Xworm RAT

XWorm-RAT V2.1 ⚠️Attention: This tool is made distributed EXCLUSIVELY for security researches. Please, dont use it for illegal activity A famous XWorm RAT for free, all the popular RAT features. Please support this repository with a star⭐️ if you like it The archive is protected, the password is:...

meltdown-exploit

MELTDOWN EXPLOIT POC Speculative optimizations execute code in a non-secure manner leaving data traces in microarchitecture such as cache. Lipp et. al 2018 published their code 2018-01-09 at https://github.com/IAIK/meltdown. Look at their paper for details: https://meltdownattack.com/meltdown.pdf...

routersploit

RouterSploit - Exploitation Framework for Embedded Devices Community Join community on Embedded Exploitation Discord. Description The RouterSploit Framework is an open-source exploitation framework dedicated to embedded devices. It consists of various modules that aid penetration testing...

acltoolkit

acltoolkit acltoolkit is an ACL abuse swiss-army knife. It implements multiple ACL abuses. Table of Contents acltoolkit Table of Contents Installation Usage Commands get-objectacl set-objectowner give-genericall give-dcsync add-groupmember set-logonscript Installation pip install acltoolkit-ad or...

zkar

ZKar ZKar is a Java serialization protocol analysis tool implement in Go. This tool is still work in progress , so no complete API document and contribution guide. ZKar provides: A Java serialization payloads parser and viewer in pure Go, no CGO or JDK is required From the Java serialization...

anamnesis-release

Anamnesis: LLM Exploit Generation Evaluation This repository contains the evaluation framework for studying how LLM agents generate exploits from vulnerability reports in the presence of exploit mitigations. Given a bug report and proof-of-concept trigger, agents analyze vulnerable software and...

sshhipot

Version 2 is under development. Please switch to the v2 branch, build, and run with -h. SSHHiPot High-interaction SSH honeypot ok, it's really a logging ssh proxy. Still more or less a work-in-progress. Feel free to go install this repository if you'd like to try it. Run it with -h to see more...

awesome-osint-arsenal

🔍 AWESOME OSINT ARSENAL The Ultimate Open-Source Intelligence + Security Toolkit 751+ tools · 50 categories · Multi-distro installers · Georgian OSINT · Termux support The most comprehensive OSINT and security toolkit on the internet — every tool with installation instructions or a verified link....

fileintel

fileintel This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added. Files are identified by file hash MD5, SHA1, SHA256. The output is in CSV format and sent to STDOUT so the data can be...

PentestGPT

!Contributorscontributors-shieldcontributors-url !Forksforks-shieldforks-url !Stargazersstars-shieldstars-url !Issuesissues-shieldissues-url !MIT Licenselicense-shieldlicense-url !Discorddiscord-shielddiscord-url PentestGPT AI-Powered Autonomous Penetration Testing Agent Published at USENIX...

ByeDPIAndroid

ByeDPI for Android English | Русский Android application that runs a local VPN service to bypass DPI Deep Packet Inspection and censorship. This application runs a SOCKS5 proxy ByeDPI and redirects all traffic through it. Installation Or use Obtainium 1. Install Obtainium 2. Add the app by URL:...

natlas

Natlas Summary You've got a lot of maps and they are getting pretty unruly. What do you do? You put them in a book and call it an atlas. This is like that, except it's a website and it's a collection of nmaps. Natlas' objective is to make it easy to perform continuous scanning and review collecte...

CVE-2026-73570

CVE-2026-73570 — Zimbra ZCS SNMP Notification RCE exploit PoC Unauthenticated Remote Code Execution via OS Command Injection in the Zimbra Collaboration Suite SNMP notification handler. Overview Field| Value ---|--- CVE| CVE-2026-73570 CVSS 3.1| 8.9 HIGH — AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L CWE|...

Auto-PostXploit

Auto-PostXploit Windows Auto Post Exploitation - For ReD Team https://github.com/emilyanncr/Windows-Post-Exploitation/ Download : wget https://raw.githubusercontent.com/BehzaDMagzer/Auto-PostXploit/master/Auto-PostXploit.exe Usage : meterpreter upload %path%/Auto-PostXploit.exe...

area51

Every callback, captured. The exploit server for out-of-band findings. Point a target at a domain you own. Every HTTP request and every email it sends back lands in a dashboard you control, and it gets whatever response you choose in return. Getting started · Playbooks · CLI · Architecture ·...

sslyze

SSLyze SSLyze is a fast and powerful SSL/TLS scanning tool and Python library. SSLyze can analyze the SSL/TLS configuration of a server by connecting to it, in order to ensure that it uses strong encryption settings certificate, cipher suites, elliptic curves, etc., and that it is not vulnerable ...

