HSC24RedTeamInfra

HSC24RedTeamInfra Slides and Codes used for the workshop Red Team Infrastructure Automation...

ShadowSteal

ShadowSteal | CVE-2021-36934 Pure Nim implementation for exploiting CVE-2021-36934, the SeriousSAM Local Privilege Escalation LPE. Not OPSEC safe.... yet ;. I do not claim credit for the discovery of this exploit. Quick Start Build with Docker Getting started with ShadowSteal is now easier than...

Podroid

Podroid Run Linux containers and a full Linux desktop on your Android phone. No root. A real Alpine Linux VM with its own kernel - not a chroot or proot trick - so Podman, Docker and LXC behave exactly like they do on a server. Website · Documentation · Download APK Home | Running | !Built-in...

CVE-2026-0300

This repository does not have a README...

sel4-ics-gateway-demo

seL4 ICS Gateway Demo A defensive security research project comparing protocol-break vs packet-forwarding architectures for protecting industrial control systems from cyber attacks. Documentation: Network Architecture - Network diagrams and traffic flow Container Architecture - Docker container...

CVE-2023-4634-PoC

CVE-2023-4634 - RCE Vulnerability in WordPress Plugin Media Library Assistant 1. Build and launch environment cd Stand docker-compose up --build -d 2. Wait for services to start 60 seconds sleep 60 curl -I http://localhost:8080 3. Run vulnerability scan cd ../PoC/src python3 scanner.py...

maldev-for-dummies

Malware Development for Dummies In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will sho...

PhantomEvasion

PHANTOM EVASION 3.0 Phantom-Evasion is an antivirus evasion tool written in python both compatible with python and python3 capable to generate almost fully undetectable executable even with the most common x86 msfvenom payload. The following OSs officialy support automatic setup: 1. Kali Linux 2...

CVE-2017-13089

CVE-2017-13089 Payload generator for CVE-2017-13089. This version requires manually locating the stack address to be executed. Directly attacking is also likely to succeed In the shellcode section, buf is a normal payload generated with msf; simply replace it with the payload you need. Usage:...

CVE-2016-0801

CVE-2016-0801...

agentic-radar

A Security Scanner for your agentic workflows! View Demo · Documentation · Report Bug · Request Feature Table of Contents 1. Description 2. Agentic Visualizer 3. Getting Started Prerequisites Installation 4. Advanced Installation CrewAI Installation OpenAI Agents Installation 5. Usage 6. Advanced...

FiercePhish

FiercePhish FiercePhish is a full-fledged phishing framework to manage all phishing engagements. It allows you to track separate phishing campaigns, schedule sending of emails, and much more. The features will continue to be expanded and will include website spoofing, click tracking, and extensiv...

PMAT-labs

PMAT-labs 🔬 Welcome to the labs for Practical Malware Analysis & Triage. !Release Versionimg-version-badgerelease !Course Linkcoursecourse-link !EULAimg-license-badgeeula 🔴 WARNING 🔴 Read this carefully before proceeding. This repository contains live malware samples for use in the Practical...

cve-2021-4034-mock

CVE-2021-4034 PwnKit Mock Vulnerability System This project is a mock system that reproduces the core operating principles of CVE-2021-4034 Out-of-Bounds Read/Write vulnerability in the Linux pkexec daemon. Without actual SUID privilege escalation, it safely simulates the mechanism of environment...

CVE-2026-45447

cve-id ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized penetration testing environments Example setup: git clone cd Project use python follow below Create a virtual environment python -m venv...

exist

EXIST EXternal Information aggregation System against cyber Threat ⚠️ This repository is unmaintained / archived. Security issues will not be fixed. EXIST is a web application for aggregating and analyzing CTI cyber threat intelligence. EXIST is written by the following software. Python 3 Django...

CVE-2019-17571

CVE201917571 Environment for CVE201917571...

EAC

العربية There are two versions of EAC: the first is paid and called EAC, and the other is free and called EOC, which is the most common in most games. I have uploaded the SDK to help you understand how EAC works. In any case, EOC is considered weaker than the paid version because it is free, but...

Struts2Shell

Struts2Shell An exploit and library for CVE-2017-5638 - Apache Struts2 S2-045 bug. Installation $ npm install -g struts2shell Installation as Library $ npm install struts2shell Command Line Options -h, --help output usage information -V, --version output the version number -u, --url target URL to...

CVE-2022-40684

CVE-2022-40684 by 1vere$k For now it's a POC copy for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager appliances. Coppied from https://github.com/horizon3ai/CVE-2022-40684 Analysis The exploit uses the simple payload: PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 Host...

