CVE-2026-3304

CVE-2026-3304 Lab Environment For educational and research purposes only. Attacking systems without authorization is illegal. This lab environment was built by analyzing the Multer 2.1.0 patch and its official test code. The vulnerable server replicates the exact conditions described in the patch...

CVE-2022-36804-POC

CVE-2022-36804-POC 🕷️ Bitbucket CVE-2022-36804 unauthenticated remote command execution Exploitation Find publicly visible repositories - example.com/repos?visibility=public...

phantom-playbooks

This is the Corelight Repository for Community Playbooks developed for Splunk Phantom. These provide some examples for you to craft your own playbooks. Corelight Investigate DNS Alert This playbook takes a saved search or alert mechanism for DNS from Splunk and pulls the Zeek UID for the alerts. ...

nmap-vulnerability-scan-scripts

Synopsys CyRC Vulnerability Advisory: https://www.synopsys.com/blogs/software-security/cyrc-advisory-remote-code-execution-vulnerabilities-mouse-keyboard-apps.html CVE-2022-45477, CVE-2022-45479, CVE-2022-45482, CVE-2022-45481...

poc-cve-2024-38396

CVE-2024-38396 and CVE-2024-38395 This PoC can e used either via a docker run or simply cat. This repository contains the docker file for vin01/escape-seq-test:cve-2024-38396. The PoC simply opens a calculator on OS X. How to run: Example 1. cat simpler-poc-title-report-code-execution.txt Example...

Log4Pot

Log4Pot A honeypot for the Log4Shell vulnerability CVE-2021-44228. License: GPLv3.0 Features Listen on various ports for Log4Shell exploitation. Detect exploitation in request line and headers. Download exploit payloads recursively. Log to file and Azure blob storage. Usage 1. Install Poetry: cur...

CVE-2026-65343

CVE-2026-65343 — AppleKeyStore OOB Read KASLR Defeat Component: AppleKeyStore kernel extension — LibSerSEPControlDeserialize Affected: iOS / iPadOS 26.6 23G71 and earlier Fixed in: iOS / iPadOS 26.6.1 23G83 Type: Out-of-Bounds read in SEP control message deserialization Impact: Kernel pointer lea...

CVEs

CVEs This repository contains publicly disclosed vulnerabilities reported during my security research activities. Notes The repository may include: Technical write-ups Vulnerability details References Security analyses Additional research related to published disclosures Research Interests...

ThreatDetect

ThreatDetect ThreatDetect is a Streamlit-based insider threat detection prototype that analyzes employee activity data and flags potentially risky behavior. It uses a trained XGBoost classifier together with an Isolation Forest anomaly detector to produce organisation-level risk summaries and...

CVE-2026-33701-Unsafe-Deserialization-in-OpenTelemetry-Java-Agent-RMI-Instrumentation

CVE-2026-33701 — Unsafe Deserialization in OpenTelemetry Java Agent RMI Instrumentation Severity: Critical CVSS v4.0: 9.3 Affected versions: opentelemetry-javaagent 2.26.1 Patched in: 2.26.1 released March 23, 2026 Overview OpenTelemetry is probably the most widely adopted observability framework...

CVE-2019-16278-PoC

CVE-2019-16728-PoC CVE-2019-16728 Reference https://git.sp0re.sh/sp0re/Nhttpd-exploits/src/branch/master/CVE-2019-16278.sh...

CVE-2021-24098

CVE-2021-24098 POC for CVE-2021-24098, a Denial Of Service bug in condrv.sys...

pyxamstore

Xamarin AssemblyStore Explorer pyxamstore This is an alpha release of an assemblies.blob AssemblyStore parser written in Python. The tool is capable of unpack and repackaging assemblies.blob and assemblies.manifest Xamarin files from an APK. Installing Run the installer script: python setup.py...

CANalyzat0r

This software project is a result of a Bachelor's thesis created atSCHUTZWERK in collaboration with Aalen University by Philipp Schmied @CaptnBanana. Please refer to the correspondingblog post for more information. Why another CAN tool? Built from scratch with new ideas for analysis mechanisms...

CVE-2026-31431-REVSHELL

█▀▀ ▄▀█ █ █ █▀█ █▀█ █▀█ ▀█▀ █▀░ █▀█ █ █▄▄ █▀▄ █▄█ █▄█ ░█░ CVE-2026-31431 • Linux Kernel LPE → Root Reverse Shell Overview FailRoot is a weaponized exploit for CVE-2026-31431 — an out-of-bounds write in the Linux kernel's crypto: algifaead subsystem. It chains a privilege escalation with a...

