thats_no_pipe

Thats no pipe Frida-based project to intercept Windows named pipe communication Objectives This project aims at intercepting IPC communications by hooking specific WinAPI functions and forwarding them to an HTTP proxy using a websocket. Architecture Read from and write to a named pipe can happen ...

rapid7-CVE-2026-15409

CVE-2026-15409 This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via...

CVE-2020-13935

Exploit for WebSocket Vulnerability in Apache Tomcat CVE-2020-13935 In the corresponding blog post the analysis and exploitation of the vulnerability is explained in detail. Usage Clone the repository, then build the tcdos binary. Run the program as follows to test whether a particular WebSocket...

CVE-2019-10915

La vulnerabilidad es un bypass de autenticación en el servidor TIA Administrator. Un atacante podría ejecutar comandos arbitrarios de la aplicación a través de websockets en el servidor node.js que está expuesto externamente por defecto. Al explotar esta vulnerabilidad, un atacante remoto no...

openclaw-security-monitor

OpenClaw Security Monitor Monitoreo proactivo de seguridad, escaneo de amenazas y visibilidad en tiempo real para implementaciones de OpenClaw. Detecta amenazas de la campaña ClawHavoc más de 824 habilidades maliciosas, stealer AMOS , infostealer Vidar , proxy malicioso GhostSocks , fuerza bruta...

CVE-2026-39987

POC del Exploit CVE-2026-39987 Descripción general Este repositorio contiene un script de Prueba de Concepto POC para CVE-2026-39987, una vulnerabilidad de Ejecución Remota de Código RCE previa a la autenticación en Marimo. El exploit aprovecha un endpoint WebSocket para ejecutar comandos...

nextssrf

root@kitploit: ╔══════════════════════════════════════════════════════════════╗ ║ NextSSRF — CVE-2026-44578 Scanner & Exploit ║ ║ Next.js WebSocket Upgrade Handler SSRF ║ ║ Affected: 13.4.13 → 15.5.15, 16.0.0 → 16.2.4 ║ ║ @mitsec / ynsmroztas — Bug Bounty Tooling ║...

CVE-2026-82930

The mH-DEVELOPER smart home module contains a vulnerability where the authorization middleware fails to verify tokens. This flaw leaves all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can exploit this to query endpoints, access system...

CVE-2026-82930 Missing Authentication in mH-DEVELOPER

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

jscythe

jscythe abuses the node.js inspector mechanism in order to force any node.js/electron/v8 based process to execute arbitrary javascript code, even if their debugging capabilities are disabled. Tested and working against Visual Studio Code, Discord, any Node.js application and more! How 1. Locate t...

chisel-ng

| | | | /| ' | / |/ \ | | ' \ / | | | | | | \ / || | | | | | || | ||/ || | | || , | |/ chisel-ng Una implementación en Rust de chisel para pruebas de penetración y operaciones de equipo rojo. Establece túneles inversos sobre SSH sobre WebSocket sobre TLS, permitiendo a los operadores pivotar a...

gotestwaf

GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...

wssip

This repository does not have a README...

atlantis-android

Atlantis Android Capture HTTP/HTTPS traffic from Android apps and send to Proxyman for debugging. Overview Atlantis Android es una biblioteca complementaria de Proxyman que te permite capturar e inspeccionar el tráfico de red de tus aplicaciones Android sin necesidad de configurar un proxy ni...

CVE-2024-55591-POC

PoC de I+D de ScaryByte para CVE-2024-55591 Un script integral todo-en-uno de prueba de concepto basado en Python para descubrir y explotar una vulnerabilidad crítica de bypass de autenticación CVE-2024-55591 en ciertos dispositivos Fortinet. Este script: 1. Instala las dependencias faltantes...

mitm-proxy

Go MITM Proxy A lightweight, developer-friendly Man‑in‑the‑Middle MITM HTTP/HTTPS proxy written in Go. It supports HTTP/1.1 and HTTP/2, CONNECT tunneling, WebSocket tunneling ws/wss, on‑disk response caching with flexible filters, and live config reloading. Badges Admin Dashboard Preview Overview...

grdpwasm

grdpwasm Un cliente RDP basado en web construido con Go WebAssembly y grdp. Conéctate a un servidor de Escritorio Remoto de Windows directamente desde tu navegador — sin necesidad de complementos. Arquitectura root@kitploit: Browser WASM ──WebSocket──► proxy Go ──TCP──► RDP Server Debido a que lo...

ROOT-APP-NPM-CVE-2026-48779 CVE-2026-48779 in ws - Patched by Root

Root has patched CVE-2026-48779 in the ws package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-37890 CVE-2024-37890 in ws - Patched by Root

Root has patched CVE-2024-37890 in the ws package for Root:npm. Multiple fixed versions available...

bmcweb

OpenBMC webserver This component attempts to be a "do everything" embedded webserver for OpenBMC. Features The webserver implements a few distinct interfaces: DBus event websocket. Allows registering for changes to specific dbus paths, properties, and will send an event from the websocket if thos...