TornadoC2

TornadoC2 A pull-based C2 with ten native transports, concurrent multi-profile handlers, and an honest threat model. The agent is a single Go binary with every behavioural property baked in at build time — no runtime config file, no environment variable, no command-line arguments. Tasks and resul...

camjacking

Camjacking CamJacking is an enterprise-grade security awareness training framework designed to simulate realistic phishing attacks targeting camera permissions and user awareness 🎯 What is CamJacking? CamJacking is an enterprise-grade security awareness training framework designed to simulate...

day06-foxcms-rce

Day06 — FoxCMS-style RCE CVE-2025-29306 — Educational lab This tiny lab simulates the core idea behind CVE-2025-29306 : unsafe use of unserialize on attacker-controlled input leading to remote code execution. This is a minimal, intentionally vulnerable educational replica — not FoxCMS itself...

CVE-2026-29145-Tester

CVE-2026-29145 Testing Environment 📌 Overview This repository contains a proof-of-concept PoC environment designed to test for CVE-2026-29145. The vulnerability is an authentication bypass in Apache Tomcat's Mutual TLS CLIENTCERT implementation. When OCSP Online Certificate Status Protocol is...

motioneye-authenticated-RCE

MotionEye/MotionEyeOS Authenticated RCE A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye. You need administrator credentials, so it should not be that big of a deal. Unfortunately, MotionEye/MotionEyeOS can frequently be found running with default credentials...

SecureConnect-Auth-Bypass

ConnectWise SecureConnect Authentication Bypass Vulnerability An exploit proof of concept for ConnectWise SecureConnect authentication bypass vulnerability. Blog Post More details here: https://www.horizon3.ai/attack-research/red-team/connectwise-screenconnect-auth-bypass-deep-dive/ Usage Running...

cve-2023-5217-poc

CVE-2023-5217: libvpx VP8 Encoding Heap Overflow PoC CVE-2023-5217 is an in-the-wild exploited libvpx vulnerability that was found by Clément Lecigne of Google's Threat Analysis Group to be targeting Chrome. This repo shows how to trigger CVE-2023-5217 in the browser using the WebCodecs and...

Phoenix-Framework

Phoenix-Framework Phoenix is an async based post exploitation framework that abuses trusted sites for C2. Supported Platforms Phoenix currently supports the following platforms via their Bot APIs: Discord Telegram Reddit Coming soon Phoenix offers the basic following features : String Obfuscation...

CloakBin

CloakBin Zero-Knowledge Encrypted Pastebin Your data is encrypted in your browser before it leaves your machine. The server only ever stores ciphertext. Live Demo • Report Bug • Request Feature Share a secret straight from your terminal. It encrypts on your machine before anything uploads: echo...

huskyCI

This article can also be read inBrazilian Portuguese. Introduction huskyCI is an open source tool that orchestrates security tests and centralizes all results into a database for further analysis and metrics. It can perform static security analysis in Python BanditBandit and SafetySafety, Ruby...

bouncer-overflow

PgBouncer Crash PoC This repository contains a local proof of concept for a PgBouncer crash caused by an integer overflow in vulnerable PgBouncer versions. The included Docker setup builds PgBouncer 1.25.1, starts a PostgreSQL backend, enables SCRAM-SHA-256 authentication, and runs poc.py against...

Ruby_Pricise_Heap_Spray

RubyPriciseHeapSpray Use ruby strings to do a precise heap spray in an win7 env ps. 0c0c0c0c you will have to adjust the last number of iterations on how many times u call the spray function. that's bc of how ruby works.... basically ruby decides to delete all heap allocs of certain sizes if for...

DIRTY-FRAG-Detection-with-Wazuh-4.14.4

DIRTY FRAG Detection with Wazuh 4.14.4 - CVE-2026-43284 / CVE-2026-43500 Detection engineering for the Dirty Frag kernel LPE - Ubuntu / RHEL / Debian / Amazon Linux What is Dirty Frag? CVE-2026-43284 / CVE-2026-43500 is a Linux kernel Local Privilege Escalation LPE that chains two independent...

RP_RecordClip_DLL_Hijack

Remote DLL Hijack Vulnerability in Real Player CVE-2022-32291 The Player application which is vulnerable upon starting Real Converter and the Recording Manager are prone to a remote DLL hijack binary planting issue because of unsafe search for unexisting DLLs. To exploit the issue attackers would...

CVE-2021-29441

CVE-2021-29441 Usage: CVE-2021-29441.exe ip Alibaba Nacos unauthorized account addition...

