PoC-public

PoC-public This repository collects PoC code that we published at various security conferences. Black Hat EU 2020 CODE BLUE 2021 Black Hat Asia 2023 CODE BLUE 2023...

scripts-nse

What is it? Some NSE scripts to search information from routers. The author of this scripts are VicenDominguez. He found the 0-Day on Huawei I only modified for two others. The author of this script is not responsible for its use. Huawei HG253s v2 Vodafone-Spain is starting to rent a new Huawei...

fastnetmon

Community Edition FastNetMon - A high-performance DDoS detector/sensor built on top of multiple packet capture engines: NetFlow, IPFIX, sFlow, AFPACKET port mirror. What do we do? We detect hosts in the deployed network sending or receiving large volumes of traffic, packets/bytes/flows per second...

maritime-security-paper

Maritime Security Research Paper Comprehensive research on security vulnerabilities in autonomous maritime vessels and defense recommendations 📄 Overview This repository contains the complete maritime security research paper, documentation, and supplementary materials for academic publication and...

CVE-2026-29000

CVE-2026-29000: pac4j-jwt Authentication Bypass POC This repository contains a proof-of-concept POC for an authentication bypass vulnerability in pac4j-jwt CVE-2026-29000. The vulnerability allows an attacker to bypass signature verification by nesting a PlainJWT using alg: none inside a JWE JSON...

XCP_ng_CVE-2026-31431_tester

CVE-2026-31431 "Copy Fail" — XCP-ng Laboratory Detector A safe, non-destructive detector script for CVE-2026-31431 "Copy Fail", validated against XCP-ng 8.3 LTS prior to the May 5, 2026 security update. ⚠️ Authorized use only. Run this script exclusively on systems you own or are explicitly...

CVE-2025-61777

CVE-2025-61777 1. Unauthorized modification of badge templates on FlagforgeCTF CVE-2025-61777 Summary The Flagforge application https://flagforge.xyz exposes critical vulnerabilities in its administrative API endpoints, specifically /api/admin/badge-templates GET and...

CVE-2020-8597

CVE-2020-8597 eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eaprequest and eapresponse functions. If you manage to get "EAP: unauthenticated peer name" long enough, seems like my client limits it to 255, you can do Buffer Overflow. You still have to beat the Sta...

nrf24-playset

nRF24 Playset The nRF24 Playset is a collection of software tools for wireless input devices like keyboards, mice, and presenters based on Nordic Semiconductor nRF24 transceivers, e.g. nRF24LE1 and nRF24LU1+. All software tools support USB dongles with the nrf-research-firmware by the Bastille...

CVE-2025-3605

🚀 CVE-2025-3605 Exploit Guide 🛡️ Vulnerability Summary The Frontend Login and Registration Blocks plugin for WordPress versions = 1.0.7 is vulnerable to privilege escalation via account takeover. The issue arises because the plugin does not validate user identity when updating sensitive details...

Windows10Exploits

Windows10Exploits Download a single CVE The variable is only for example ; you can make your own SVN script for downloading a single folder = CVE = BR @nu11secur1ty $CVE = CVE-2018-0833 svn checkout https://github.com/nu11secur1ty/Windows10Exploits/trunk/Undefined/$CVE Link table of Analysis...

river

River is a Python library for online machine learning. It aims to be the most user-friendly library for doing machine learning on streaming data. River is the result of a merger between creme and scikit-multiflow. ⚡️ Quickstart As a quick example, we'll train a logistic regression to classify the...

reactguard

ReactGuard React2Shell scanner powered by Xint. ReactGuard provides framework- and vulnerability-detection tooling for CVE-2025-55182 React2Shell across frameworks that support React Server Components. It also includes detectors for CVE-2025-55183, CVE-2025-55184, and CVE-2025-67779. Support stat...

CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2019-3396TEST

CVE-2019-3396TEST TEST...

