DirtyCOWTester

Dirty COW Tester...

qiling

Qiling's use case, blog and related work Qiling is an advanced binary emulation framework, with the following features: Emulate multi-platforms: Windows, macOS, Linux, Android, BSD, UEFI, DOS, MBR. Emulate multi-architectures: 8086, X86, X8664, ARM, ARM64, MIPS, RISC-V, PowerPC. Support multiple...

rr

Overview rr is a lightweight tool for recording, replaying and debugging execution of applications trees of processes and threads. Debugging extends gdb with very efficient reverse-execution, which in combination with standard gdb/x86 features like hardware data watchpoints, makes debugging much...

CVE-2015-8550

CVE-2015-8550...

Spring4Shell-CTF

Spring4Shell CVE-2022-22965 Vulnerability Environment Setup and CTF Challenge Design Project Overview This project includes dual-track security research implementations: 1. Traditional Vulhub Environment Setup : Leveraging the open-source Vulhub vulnerability database to quickly reproduce the...

jvmtiAgentLoad-Exploit

Arbitrary code execution via jvmtiAgentLoad Description: Tools and code for generating a malicious JAR to exploit jvmtiAgentLoad Usage: $ bash createjar.sh Usage: createjar.sh Supported TARGETOS options: linux|windows Linux Target The following command generates a JAR mal.jar that can be used on ...

action-octoscan

📦 :octocat: action octoscan A GitHub Action that performs a security scan of your GitHub actions. This action is based on octoscan 🤸 Usage Customizing inputs outputs Permissions 🤸 Usage Here is a basic example of how to use this action. This will work for both push and pullrequest events. --- nam...

pingback

Pingback C2 Detection A Zeek package and Suricata rules for detection of ICMP ping tunnels created by the Pingback C2 tool. Accompanying blog post: https://corelight.blog/2021/05/07/pingback-icmp-tunneling-malware/ Installation The easiest way to install this package is through zkg: zkg install...

eximrce-CVE-2019-10149

eximrce Simple python socket connection to test if exim is vulnerable to CVE-2019-10149. The payload simply touch a file in /root/lweximtest. Output will be slow depending on server's reply and not knowing how to properly use python's socket module. Would love a lesson on how to speed it up. Only...

exploits

exploits...

Loki-RS

Loki-RS A rewrite of Loki in Rust. High-performance, multi-threaded YARA & IOC scanner in a single binary. Status : Beta. Works, but still under active development. Features YARA scanning of files and process memory yara-x IOC matching MD5/SHA1/SHA256 hashes, filename patterns, C2 indicators...

CVE-2026-13001

CVE-2026-13001 Podlove Podcast Publisher CVSS 9.8 Critical | Unauthenticated Arbitrary File Upload leading to Remote Code Execution Overview Critical vulnerability in the Podlove Podcast Publisher WordPress plugin versions up to and including 4.5.1 that allows unauthenticated attackers to upload...

CVE-2025-69581

CVE-2025-69581 An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personaldata endpoint exposes full sensitive user information even after logout because proper cache-control is missing. Using the browser back button restores all personal data, allowing unauthorized users on the...

CVE-2025-65670

CVE-2025-65670 An Insecure Direct Object Reference IDOR in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the...

Solr-GRAB

Solr-GRAB Steal Apache Solr instance Queries with or without a username and password. DISCLAIMER : This project should be used for authorized testing and educational purposes only. Download git clone https://github.com/GnosticPlayers/Solr-GRAB Usage You can search for Apache Solr Instances via...

dnschan

dnschan This is a trojan that runs over DNS. You can: handle multiple agents very slowly upload files fetch files from the web run processes...

ZackAttack

===== ZackAttack! - Realying NTLM Like Nobody's Business ======= WTF Is This? tl;dr version - ZackAttack! is a new Tool Set to do NTLM Authentication relaying unlike any other tool currently out there. = So how is ZackAttack! different / better? Compared to other tools... Supports NTLMv2 : Brings...

CVE-2022-42889-POC

CVE-2022-42889-POC A simple demo application that shows how to exploit the CVE-2022-42889 vulnerability. Utilizes OOB Out of Band services to demonstrate dns and url prefixes. JavaDocs for commons-text interpolation commons-text JavaDocs Example interpolations script:javascript...

Azure_Workshop

Azure Red Team Attack and Detect Workshop This is a vulnerable-by-design Azure lab containing 2 x attack paths with common misconfigurations. These vulnerabilities are intended to represent those found in live production environments and the attack vectors are intended to be as realistic as...