LSPromise

LSPromise A complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel. It does not involve memory corruptions or race conditions, so attackers don't need to perform complex heap spraying or bypass mitigations against memory corruption vulnerabilities such ...

autoresponder

AutoResponder Carbon Black Response IR tool for hunting threats in an environment What is it? AutoResponder is a tool aimed to help people to carry out their Incident Response tasks WITH the help of Carbon Black Response's awesome capabilities and WITHOUT much bothering IT/System/Network Teams Wh...

CVE-2026-34486

CVE-2026-34486 — Apache Tomcat EncryptInterceptor RCE Apache Tomcat Tribes cluster communication module fails to discard messages when EncryptInterceptor decryption fails, allowing unauthenticated attackers to trigger Remote Code Execution via Java deserialization on port 4000. Vulnerability...

CVE-2026-76904

GeoServer WFS Inventory and Authorized Verification This repository contains two Python scripts for investigating GeoServer WFS endpoints. Overview wfsinventory.py Purpose: Inventory layers, XSD fields, and WFS values, and optionally verify candidates via a time-based check. Execution examples:...

popeye

Popeye: Kubernetes Live Cluster Linter Popeye is a utility that scans live Kubernetes clusters and reports potential issues with deployed resources and configurations. As Kubernetes landscapes grows, it is becoming a challenge for a human to track the slew of manifests and policies that orchestra...

rengine

reNgine: The Ultimate Web Reconnaissance & Vulnerability Scanner 🚀 reNgine 2.2.0 is released! reNgine 2.2.0 comes with bounty hub where you can sync and import your hackerone programs, in app notifications, chaos as subdomain enumeration tool, ability to upload multiple nuclei and gf patterns,...

cve-2026-1668-poc

Proof-of-concept exploit for CVE-2026-1668 This is a proof-of-concept exploit for CVE-2026-1668. It is intended purely for educational purposes only. Please do not attempt to exploit systems that you do not own or do not have explicit permission to exploit. This proof-of-concept was developed...

ida-pro-mcp

IDA Pro MCP !IMPORTANT I recommend using theOfficial Hex-Rays IDA MCP Server instead! See the announcement blog post for more information. Simple MCP Server to allow vibe reversing in IDA Pro. https://github.com/user-attachments/assets/6ebeaa92-a9db-43fa-b756-eececce2aca0 The binaries and prompt...

CVE-2025-54957

Dolby Unified Decoder CVE-2025-54957 POC When a file is processed by Dolby's DDPlus Unified Decoder, an out of bounds write is possible when the evolution data is processed. The decoder writes evolution information into a large, heap-like contiguous buffer contained by a larger struct, and the...

CVE-2018-16763_fuel_cms_exploit

⚠️ Disclaimer This project is strictly for educational and ethical security research purposes only. All activities were performed in a controlled lab / CTF environment. Do not use the techniques described here on any system without proper authorization. 🎯 Objectives Identify potential attack...

CVE-2026-54121-CertiGhost

CVE-2026-54121 Certighost - patched fork A working fork of the proof-of-concept tool for CVE-2026-54121, also known as Certighost. Original research and PoC by @H0j3n and @aniqfakhrul detailed analysis at: https://gist.github.com/H0j3n/a5ef2609b5f2944ac2390a191a534c26. This fork fixes the SAN...

Pwdlyser

Pwdlyser New repo for Public release Pwdlyser P assw ord -Analyser is a multi-functional analysis tool created to provide security professionals and organisations aiming to improve their security posture with the ability to easily review and analyse passwords from Active Directory domain accounts...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

CVE-2021-3279

CVE-2021-3279 https://www.cvedetails.com/cve/CVE-2021-3279/...

API-dnsdumpster.com

DNSDumpster API UNOFFICIAL ⚠️ IMPORTANT DISCLAIMER : This is an UNOFFICIAL API wrapper for dnsdumpster.com that scrapes the public website. DNSDumpster.com offers an official API plan for commercial and heavy usage. If you need reliable, production-grade access, please consider their official API:...

ubertooth

Ubertooth Project Ubertooth is an open source wireless development platform suitable for Bluetooth experimentation. Ubertooth ships with a capable BLE Bluetooth Smart sniffer and can sniff some data from Basic Rate BR Bluetooth Classic connections. The latest release is 2020-12-R1. The latest...

pocsploit

pocsploit 中文 README pocsploit is a lightweight, flexible and novel open source poc verification framework Pain points of the POC framework in the market 1. There are too many params, I don't know how to get started, but only some of them are commonly used. 2. YAML poc frameworklike nuclei & xray ...

moonwalk

moonwalk Cover your tracks during Linux Exploitation / Penetration Testing by leaving zero traces on system logs and filesystem timestamps. 📖 Table of Contents Introduction Features Installation Usage Contribution License ℹ️ Introduction moonwalk is a 400 KB single-binary executable that can clear...