BlueFish

BlueFish BlueFish is a Python-based automation tool designed to simplify the analysis of PCAP Packet Capture files. It leverages the power of Wireshark's command-line tool, tshark, to extract valuable information from network captures. With BlueFish, you can quickly identify potential login...

IoT-Vulnerability-Research-Public

Hardware Security & Vulnerability Research This repository serves as a centralized public archive for my independent vulnerability research, hardware audits, and Coordinated Vulnerability Disclosures CVD. All proof-of-concept scripts, firmware extractions, and hardware teardowns are published her...

JoomlaCVE20168869

Exploit for Joomla 3.4.4 - 3.6.4 CVE-2016-8869 and CVE-2016-8870 with File Upload web shell This is PHP port, original python source code provided by @link https://github.com/XiphosResearch/exploits/tree/master/Joomraa Usage: php exploit.php --username hacker -p password -e [email protected]...

ip-finder-cli

IPFinder CLI Command Line Interface https://ipfinder.io/ Supports Single IP Address, asn, ranges, firewall as Input Supports Bulk Exports Results to Screen or to An Output File Supports IPv4 and IPv6 Supports ASN number , RANGES , Firewall Getting Started sign up for a free account at...

CVE-2024-41107

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ 🚀 CVE-2024-41107...

pwnfaces

😛 pwnfaces Primefaces 5.X EL Injection Exploit 🕵️ What is pwnfaces? 🕵️ pwnfaces is a Golang tool created to exploit the vulnerability defined as CVE-2017-1000486 EL Injection in PrimeFaces 5.X ⚡ Installing / Getting started A quick guide of how to install and use pwnfaces. 1. go install...

maude-hcs

Maude-HCS Maude-HCS is one of the first generalized and modular toolchains for formally specifying and reasoning about Hidden Communication Systems HCS at real-world scales. It enables network designers to explore alternative HCS designs quickly and effectively and provides formal...

brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

CVE-2024-43018

CVE-2024-43018 Assign an ID Be officially populated in CVE - Mitre Index Description Technologies used Source and Sink How to execute it Fix Authors Description While investigating for the thesis https://hdl.handle.net/10316/118126 and https://hdl.handle.net/10316/118059 a new vulnerability on...

apatchy

apatchy An in-process fuzzing framework for Apache HTTPD apatchy lets you fuzz Apache's full HTTP request processing pipeline - parsing, hooks, filters, handlers - without any network I/O. It replaces Apache's socket layer with custom I/O filters, feeding raw bytes directly into the same code pat...

copy-fail-CVE-2026-31431-C

copy-fail-CVE-2026-31431-C Verified on ubuntu 24,ubuntu 25,kali 2026. gcc -o exploit exploit.c -lz && chmod +x exploit && ./exploit Static compilation sudo apt install zlib1g-dev gcc -static -o exploit exploit.c -lz or aarch64-linux-gnu-gcc -o exploit exploit.c -lz -static...

patriot

Patriot Small research project for detecting various kinds of in-memory stealth techniques. Download the latest release here. The current version supports the following detections: Suspicious CONTEXT structures pointing to VirtualProtect functions. Targets research by Austin Hudson Foliage and Ek...

CVE-2019-18426

WhatsApp Vulnerabilities Disclosure - Open Redirect + CSP Bypass + Persistent XSS + FS read permissions + potential for RCE CVE-2019-18426 Technical Article Original Vulnerabilities Disclosures Documents DEMO Vids!...

tkeypoc

PoC for CVE-2015-5477 BIND9 TKEY DoS This code sends UDP packet that crashes vulnerable BIND9 DNS servers. elceef@osiris:/tkeypoc$ ./tkeypoc.py localhost CVE-2015-5477 BIND9 TKEY PoC Sending packet to localhost ... Done...

Windows-10-Exploit

This repository does not have a README...

TTPRunner

TTPRunner Autonomous TTP execution agent for purple team operations Feed it a threat report. It builds the attack plan. You approve. It executes. Features Feature| Description ---|--- Multi-Format Parsing| PDF LLM-powered, STIX 2.1, Markdown, URLs - paste a threat report and go LLM Analysis|...

xurlfind3r

xurlfind3r xurlfind3r is a command-line utility designed to discover URLs for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly...

CVE-2026-46529

RCE via PDF argv injection CVE-2026-46529 atril/xreader/evince Working proof-of-concept for the argv injection in evspawn shell/ev-application.c. A single click anywhere on the rendered page of a crafted PDF triggers arbitrary code execution as the user running the viewer. This release uses the...