Bluto-Old

BLUTO Bluto has moved to a new repo, this version is now deprecated. New version and repo can be found https://github.com/darryllane/Bluto Latest Version Features: DNS recon SubDomain Brute forcer DNZ Zone Transfers DNS Wild Card Checks DNS Wild Card Brute Forcing Email Enumeration Staff...

usbsas

usbsas is a free and open source GPLv3 tool and framework for securely reading untrusted USB mass storage devices. Overview Following the concept of defense in depth and the principle of least privilege, usbsas's goal is to reduce the attack surface of the USB stack. To achieve this, most of the...

CVE-2025-64446

CVE-2025-64446 FortiWeb Unauthenticated RCE via Path Traversal & CGI Auth Bypass...

jackson-check

jackson-check jackson-databind + jackson-core 共 26 条安全公告自查工具。零依赖单 jar,不联网。 它回答三个 Dependabot 回答不了的问题: 0. Dependabot 没收录的那条,我中没中? —— 截至 2026-10-05 只剩 jackson-core 的 CVE-2026-68498 一条见「v0.3.0」一节。 1. 这 26 条里,我真正中几条? —— 扫你的源码找触发条件@JsonView / 多态类型 / 大小写不敏感匹配……,把「装了受影响版本」降噪成「真的踩到那个特性」。 2. 我到底该升到哪个版本? ——...

cmdchamp

cmdchamp Bash CLI trainer — 30 levels from ls to privilege escalation. Every question asks you to type a real command — get instant feedback, move on. Miss one and it doesn't just show you the answer: it shows what YOUR command printed against what was wanted, and for a pipeline the line count at...

CVE-2024-3400-RCE-Scan

Cyberspace Mapping Dork Fofa app="paloalto-GlobalProtect" https://en.fofa.info/result?qbase64=YXBwPSJwYWxvYWx0by1HbG9iYWxQcm90ZWN0Ig%3D%3D Zoomeye app:"Palo Alto Networks firewall httpd"...

crestron_getsudopwd

crestrongetsudopwd Based on Ricky Lawshae discovery on Crestron TSW-X60 and MC3 devices, this tool aims to exploit the CVE-2018-13341. Using the MAC address of the targeted device, you can recover the password of the "crengsuperuser" hidden account which has elevated privileges and allow you to r...

vmware-exploitation

VMware Exploitation A collection of links related to VMware escape exploits. Pull requests are welcome. Follow @andreyknvl on Twitter or @[email protected] on Mastodon to be notified of updates. Research 2024 "Chaining N-days to Compromise All": "Part 4 — VMware Workstation Information...

My-Exploits

My-Exploits This repo is all about my-self coded exploit codes :...

pysap

pysap - Python library for crafting SAP's network protocols packets Version 0.2.2.dev0 in dev Overview SAP Netweaver and SAP HANA are technology platforms for building and integrating SAP business applications. Communication between components uses different network protocols and some services an...

catalyst

Catalyst Speed up your reactions Website - The Catalyst Handbook Documentation - Demo Catalyst is an incident response platform. It can help to automate your alert handling and incident response procedures. Features Ticket Alert & Incident Management Tickets are the core of Catalyst. They...

Common-Vulnerability-and-Exploit

Common-Vulnerability-and-Exploit-5638 This is the Apache Struts CVE-2017-5638 struts 2 vulnerability. The same CVE that resulted in the equifax database breach. A write up on how to apply, and patch against this exploit...

CVE-2025-56503

CVE-2025-56503 Description An issue in Sublime HQ Pty Ltd Sublime Text 4 4200 allows authenticated attackers with low-level privileges to escalate privileges to Administrator via replacing the uninstall file with a crafted binary in the installation folder. Affected Product Sublime Text 4, Versio...

ThreatPad

ThreatPad A collaborative, real-time note-taking platform built for Cyber Threat Intelligence CTI and security operations teams. ThreatPad combines the speed of modern productivity tools with CTI-specific capabilities: IOC auto-extraction, STIX 2.1 export, structured threat templates, and...

CVE-2022-0944_RCE_POC

CVE-2022-0944 Proof of concept exploit for SQLPad RCE CVE-2022-0944 leading to a RCE with a revershell to the attackers PC. Usage usage: script.py URL IP PORT positional arguments: URL URL to SQLPad IP Listener host address for reverse shell PORT Listener port for reverse shell Example: trigger...

CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE

CVE-2022-22947-Spring-Cloud-Gateway-SpelRCE CVE-2022-22947 Introduction Hazard Level: High POC/EXP Status: Public CNVD ID: CNNVD-2022-16402 Affected Versions: Spring Cloud Gateway 3.1.0 Spring Cloud Gateway =3.0.0, =3.0.6 Spring Cloud Gateway 3.0.0 Vulnerability Description Spring Cloud Gateway h...

