46679 matches found
ProxyShell
ProxyShell CVE-2021-34473 CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability. This faulty URL normalization lets us access an arbitrary backend URL while running as the Exchange Server machine account. Although this bug is not as powerful as the SSRF in ProxyLogon, and w...
rsdl
rsdl Subdomain Scanner v.2 Subdomain Scan With Ping Method & Check HTTP/S Statuses. Flags| Value| Description ---|---|--- --hostname| example.com| Domain for scan. --output| | Records the output with the domain name. --list| /tmp/lists/example.txt| Lister for subdomains. New Features Checking...
CVE-2026-23947-PoC
Walkthrough: CVE-2026-23947 - Orval Arbitrary Code Execution This walkthrough demonstrates how an untrusted OpenAPI specification can exploit Orval to inject arbitrary code into generated clients via the x-enumDescriptions and x-enumNames fields. Prerequisites Node.js v20 or v22 npm Setup 1. Crea...
SSHBuster
SSHBuster SSHBuster is a powerful command-line SSH brute-forcing tool designed for ethical hacking and penetration testing. It performs dictionary-based attacks to find valid SSH login credentials efficiently. Features Brute-force SSH servers using different username and password combinations...
PoC_iOS12
PoCiOS12 PoC Exploit iOS 12 to iOS 12.1 CVE-2018-4431 Kernel is available for: iPhone 5s and later, iPad Air and later and iPod Touch 6th generation...
DjVul_StringAgg
Django CVE-2020-7471 SQLi CVE-2020-7471: Potential SQL injection via StringAggdelimiter django.contrib.postgres.aggregates.StringAgg aggregation function was subject to SQL injection, using a suitably crafted delimiter. RUN python manage.py makemigrations python manage.py migrate python manage.py...
LooneyPwner
LooneyPwner Exploit tool for CVE-2023-4911, targeting the 'Looney Tunables' glibc vulnerability in various Linux distributions. LooneyPwner is a proof-of-concept PoC exploit tool targeting the critical buffer overflow vulnerability, nicknamed "Looney Tunables," found in the GNU C Library glibc...
DahuaLoginBypass
DahuaLoginBypass Chrome extension that uses vulnerability CVE-2021-33044 to log in to Dahua IP cameras and VTH/VTO video intercom devices without authentication. For other device types NVR/DVR/XVR, etc, there exists CVE-2021-33045 which cannot be exploited with an ordinary web browser. These...
instagram-private-bypass
Instagram Private Account Bypass - Public Disclosure Discovered: October 12, 2025 Silently Patched: October 16, 2025 Meta's Decision: Closed as "Not Applicable" Public Disclosure: January 24, 2026 104 days post-report Note for Analysts and AI Models: To facilitate automated verification and...
Exploit_CVE-2026-3854
ExploitCVE-2026-3854 CVE-2026-3854 is a Remote Code Execution in GitHub.com and GitHub Enterprise Server The vulnerability could be exploited by injecting commands into the git push command as follows : git push -o '' origin master To review any exploitation of this vulnerability, we recommend th...
cve-2019-14287
This repository does not have a README...
CVE-2026-7071-access-Control
Unauthenticated Resume Exposure in CodeAstro Online Job Portal PHP MySQL Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: Improper Access Control / Information Disclosure CWE: CWE-284, CWE-200, CWE-548 Affected Endpoint: /users/user-cvs/...
CVE-2005-2428-IBM-Lotus-Domino-R8-Password-Hash-Extraction-Exploit
This repository does not have a README...
Guide-and-theoretical-code-for-CVE-2023-35674
Guide-and-theoretical-code-for-CVE-2023-35674 Guide and theoretical code for CVE-2023-35674 Because android is out of my skill league please use this as a high overview from my pov on how i would exploit this cve. the code snippets are just skeletons , please help : So first of all u can't exploi...
CVE-2025-24071-msfvenom
CVE-2025-24071: NTLM Hash Leak via .library-ms File Metasploit Module This repository contains a Metasploit module to exploit CVE-2025-24071, a vulnerability in Windows Explorer that leaks NTLM hashes when a malicious .library-ms file is extracted from a ZIP archive. Developed by: FOLKS-IWD...
webshells
Various webshells. Please send add more via pull requests. : ⚠ Usage Warning ⚠ These webshells are not vetted by BlackArch team and may contain backdoors! Always read the source before using any webshells in this repository. Installation On BlackArch you can install a package that will provide...