CVE-2024-55587

CVE-2024-55587 This repository is proof of concept for CVE-2024-55587 vulnerability in python library libarchive. The generatezip file creates malicious zip that will exploit u safe extraction of files in libarchive extractall method. The vulnerablezip is just an exaple of vulnerable code...

zeek-community-id

"Community ID" flow hashing for Zeek This Zeek package provides support for Community ID flow hashing, a standardized way of labeling traffic flows in network monitors. When loaded, the package adds a communityid string field to conn.log. Note Zeek 6 and later versions include Community ID suppor...

testing-handbook

Trail of Bits Testing Handbook The Trail of Bits Testing Handbook is a resource for developers and security professionals on configuring, optimizing, and automating many static and dynamic analysis tools we use at Trail of Bits. Preview Testing Handbook: https://appsec.guide 🌐 Why is this needed?...

ChameleonMini-rebooted

ChameleonMini RevE - Rebooted Linux & OSX CI| Releases ---|--- | Attribution LICENSE "Based on the open-source NFC tool ChameleonMini: https://github.com/emsec/ChameleonMini" License This is firmware for the revised, rebooted version of the ChameleonMini RevE Rebooted which so many of you bought...

CVE-2022-0185-Analysis-and-Exploit

CVE-2022-0185-Analysis-and-Exploit Research and proof-of-concept for CVE-2022-0185 Linux kernel heap overflow vulnerability. CVE-2022-0185 – Linux Kernel Heap Overflow Analysis Overview CVE-2022-0185 is a heap-based buffer overflow vulnerability in the Linux kernel’s filesystem context...

solrradar

Mass Reconnaissance & Exploitation Framework for Apache Solr Velocity Template Injection → Remote Code Execution 📑 Table of Contents Vulnerability Overview Affected Versions Features Installation Usage Proof of Concept Technical Deep-Dive Detection Methodology Defense & Mitigation Disclaimer...

CVE-2022-22965-susceptibility

This repository does not have a README...

CVE-2025-9784

CVE-2025-9784 MadeYouReset HTTP/2 Vulnerability Test Overview This repository contains a simple and effective bash script to test for the CVE-2025-9784 vulnerability known as the "MadeYouReset" HTTP/2 Denial of Service DoS attack in Undertow HTTP/2 server implementations. The vulnerability allows...

winDED

winDED Custom exploit for CVE-2023-38831 using python. Introduction: WinRAR is an archiving software that allows users to create file archives and zipped versions of files and folders so that users can easily transport files/ folders or store them at a compressed size. I mean, you’ve heard of it,...

collisions

Hash collisions and exploitations By Ange Albertini and Marc Stevens. FAQ TL;DR Q: Is it possible to make a file get an arbitrary MD2/MD4/MD5/MD6/SHA1/SHA2/SHA3, or the same hash as another file? A: No. Q: Can one create 2 different files with the same hash? A: With MD5, in a few seconds on a...

CVE-2023-29489

CVE-2023-29489 Mass Scaning vulnerability in Cpanel XSS KALI LINUX sudo pip install BeautifulSoup sudo pip install shodan sudo pip install pystyle git clone https://github.com/0-d3y/CVE-2023-29489.git cd CVE-2023-29489 python cve202329489.py TERMUX pkg install BeautifulSoup pkg instaal shodan pkg...

PoshBot

PoshBot Azure Pipelines| GitHub Actions| Documentation| PS Gallery| License ---|---|---|---|--- | | | | Supporting PoshBot PoshBot is a MIT-licensed open source project. Ongoing development is made possible thanks to the support of sponsors. If you'd like to become a sponsor, you can do so throug...

VectorKernel

VectorKernel PoCs for Kernelmode rootkit techniques research or education. Currently focusing on Windows OS. All modules support x64 family 64bit OS only. Environment All modules are tested in Windows 11 x64. To test drivers, following options can be used for the testing machine: 1. Enable Loadin...

CVE-2025-69720

CVE-2025-69720: ncurses infocmp -i Stack Buffer Overflow CWE-121 Reporter: Yixuan Cao Shenzhen University, [email protected] Environment Host: openEuler 22.03 LTS Linux aarch64 Toolchain: system clang 12.0.1 + AddressSanitizer Source: ncurses-6.4 and ncurses-6.5 prior to patch 20251213 Summa...

CVE-2025-12139-WordPress-Integrate-Google-Drive-Exploit

CVE-2025-12139: Integrate Google Drive WordPress Plugin - Information Disclosure Exploit Description This is a Golang Proof of Concept PoC exploit for CVE-2025-12139. The vulnerability exists in the Integrate Google Drive plugin versions = 1.5.3 for WordPress. It allows unauthenticated attackers ...