CVE-2022-32832

CVE-2022-32832 Proof-of-concept and write-up for the CVE-2022-32832 vulnerability patched in iOS 15.6 CVE-2022-32832 is a vulnerability in the AppleAPFSUserClient::methodDeltaCreateFinalize external method selector 49. Here is the decompilation pre-patch: int64 cdecl...

CVE-2024-0012_CVE-2024-9474_PoC

🚀 CVE-2024-0012 & CVE-2024-9474 Palo Alto PAN-OS Exploit 🔐 🛡️ Description This Proof-of-Concept PoC script targeting vulnerabilities in Palo Alto PAN-OS, specifically CVE-2024-0012 and CVE-2024-9474 by automating the exploitation process, including autentication bypass, payload creation, chunked...

CVE-2024-51788

💀 CVE-2024-51788 - WordPress The Novel Design Store Directory Plugin = 4.3.0 - Unauthenticated Arbitrary File Upload 🚨 Overview CVE-2024-51788 is a newly disclosed critical vulnerability affecting the The Novel Design Store Directory WordPress plugin = v4.3.0. This flaw allows unauthenticated...

LinkedInDumper

LinkedInDumper Python 3 script to dump company employees from LinkedIn API 💬 Description LinkedInDumper is a Python 3 script that dumps employee data from the LinkedIn social networking platform. The results contain firstname, lastname, position title, location and a user's profile link. Only 2 A...

CVE-2026-11518-XSS

Stored XSS in Inventory System using PHP and MySQL Vulnerability Details Field| Details ---|--- Vulnerability Type| Stored Cross-Site Scripting XSS Affected Application| Inventory System using PHP and MySQL Vendor| SourceCodester Affected Version| 1.0 Affected File| register.php Parameters|...

CVE-2026-1056-POC

CVE-2026-1056-POC Snow Monkey Forms - Unauthenticated Arbitrary File Deletion PoC This repository contains a Proof of Concept PoC for a critical vulnerability in the Snow Monkey Forms WordPress plugin versions send; // Direct execution flow to send // CSRF check is only performed for other method...

CVE-2025-1304

🚨 WordPress NewsBlogger Theme = 0.2.5.1 - Arbitrary File Upload CVE-2025-1304 CVSS Score: 8.8 High Vulnerability Type: Arbitrary File Upload Component: WordPress Theme CVE ID: CVE-2025-1304 🔥 Vulnerability Overview The NewsBlogger WordPress theme versions = 0.2.5.1 is vulnerable to an Arbitrary...

CVE-2012-2982

CVE-2012-2982 This python script is written for vulnerability in Webmin 1.580, CVE-2012-2982. The vulnerability exists in the /file/show.cgi component and allows an authenticated user, with access to the File Manager Module, to execute arbitrary commands with root privileges. Installation Tested...

CVE-2024-22026

CVE-2024-22026 Exploit POC for CVE-2024-22026 affecting Ivanti EPMM "MobileIron Core" CVE-2024-22026 is a local privilege escalation vulnerability in Ivanti EPMM formerly MobileIron server versions prior to 12.1.0.0, 12.0.0.0, and 11.12.0.1. This vulnerability allows a local attacker to gain root...

BounceBack

BounceBack ↕️🤫 Stealth redirector for your red team operation security. Overview BounceBack is a powerful, highly customizable and configurable reverse proxy with WAF functionality for hiding your C2/phishing/etc infrastructure from blue teams, sandboxes, scanners, etc. It uses real-time traffic...

aixcc-afc-atlantis

Atlantis This repository contains Atlantis , Team Atlanta's Cyber Reasoning System CRS submitted to the AIxCC Final Competition AFC. Atlantis is designed to automatically discover and analyze vulnerabilities in software systems. The main system implementation is located in the...

CVE-2025-61299_POC

CVE-2025-61299POC Authenticated Command Injection in Nagios XI 2024R1 CVE-2025-61299...

CVE-2023-44487-HTTP-2-Rapid-Reset-Exploit-PoC

CVE-2023-44487 - HTTP/2 Rapid Reset Checker PoC Descriptions This main is a Proof of Concept PoC for CVE-2023-44487 , also known as the HTTP/2 Rapid Reset Attack. The vulnerability allows attackers to perform a Denial of Service DoS attack by rapidly sending RSTSTREAM frames over HTTP/2...

CVE-2023-46805

Title: Proof of Concept for CVE-2023-46805 - For Educational Use Only License: This work is placed under the Creative Commons Attribution 4.0 International License CC BY 4.0. You are free to share, copy, distribute, and transmit this work, to adapt it or use it for other purposes, provided the...

shirocrack

shirocrack Simple hash cracker for Apache Shiro hashes written in Golang. Useful for exploiting CVE-2024-4956. Let's keep this short CVE-2024-4956 is a path traversal vulnerability in Sonatype Nexus Repository that allows an unauthenticated attacker with network access to the server to read...