ogi

OpenGraph Intel OGI Open-source visual link analysis and OSINT framework. Free, self-hostable, and community-driven. Features • Screenshots • Quick Start • Docker • Transform Hub • Architecture • Contributing Heads up: This project is actively evolving. It has solid core capabilities and test...

ogi

OpenGraph Intel OGI Framework de análisis visual de enlaces y OSINT de código abierto. Gratuito, autogestionable e impulsado por la comunidad. Características • Capturas de pantalla • Inicio rápido • Docker • Transform Hub • Arquitectura • Contribuir Aviso: Este proyecto está en evolución activa...

GhostTunnel

GhostTunnel GhostTunnel es un método de transmisión de puerta trasera encubierta que se puede utilizar en un entorno aislado. Puede atacar el objetivo a través del dispositivo HID únicamente para liberar la carga útil agente, luego el dispositivo HID se puede retirar después de liberar la carga...

exploits

exploits CVE-2021-22600: Linux kernel LPE exploit CVE-2021-3156: Linux local privilege escalation through heap overflow in sudo Demo CVE-2021-3156: One shot exploit for heap overflow vulnerability in sudo CVE-2020-6507: Out of bounds write in V8. Chrome versions = 83.0.4103.97. RCE CVE-2020-16040...

MISP

MISP - Plataforma de Compartición de Inteligencia de Amenazas MISP es una solución de software de código abierto para recopilar, almacenar, distribuir y compartir indicadores y amenazas de ciberseguridad relacionadas con el análisis de incidentes de ciberseguridad y el análisis de malware. MISP...

CVE-2024-43918

Wordpress WBW Product Table Pro = 1.9.4 - Unauthenticated Arbitrary SQL Execution to Remote Code Execution CVE-2024-43918 The WBW Product Table Pro plugin for WordPress is vulnerable to unauthorized arbitrary SQL Execution due to a missing capability check on a function in all versions up to, and...

jfrog-CVE-2023-25136-OpenSSH_Double-Free

CVE-2023-25136 Proof-of-Concept Overview This is a DoS Proof-of-Concept of OpenSSH 9.1p1 Double-Free Vulnerability CVE-2023-25136. It will trigger the double-free and cause an abort crash. For a comprehensive understanding, check out the accompanying blog post for in-depth details. Dependencies...

adaudit

adaudit This PowerShell script is designed to conduct a comprehensive audit of Microsoft Active Directory, focusing on identifying common security vulnerabilities and weaknesses. Its execution facilitates the pinpointing of critical areas that require reinforcement, thereby fortifying your...

adaudit

adaudit Este script de PowerShell está diseñado para realizar una auditoría exhaustiva de Microsoft Active Directory, centrándose en la identificación de vulnerabilidades y debilidades de seguridad comunes. Su ejecución facilita la localización de áreas críticas que requieren refuerzo,...

domain-locker

Domain Locker The Central Hub for all your Domain Names 🌐domain-locker.com Contents About Screenshot Features Live Demo Get Started Domain-Locker.com Self-Hosting Developing App Setup Architecture Contributing Attributions License About The aim of Domain Locker, is to give you complete visibility...

brutespray

Brutespray Created by: Shane Young/@x90sky && Jacob Robles/@shellfail Inspired by: Leon Johnson/@sho-luv Description Brutespray automatically attempts default credentials on discovered services. It takes scan output from Nmap GNMAP/XML, Nessus, Nexpose, JSON, and lists, then brute-forces...

brutespray

Brutespray Creado por: Shane Young/@x90sky && Jacob Robles/@shellfail Inspirado por: Leon Johnson/@sho-luv Descripción Brutespray intenta automáticamente credenciales por defecto en los servicios descubiertos. Toma la salida de escaneo de Nmap GNMAP/XML, Nessus, Nexpose, JSON y listas, y luego...

CVE-2024-38077-check

CVE-2024-38077check Detect whether the target has CVE-2024-38077 vulnerability based on port 135. The target machine's firewall must not restrict port 135. If the target has RDL service enabled, it is affected by this vulnerability. If the target server has updated the patch, an attempt to connec...

pmanager

Pmanager Demostración Descripción Almacena y recupera tus contraseñas desde una base de datos local y segura. Verifica si tus contraseñas han sido filtradas anteriormente para evitar ataques de reutilización dirigida de contraseñas. ¿Por qué desarrollar otro gestor de contraseñas? Este proyecto...

webdav_exploit

webdavexploit An exploit for Microsoft IIS 6.0 CVE-2017-7269 based on https://github.com/edwardz246003/IISexploit but works remotely usage python exploit.py -d http://www.eliuha.com/eliuha...