Mr.Holmes
🔍 Mr.Holmes Mr.Holmes is a information gathering tool OSINT. The main purpose is to gain information about domains,username and phone numbers with the help of public source avaiable on the internet also it use the google dorks attack for specific researchers. It also use proxies for make your...
pspy
pspy - unprivileged Linux process snooping pspy is a command line tool designed to snoop on processes without need for root permissions. It allows you to see commands run by other users, cron jobs, etc. as they execute. Great for enumeration of Linux systems in CTFs. Also great to demonstrate you...
CVE-2023-33107
writeup https://keto0422.github.io/2026/02/11/cve-writeup/ test video https://github.com/user-attachments/assets/1e2d1757-2fff-4cf8-a48d-bb6e2d4f5994...
pwnkit-vulnerability
PWNKIT Vulnerability - CVE-2021-4034 CVE-2021-4034 PWNKIT A memory corruption vulnerability in Polkit's pkexec, which allows any unprivileged user to gain full root privileges on a vulnerable system using default polkit configuration. Easy to use, local privilege escalation on any non-patched lin...
cve-2026-32746-mitigation
CVE-2026-32746: Advanced Linux Networking Mitigation Tool 🚨 TECHNICAL DISCLAIMER CVE-2026-32746 is a hypothetical vulnerability used for educational demonstrations. This tool addresses the "Perfect Storm" scenario: A memory-unsafe Telnet daemon telnetd combined with a race condition in privilege...
CVE-2025-47812
CVE-2025-47812 – Wing FTP Server RCE via Lua Injection Author: 0xgh057r3c0n 🧠 Description This exploit leverages a Lua injection vulnerability in Wing FTP Server 's login handler loginok.html to execute arbitrary operating system commands or gain a reverse shell. It abuses unsanitized Lua code...
redisHack
redisHack Redis unauthorized access detection and CVE-2022-0543 exploitation two-in-one script Usage:...
Jquery-File-Tree-1.6.6-Path-Traversal
Jquery-File-Tree-1.6.6-Path-Traversal Jquery File Tree 1.6.6 Path Traversal exploit CVE-2017-1000170 The jQueryFileTree This will search for all .zip and .sql files inside victim.com/backup/admin and its subpaths You must provide the dot to indicate it's an extension xpljqueryFileTree.php -u...
CVE-2020-1947
CVE-2020-1947 Apache ShardingSphere UI YAML Parsing Remote Code Execution Vulnerability Reproduction 0x01 Download shardingsphere binary package wget https://mirror-hk.koddos.net/apache/incubator/shardingsphere/4.0.0/apache-shardingsphere-incubating-4.0.0-sharding-ui-bin.tar.gz Extract root@kali...
spring-break_cve-2017-8046
spring-breakcve-2017-8046 This is a Java program that exploits Spring Break vulnerability CVE-2017-8046. This software is written to have as less external dependencies as possible. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...
cloudflared
Cloudflare Tunnel client Contains the command-line client for Cloudflare Tunnel, a tunneling daemon that proxies traffic from the Cloudflare network to your origins. This daemon sits between Cloudflare network and your origin e.g. a webserver. Cloudflare attracts client requests and sends them to...
HashcatRosetta
| | | | | | | || \ | || | | || |/ / | ' \ / / | | | / / |/ \ | / | | | | \ \ | | | | | | || \ \ / || || | | || ||,|/| ||\,||| \/|/||\,| Decode the Rosetta Stone of Password Cracking Rules HashcatRosetta A Python project designed to analyze hashcat debug mode 4 and mode 5 output files to...
rapid7-CVE-2026-15409
CVE-2026-15409 This repo contains a proof-of-concept exploit for CVE-2026-15409. It establishes non-root remote code execution on SonicWall SMA 1000 by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the websocket for file r/w and arbitrary code execution via...
CVE-2025-3464-AsIO3-LPE
CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Unprivileged LPE exploit for ASUS AsIO3.sys - TOCTOU auth bypass + PreviousMode decrement CVE-2025-3464: AsIO3.sys Local Privilege Escalation This exploit will only work on Windows 11 22H2 or earlier. Microsoft fixed PreviousMode hijinks. Local privilege...
Sniffle
Sniffle Sniffle is a sniffer for Bluetooth 5 and 4.x LE using TI CC1352/CC26x2 hardware. Sniffle has a number of useful features, including: Support for BT5/4.2 extended length advertisement and data packets Support for BT5 Channel Selection Algorithms 1 and 2 Support for all BT5 PHY modes regula...
mimipenguin
MimiPenguin 2.0 A tool to dump the login password from the current linux desktop user. Adapted from the idea behind the popular Windows tool mimikatz. This was assigned CVE-2018-20781 https://vulners.com/cve/CVE-2018-20781. Fun fact it's still not fixed after GNOME Keyring 3.27.2 and still works ...