dnspython

dnspython INTRODUCTION dnspython is a DNS toolkit for Python. It supports almost all record types. It can be used for queries, zone transfers, and dynamic updates. It supports TSIG-authenticated messages and EDNS0. dnspython provides both high- and low-level access to DNS. The high-level classes...

altdns

Altdns - Subdomain discovery through alterations and permutations Altdns is a DNS recon tool that allows for the discovery of subdomains that conform to patterns. Altdns takes in words that could be present in subdomains under a domain such as test, dev, staging as well as takes in a list of...

mediator

Mediator is an end-to-end encrypted reverse shell in which the operator and the shell connect to a "mediator" server that bridges the connections. This removes the need for the operator/handler to set up port forwarding in order to listen for the connection. Mediator also allows you to create...

cc.py

cc.py Extracting URLs of a specific target based on the results of "commoncrawl.org". Updated to v.0.3 | Whats new: 65% faster proceeding Specify a year via -y/--year, e.g.: -y 2018 Specify an output file via -o/--out, e.g.: -o whatever.txt Crawl all pages for a specific index -i/--index, e.g.:...

ansvif

ansvif A Not So Very Intelligent Fuzzer Marshall Whittaker oxagast [email protected] As the complexity of a system rises, as does the potential for problems within that system. --Whittaker's Law Compile Dependancies: automake autoconf-archive zlib1g-dev g++ gcc and libgtk2.0-dev if you want...

haptyc

Haptyc Test Generation Framework What's Haptyc? Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly well it also introduces a simpler way to express...

uncaptcha

uncaptcha Defeating Google's audio reCaptcha system with 85% accuracy. Disclaimer unCaptcha is intended to be a proof of concept. As of the time of our paper, we found it to successfully solve reCaptcha's audio challenges with 85% success. Since that time, reCaptcha appears to include some...

CVE-2026-25243-debugfree

CVE-2026-25243 — DEBUG-free Redis RCE private Reliable remote code execution from a single crafted RESTORE on jemalloc Redis — noDEBUG command, no /proc, no gdb, no ROP, ASLR on. Runs the attacker's command as the redis process root in default images. 🔒 Private repository — authorized security...

CVE-2026-76578

CVE-2026-76578 — FreeIPA Anonymous Admin Takeover Product: FreeIPA 4.9.x – 4.13.3 Severity: Critical CVSS 9.8 Fixed: FreeIPA 4.13.4 / 389-ds-base 3.2.0-10.el102 RHSA-2026:64785 Legal Notice This proof-of-concept was developed and executed exclusively within an isolated, privately owned lab...

msprobe

msprobe About Installing Usage Examples Coming Soon Acknowledgements About Finding all things on-prem Microsoft for password spraying and enumeration. The tool will used a list of common subdomains associated with your target apex domain to attempt to discover valid instances of on-prem Microsoft...

CVE-2024-57521-RuoYi-SQLi

🛡️ CVE-2024-57521 RuoYi-Vue Post-Authentication SQL Injection Vulnerability Audit Notes Figure 1: CVE-2024-57521 SQL Injection Vulnerability Data Flow Audit Diagram 0. Project Statement This repository is intended for security research and educational purposes only. Do not use the techniques in...

EXPLOIT-CVE-2026-8832

EXPLOIT CVE-2026-8832 An exploitation tool to test for Remote Code Execution RCE vulnerabilities in the WordPress plugin WPCode Lite Insert Headers and Footers v2.3.5. This vulnerability stems from registering the Custom Post Type CPT wpcode without defining a custom capabilitytype. This oversigh...

CVE-2023-34837

CVE-2023-34837 — eScan Management Console: Reflected Cross-Site Scripting XSS Overview CVE-2023-34837 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console version 14.0.1400.2281. The vulnerability exists in the GrpPath POST...

OpenSSH-4.7p1-CVE-2008-5161-Exploit

CVE-2008-5161 OpenSSH 4.7p1 Audit Helper Automates version checking and credential auditing of legacy OpenSSH 4.7p1 Debian-8ubuntu1 targets by driving Metasploit’s auxiliary/scanner/ssh/sshlogin module from Python via pwntools. This project is intended for research and authorized security testing...

CVE-2025-14598

CVE-2025-14598 CVSS: 9.8 Remote Unauthenticated SQL Injection leading to Remote Code Execution. Executive Summary A SQL Injection vulnerability was identified in the login functionality of BET e-Portal, a software solution widely deployed across educational institutions for student information an...

CVE-2026-0300

PAN-OS CVE-2026-0300 Non-Destructive Exposure Survey Tool Overview This tool is a non-destructive exposure survey utility for assessing whether a target PAN-OS service may expose network-accessible surfaces related to CVE-2026-0300. The tool is intended for authorized defensive security validatio...