TraceTree

TraceTree TraceTree Demo TraceTree cascade-analyzer is an autonomous security organism designed for the agentic era. It moves beyond simple scanning into a robust, hardened, and scalable detection ecosystem. Like its mascot, the spider, TraceTree weaves a comprehensive web of protection around yo...

masc

masc A malware web scanner developed during CyperCamp Hackathon 2017 About homepage PyPI Features At the moment, there are some features avaiable for any type of website custom or CMS and some of them only available for specific platforms: Scan any website for malware using OWASP WebMalwareScanne...

masc

masc Un escáner de malware web desarrollado durante el Hackathon de CyperCamp 2017 Acerca de homepage PyPI Características Por el momento, hay algunas características disponibles para cualquier tipo de sitio web personalizado o CMS y algunas solo disponibles para plataformas específicas: Escanea...

Amnesiac

Amnesiac Amnesiac es un framework de post-explotación diseñado para ayudar en el movimiento lateral dentro de entornos de Active Directory. Amnesiac se está desarrollando para cubrir un vacío en sistemas operativos Windows, donde los frameworks de post-explotación no están fácilmente disponibles ...

publications

Publications A home for publications, including slides/papers, proof-of-concepts, videos and tools. For blog posts, see the elttam blog, and for our services, see our website. Date| Type| Event| Title| Resources ---|---|---|---|--- 2026| adv| -| Home Assistant Authenticated Arbitrary File Read vi...

CVE-2022-23909

CVE-2022-23909 Description: On Windows, the Sherpa Connector Service version 2020.2.20328.2050 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. In case of a poorly...

Rails-doubletap-RCE

Rails-doubletap-exploit RCE on Rails 5.2.2 using a path traversal CVE-2019-5418 and a deserialization of Ruby objects CVE-2019-5420 Technical Analysis : CVE-2019-5418 - https://github.com/mpgn/CVE-2019-5418 CVE-2019-5420 - https://hackerone.com/reports/473888 Security Adivsory : CVE-2019-5418 -...

CVE-2019-13272

CVE-2019-13272 Linux local root exploit Linux 4.10 5.1.17 PTRACETRACEME local root CVE-2019-13272 In the Linux kernel before 5.1.17, ptracelink in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtai...

CVE-2019-5418

CVE-2019-5418 Test case Run : $ rails s PoC : Accept: ../../../../../../../../etc/passwd Req 1 - GET /shitblock HTTP/1.1 Host: REDACTED:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64; rv:65.0 Gecko/20100101 Firefox/65.0 Accept: diyarbakirguzelbaglardelalelorke ------ CATCH Content-Lengt...

CVE-2023-4698

CVE-2023-4698 Local File Inclusion LFI in usememos/memos 0.13.2 Description Today, I want to shine a spotlight on a significant discovery — a critical security vulnerability that has been identified in usememos/memos. This vulnerability, which falls under the category of Local File Inclusion LFI,...

CVE-2017-9805

CVE-2017-9805 CVE-2017-9805 POC The issue comes from a lack of filtering on the deserialization class used by the REST plugin. Struts uses Xstream with a lot of filtering for deserialization in multiple places, however this filtering was not in place for the REST plugin...

cve-2022-21882-poc

cve-2022-21882-poc lpe poc for cve-2022-21882...

brawl-public-game-001

BRAWL One of the challenging problems for cyber security researchers developing detection and response capabilities is finding a realistic environment in which to test their hypothesis and capabilities. The cheapest method is to test capabilities on a small lab network. But this environment is...

dora

dora Features Blazing fast as we are using ripgrep in backend Exploit/PoC steps for many of the API key, allowing to write a good report for bug bounty hunting Unlike many other API key finders, dora also shows the path to the file and the line with context for easier analysis Can easily be...

dora

dora Características Extremadamente rápido ya que utilizamos ripgrep en el backend Pasos de explotación/PoC para muchas de las claves API, lo que permite redactar un buen informe para la caza de recompensas por errores A diferencia de muchos otros buscadores de claves API, dora también muestra la...

phantom-frida

phantom-frida phantom-frida builds Android Frida Server and Gadget from source while changing a targeted set of observable runtime identifiers. It is a builder and verification harness, not a promise that every application-specific detection method is defeated. The current compatibility target is...

Vulnerability-Disclosures

Mandiant Vulnerability Disclosures This repository details vulnerabilities disclosed by Mandiant. These vulnerabilities were discovered by internal research, through Red Team assessments, or in use in the wild. Proof of concepts PoCs may or may not be provided. The following licenses/licensing...

exploits

exploits "You can't argue with a root shell." -- Felix "FX" Lindner A collection of my public exploits. See also https://www.exploit-db.com/?author=315 Exploits Linux raptorchown.c. Linux 2.6.x 2.6.7-rc3 CVE-2004-0497. Missing DAC controls in syschown on Linux. raptorprctl.c. Linux 2.6.x from...

phpstan

PHPStan - PHP Static Analysis Tool PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code. It moves PHP closer to compiled languages in the sense that the correctness of each line of the code can be...

CVE-2012-0003_eXP

This repository does not have a README...