SpeculativeExecutionAssessment

SpeculativeExecutionAssessment Assesses a system for the "speculative execution" vulnerabilities described in: CVE-2017-5715 branch target injection CVE-2017-5753 bounds check bypass CVE-2017-5754 rogue data cache load WARNING: Ensure that "Prefer 32-bit" is not checked in the build options...

CVE-2024-23897

Usage python poc.py usage: python poc.py http://127.0.0.1:8888/ /etc/passwd...

birdy-edwards

BIRDY-EDWARDS 2.0 Infiltrate & Expose Automated AI powered Facebook intelligence tool for target profiling, network analysis and threat reporting. Runs entirely on-device via Ollama. AI-powered Facebook SOCMINT platform — 100% local, zero cloud dependency. For lite version check this repo click...

SAFE

SAFE : Self Attentive Function Embedding Paper This software is the outcome of our accademic research. See our arXiv paper: arxiv If you use this code, please cite our accademic paper as: @inproceedingsmassarelli2018safe, title=SAFE: Self-Attentive Function Embeddings for Binary Similarity,...

rdpy

RDPY Remote Desktop Protocol in twisted python. RDPY is a pure Python implementation of the Microsoft RDP Remote Desktop Protocol protocol client and server side. RDPY is built over the event driven network engine Twisted. RDPY support standard RDP security layer, RDP over SSL and NLA...

aws-iam-authenticator

AWS IAM Authenticator for Kubernetes A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster. The initial work on this tool was driven by Heptio. The project receives contributions from multiple community engineers and is currently maintained by Heptio and Amazon EKS OSS...

sslscan

sslscan2 sslscan version 2 has now been released. This includes a major rewrite of the backend scanning code, which means that it is no longer reliant on the version of OpenSSL for many checks. This means that it is possible to support legacy protocols SSLv2 and SSLv3, as well as supporting TLSv1...

NotProxyShellScanner

NotProxyShellScanner Python implementation for NotProxyShell aka CVE-2022-40140 & CVE-2022-41082. Setup Install the requirements all that's required is python3 requests. pip3 install -r requirements.txt Running There are a few options when it comes to running the tooling: usage: NotProxyShell.py ...

CVE-2011-2523

CVE-2011-2523 These are notes for creating the attack methodology in a controlled environment. It is assumed that the exercise is black-box, so I have no knowledge of the victim system. 1. Download the necessary ISOs, both Metasploitable2 and Kali or any other. 2. Important: the environment is...

Exploitation-CVE-2020-8835

This repository does not have a README...

grapheneX

grapheneX In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle a single-function system is more secure than a multipurpose one. Reducing available ways of attack typically...

POC-of-CVE-2022-36271

POC-of-CVE-2022-36271 The name of an affected Product : Outbyte PC Repair Installation File The affected version : 1.7.112.7856 The CVE ID for the entry : CVE-2022-36271 Description: iertutil.dll is missing so an attacker can use a malicious dll with same name and can get a admin privileges and...

CVE-2021-40531

CVE-2021-40531 This proof-of-concept in action. Sketch is a popular UI/UX design app for macOS. This post covers a vulnerability in Sketch that I discovered back in July, CVE-2021-40531. In its simplest form, it is a macOS quarantine bypass, but in context it can be used for remote code execution...

log4jshield

Demo • Features • Requirements • Installation • Usage • Contributing • Contact Log4j Shield - fast ⚡, scalable and easy to use finder and patcher No Log4j vulnerability left behind You can use this tool to scan for all JAR files affected by Apache Log4J vulnerability CVE-2021-44228 and patch them...

Sophos-Vulnerability

Analysis of Vulnerability CVE-2022-1040 Sophos RCE In the research group Toasec, dedicated to offensive cybersecurity, we took on the task of analyzing this vulnerability in Sophos firewalls. This vulnerability, like many others, can be reported and found if you know how to search on Twitter, whe...

FsquirtCPLPoC

Fsquirt.exe Windows binary attempts to load a Control Panel applet CPL called bthprops.cpl from its current working directory. When bthprops.cpl is present alongside fsquirt.exe, the binary loads it and executes a MessageBox from DLLMain. This PoC code generates a malicious bthprops.cpl file that...

larac2shell

LaraC2 Shell -- MDE Live Response Interactive Shell Cross-platform interactive shell for Microsoft Defender for Endpoint Live Response. Feature| Detail ---|--- Platform| PowerShell Core 7.0+ Windows, Linux, macOS API modes| Internal portal, near-realtime and Official public, stateless Execution|...