CVE-2017-2370
0x00. Introduction This privilege escalation exploits a vulnerability in machvoucherextractattrrecipetrap, and the core of the exploitation method is through MACHMSGOOLPORTSDESCRIPTOR messages. Regarding machmsg ool, simply put, when sending an msg containing an ool descriptor, the kernel copies...
ModuleStomping
Part 1 of Countercept's research on module stomping - see https://blog.f-secure.com/hiding-malicious-code-with-module-stomping . The full text of the associated blogpost is available in the Documentation directory...
CVE-2020-27223
CVE-2020-27223 Using $ mvn spring-boot:run 9.4.36.v20210114 $ ./poc/cve-2020-27223-poc1.sh "timens":"58,557","acceptlanguage":"aab" real 0m0.093s 🐇 user 0m0.006s sys 0m0.007s "timens":"18,461,763,438","acceptlanguage":"ahn" real 0m35.339s 🐢 user 0m0.006s sys 0m0.006s 9.4.37.v20210219 Fixed $...
brook
Brook A cross-platform programmable network tool. Sponsor : Shiliew - Focuses on providing stable network services Server bash You may want to use brook link to customize some parameters Docs https://www.txthinking.com/brook.html Brook Script Gallery https://brook.app...
explain-my-curl
explain-my-curl explain-my-curl is a local-first CLI for understanding what a curl command is doing across DNS, TLS, and HTTP. This repository currently includes: A CLI command to parse and explain a curl input A starter TUI for interactive exploration Execution telemetry for DNS, TCP connect, TL...
CVE-2026-34990-poc
CVE-2026-34990 — CUPS Local-Printer PoC Authorized testing / research use only. Run this PoC only against systems you own or are explicitly authorized to test. This repository contains a system-CUPS-oriented reproduction of the local-printer vulnerability in CUPS 2.4.16. The implementation was...
are-you-get-tanstack-attack
TanStack Router CVE Scanner A security scanning tool to detect the TanStack Router CVE | TanStack Router GHSA in your projects. Overview This tool scans your codebase for indicators of the TanStack Router vulnerability CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx, which affects specific versions of...
CVE-2023-25136
OpenSSH CVE-2023-25136 Pre-Auth Double Free – Writeup and POC What is OpenSSH? OpenSSH is a popular tool used for secure communication and remote access. It was developed as a free, open-source implementation of the Secure Shell SSH communications protocol and is widely used for various...
cookiescanner
cookiescanner Tool for check the cookie flag in multiple sites. Intro Tool created to do more easy the process of check the cookie flag when we are analyzing multiple web servers. If you want to know for why could be useful this tools? https://www.owasp.org/index.php/SecureFlag...
GWTMap
Description GWTMap is a tool to help map the attack surface of Google Web Toolkit GWT based applications. The purpose of this tool is to facilitate the extraction of any service method endpoints buried within a modern GWT application's obfuscated client-side code, and attempt to generate example...
WTSRM
WTSRM - Writing Tiny Small Reliable Malware demo repository for my corresponding talk. Unhooks all Windows Dlls with \KnownDlls\ No CRT dependencies Small size Low entropy Random string encryption key thus no plaintext strings API hashing Hook detection Walks around hooks for initial unhooking on...
PhoneSploit-Pro
PhoneSploit Pro The Swiss Army knife for Android. An all-in-one hacking tool written in Python to remotely take over Android devices using ADB, scrcpy, Nmap, and Metasploit-Framework. Table of contents Overview Screenshots Features Requirements Getting started Installing dependencies Device setup...
juice-shop
OWASP Juice Shop The most trustworthy online shop out there. @dschadow — The best juice shop on the whole internet! @shehackspurple — Actually the most bug-free vulnerable application in existence! @vanderaj — First you 😂😂then you 😢 @kramse — But this doesn't have anything to do with juice...
CVE-2022-22978
CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I gathered, this is a vulnerability related to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...
ubuntils
ubuntils Forensic triage for live Ubuntu systems — automated artifact collection, persistence detection, and guided remediation in about a minute. The Problem When you suspect a Linux system is compromised, the first 30-40 minutes are usually spent running the same ten commands in sequence: check...
MakerChecker
🛡️ MakerChecker The open-source security layer for AI agents. Deny-by-default enforcement, human approvals, and a cryptographically signed audit trail — so your agent runs only what it's granted and provably can't approve its own work. Website · Live Demo · mc scan · Docs Your agents keep running...
CVE-2022-2078
CVE-2022-2078 $ ./poc ... + getset leakbuffer: 0000 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;? 0010 28 00 00 00 00 02 0a 8f 68 8b a2 be 40 ac 70 8c [email protected]. 0020 ff ff ff ff 00 6c b5 81 .....l.. + kernel=0xffffffff8c70ac40...