PHPStudy-Backdoor

PHPStudy-Backdoor Backdoor Vulnerability Reproduction phpstudy dll backdoor for v2016 and v2018 0x01 scan search for backdoor dll D:\Pentester\phpStudypython check.py === .\php\php-5.2.17\ext\phpxmlrpc.dll === @eval%s'%s'; %s;@eval%s'%s'; === .\php\php-5.4.45\ext\phpxmlrpc.dll === @eval%s'%s';...

http-stalling-detector

HTTP Stalling Detector HTTP stalling DoS attacks take advantage of an inability for webservers to determine if a remote client is just connected over a slow link or if the remote client is deliberately sending data very slowly to avoid the webserver doing a timeout and shutting down the connectio...

gofireprox

GoFireProx This is a port of FireProx to Golang Installation go install -v github.com/mr-pmillz/gofireprox/cmd/gofireprox@latest gofireprox as library Integrate gofireprox with other go programs package main import "fmt" "github.com/mr-pmillz/gofireprox" func main region := "us-east-1" fpClient,...

poc-cve-2023-2868

CVE-2023-2868: Barracuda ESG Command Injection For full details, read our AttackerKB Analysis. Usage Set LHOST and RHOST variables to your listener. ruby poccve20232868.rb This will spawn a reverse shell...

cve-2018-12386

Firefox Sandboxed RCE Exploit CVE-2018-12386 Here is a simple exploit for the vulnerability CVE-2018-12386 found by Niklas Baumstark, Samuel Groß and Bruno Keith. This is mostly a PoC I did for fun, there is no sandbox bypass and it will only work on a given Linux setup where the offsets used by...

Windows-Local-Privilege-Escalation-Cookbook

Windows Local Privilege Escalation Cookbook Table of Contents Windows Local Privilege Escalation Cookbook Table of Contents Disclaimer Description Keynote Definition Useful Tools Vulnerabilities References Disclaimer This repository, "Windows Local Privilege Escalation Cookbook" is intended for...

Iran-War-Media

Iran War Media Monitor Read the Full Deep Dive Introduction This project monitors news coverage of the war between Iran, Israel, and the United States. You can use this repository to: 1. Create a corpus of media articles in English 2. Identify authors and news media outlets to keep track of who...

ps.sh

ps.sh ps.sh is a bash script that automates port scanning on specified target hosts. The aim of the scripts is reducing scan time, increasing scan efficiency and automating the workflow. Resource Features Installation Usage Contributing Licensing Credits Contributors Dependencies Features Automat...

pico-usb-wifi

= pico-usb-wifi :toc: macro :toclevels: 3 :idprefix: :idseparator: - pico-usb-wifi is firmware for the Raspberry Pi Pico W that turns it into a driverless USB Wi-Fi adapter, enumerating as a USB CDC-NCM device. :figure-caption: AI Slop .pico-usb-wifi Diagram...

PS-CVE-2020-7352

PS-CVE-2020-7352 Powershell implemetation of CVE-2020-7352...

Odoo_PDFjs_CVE-2024-4367.pdf

This repository does not have a README...

Offensive

Offensive technologies course This repository contains descriptions of several vulnerabilities and the code that exploits them. Exploitable environments can be found in /dockerfiles/victim folder. Attacker environments can be found in /dockerfiles/attacker folder. Everything comes as Docker image...

frameworks_base_AOSP10_r33_CVE-2022-20007

This repository does not have a README...

EDIDFuzzer

EDID fuzzer A tool for fuzzing Enhanced Display Identification Data Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com https://www.github.com/nccgroup/EDIDFuzzer Released under AGPL see LICENSE for more information...

BLUESPAWN

BLUESPAWN Code Status Our Mission BLUESPAWN helps blue teams monitor systems in real-time against active attackers by detecting anomalous activity What is BLUESPAWN BLUESPAWN is an active defense and endpoint detection and response tool which means it can be used by defenders to quickly detect ,...

CVE-2026-31431

CVE-2026-31431...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...

copyfailautopatch

copyfailautopatch Detect and optionally mitigate CVE-2026-31431 "Copy Fail" on a Linux host. The vulnerability is a page-cache write primitive reachable through the AFALG socket family using the authencesnhmacsha256,cbcaes AEAD transform. This script reproduces the same primitive Theori...

CVE-2024-3400

CVE-2024-3400 CVE-2024-3400 Palo Alto OS Command Injection Vendor Description A command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute...

