesses, and aggregates results SAST findings, best...

modoboa 2.0.4 - Admin TakeOver

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...

Apache Tomcat Examples Web Application - Cross-Site Scripting

Apache Tomcat 8.5.50 to 8.5.81, 9.0.30 to 9.0.64, 10.0.0-M1 to 10.0.22, and 10.1.0-M1 to 10.1.0-M16 contain a reflected cross-site scripting caused by displaying unfiltered user data in the Form authentication example, letting attackers execute scripts in victim browsers, exploit requires attacke...

dotnetpaddingoracle

dotnetpaddingoracle Pequeño script para comprobar si la aplicación web .NET es vulnerable a padding Oracle Este script verifica realmente si el oráculo está presente y es explotable, no solo si el parche ha sido instalado. uso root@kitploit: dotnetpaddingoracle.py -h -t -b -d -s -p PARAMETER Burp...

CVE-2021-41647

CVE-2021-41647 CVE-2021-41647 Online-Food-Ordering-Web-App 中的 SQL 注入漏洞 Online-Food-Ordering-Web-App 存在未经验证的错误型和时间型盲 SQL 注入攻击漏洞。 /login.php 页面上的 username 参数未对用户输入进行清理，攻击者可以使用简单的绕过技术绕过登录。 应用链接 Online-Food-Ordering-Web-App 受影响的组件与参数 URL: /login.php 参数: username POC 登录绕过 PAYLOAD 要绕过用户登录并获得完全的管理员访问权限，...

rainmap-lite

rainmap-lite Rainmap Lite - Aplicación web receptiva que permite a los usuarios lanzar escaneos de Nmap desde sus móviles/tablets/navegadores web. A diferencia de su predecesor 1, Rainmap-lite no requiere servicios especiales RabbitMQ, PostgreSQL, Celery, supervisor, etc para facilitar su...

aurora

Aurora This is a proof-of-concept web app built on top of Frida. To get started: root@kitploit: npm install grunt server Then point your web browser at http://127.0.0.1:8010/...

malwinx

Malwinx A normal flask web app to learn win32api with code snippets and references. Prerequisite You need to download the following package before starting it root@kitploit: pip install flask pip install pefile pip install requests Usage root@kitploit: $ python flaskapp.py Live Demo...

social-analyzer

Social Analyzer - API, CLI y aplicación web para analizar y encontrar el perfil de una persona en más de 1000 redes sociales/sitios web. Incluye diferentes módulos de análisis y detección, y puedes elegir qué módulos usar durante el proceso de investigación. Los módulos de detección utilizan un...

domain-to-webapp

domain-to-webapp A simple bash script for finding web application hosted within a domain Requirements curl Subfinder docker image Usage root@kitploit: $./webAppChecker businesssolutions.com ./ouputdir ./scope.txt | \ | | \ \ / /| | / \ | | | |/ | ' \ / | | ' \ | / \ \ \ /\ / / \ ' \ / \ | ' | ' ...

ThePhish

ThePhish ThePhish is an automated phishing email analysis tool based on TheHive, Cortex and MISP. It is a web application written in Python 3 and based on Flask that automates the entire analysis process starting from the extraction of the observables from the header and the body of an email to t...