JShell

JShell JShell - Get a JavaScript shell with XSS. Usages Run shell.py and JShell will automatically try to detect your IP address, default LPORT is 33. As you can see the payload has been generated and now all you have to do is to deliver this payload to the victim. As soon as you do that, you wil...

graudit

graudit graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility grep. It's comparable to other static analysis applications like RATS, SWAAT and flaw-finder while keeping the technical requirements to a minimum and being...

tfc

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

CS4239-Spring4Shell-POC

CS4239-Spring4Shell-POC Proof of concept for CVE-2022-22965 Spring4Shell for CS4239 G410 report. Adapted from this PoC to demonstrate unpatched & patched behavior. Running the demo There are 2 example programs dockerized in this repository with identical source code. One uses a vulnerable version...

log4j-shell-poc

This repository does not have a README...

CVE-2026-43499-armv7

CVE-2026-43499 GhostLock — ARM32 Huawei Watch 4 Pro Linux kernel privilege escalation exploit attempt based on CVE-2026-43499 GhostLock — Huawei Watch 4 Pro MDS-AL00, armv7l Project Overview This project is a GhostLock kernel vulnerability exploit attempt targeting the Huawei Watch 4 Pro MDS-AL00...

GitLab-Graphql-CVE-2020-26413

GitLab-Graphql-CVE-2020-26413 GitLab-Graphql-CVE-2020-26413 POC Single verification: python3 GitlabCVE-2020-26413.py -u http://127.0.0.1 Batch verification python3 GitlabCVE-2020-26413.py -f target.txt The vulnerability results will be generated in the current path of the script...

CVE-2023-38646

CVE-2023-38646 Python script to exploit CVE-2023-38646 Metabase Pre-Auth RCE via SQL injection The script will GET /api/session/properties to get the setup token and assess exploitability of the target. If it's vulnerable will then print the setup token, else it will quit after an error message. ...

mpDNS

mpDNS aka multi-purpose DNS Server Simple, configurable DNS Server with multiple useful features Python 3 names.db - holds all custom records see examples Simple wildcards like .example.com Catch unicode dns requests Custom actions aka macro: shellexec::dig google.com +short - Execute shell comma...

Pentest-Everything

⚔️ Pentest Everything Important Bookmark this page as other page links are likely to change or move over time. This page will always remain the same. About this book This book is my collection of notes and write-ups for various offensive security based topics and platforms. This book is generally...

ADExplorerSnapshot

ADExplorerSnapshot.py ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound via BOFHound, and also supports full-object dumping to NDJSON. AD Explorer allows you to connect to a DC and browse LDAP data. It can also create snapshots of the server you are...

T-MAP

T-MAP: Red-Teaming LLM Agents with Trajectory-aware Evolutionary Search T-MAP is a trajectory-aware evolutionary search framework for red-teaming LLM agents over MCP servers. It iteratively generates and mutates adversarial prompts guided by execution trajectories, mapping the agent's vulnerabili...

c4-meta-system

C4-META System v1.0.0 research prototype Research prototype for multi-layer AI defense: C4 explainability, ensemble classifiers, deobfuscation, O₂ security engine, ThoughtVirus defense, and SVETILO value alignment. Alpha-grade — validated internally, external audit pending. Version: 1.0.0-alpha |...

Mi8E5-Unlocker-by-CVE-2026-43499

Mi 8e5 Unlock Toolkit Automated bootloader unlock assistant for Mi 8e5 series devices, implementing CVE-2026-43499. This is an English-translated and macOS/Linux-ported fork of the original Windows-only release by @Kernix. Original repo:...

CVE-2025-30208

中文 | English Vite Dev Server Vulnerability Scanner 一个内外网通吃的自动化扫描器 An automated tool for scanning Vite development server vulnerabilities. This tool utilizes the FOFA API to collect potential targets and automatically detects specific vulnerabilities. Features Auto Automatic target asset collectio...

WTSRM2

WTSRM2 This is a continuation to my original project WTSRM and the corresponding talk. This project was re-written in order to utilize C++17 in order to create a template that allows us to change the required functionality at compile time with ease! This is implemented as a header only file such...