SharpMapExec

SharpMapExec Una versión mejorada de CrackMapExec. Esta herramienta está diseñada para simplificar las pruebas de penetración de redes y crear una navaja suiza que funcione en Windows, un requisito común durante las simulaciones de amenazas internas. Además de escanear en busca de acceso, se pued...

SpiderSuite

SpiderSuite es un rastreador web avanzado, multiplataforma y multifuncional, diseñado para profesionales de la seguridad. Para más información visita el sitio web de SpiderSuite. Instalación y Uso Spider Suite está diseñado para una instalación y uso sencillos, incluso para quienes lo usan por...

Osintgram

Osintgram 🔎📸 Apúntalo a una cuenta de Instagram y descubre quién está detrás de ella. Osintgram recopila, cruza y presenta todo lo que un perfil público revela — seguidores, pies de foto, hashtags, ubicaciones geolocalizadas, hábitos de publicación, datos de contacto públicos — en una interfaz we...

openvpn

OpenVPN -- A Secure tunneling daemon Copyright C 2002-2026 OpenVPN Inc. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 2 as published by the Free Software Foundation. To get the latest release of OpenVPN, go to:...

packman

packman A documentation and tracking project with the goal of making package management systems more secure. See issues for a very rough list of a few of the related issues we have seen. Table Of Package Management Systems Language| Name| Tier| Controls| Packman Lead| Packman Page...

pegasus-neo

| \ | \ | | | | / / |/ / | | | / | | | | / / | | | \ \ || \ \ |\ | || |, |,|/,|/| | |/ ███▄ █ ▓█████ ▒█████ ██ ▀█ █ ▓█ ▀ ▒██▒ ██▒ ▓██ ▀█ ██▒▒███ ▒██░ ██▒ ▓██▒ ▐▌██▒▒▓█ ▄ ▒██ ██░ ▒██░ ▓██░░▒████▒░ ████▓▒░ ░ ▒░ ▒ ▒ ░░ ▒░ ░░ ▒░▒░▒░ ░ ░░ ░ ▒░ ░ ░ ░ ░ ▒ ▒░ ░ ░ ░ ░ ░ ░ ░ ▒ ░ ░ ░ ░ ░ PEGASUS-NEO...

gitlab-rce-demo

GitLab Oj RCE Demo This repository contains a self-contained demo for the GitLab notebook-diff RCE chain described in our research. It starts a fresh GitLab 18.11.3 container, creates an ordinary user through the public HTTP interface, and runs the PoC against that instance. Technical details:...

raven

Raven Currently is not being maintained Raven is a Linkedin information gathering tool that can be used by pentesters to gather information about an organization employees using Linkedin. Disclaimer Please do not use this program to do stupid things. The author does not keep any responsibility of...

ckb-vm

Nervos CKB VM Acerca de CKB VM CKB VM es una implementación de software puro del conjunto de instrucciones RISC-V utilizado como VM de scripting en CKB. Actualmente implementa las instrucciones completas IMCB tanto para soporte de registros de 32 bits como de 64 bits. En el futuro, también...

ksubdomain

KSubdomain: Herramienta ultrarrápida de fuerza bruta de subdominios sin estado English | 中文 KSubdomain es una herramienta de fuerza bruta de subdominios basada en tecnología sin estado, que ofrece una velocidad de escaneo sin precedentes y un consumo de memoria extremadamente bajo. Utiliza socket...

Storm-Breaker

Una herramienta con capacidades atractivas. Características: Obtener información del dispositivo sin ningún permiso ! Acceder a la ubicación TELÉFONOS INTELIGENTES Acceder a la cámara web Acceder al micrófono Registro de actualizaciones: Segunda última actualización el 4 de noviembre de 2022. La...

CVE-2020-15148-bypasses

CVE-2020-15148-bypasses Several bypasses for CVE-2020-15148 Yii2 deserialization poc1 This one is exploitable in version 2.0.37, fixed in 2.0.38, which was assigned CVE-2020-15148. The following three are bypasses. checkAccess = 'system'; $this-id = 'ls'; namespace Faker use yii\rest\CreateAction...

CVE-2025-43529

CVE-2025-43529 TL; DR Apple recently shipped iOS 26.2 and iPadOS 26.2, along with a security advisory that includes fixes for WebKit vulnerabilities. One bug in the DFG JIT compiler CVE-2025-43529 stood out, so I decided to dig into it. The JIT compiler correctly recognized that a Phi node where...

kong

Kong: El Ingeniero Inverso Autónomo Orquestación de LLM para ingeniería inversa de binarios ¿Qué es Kong? La mayoría de las tareas siguen una relación lineal: cuanto más difícil es la tarea, más tiempo suele llevar. La ingeniería inversa y el análisis de binarios es una tarea en la que la...

noPac

Acerca de Explotando CVE-2021-42278 y CVE-2021-42287 para suplantar al administrador del dominio desde un usuario de dominio estándar Modificado desde sam-the-admin. Uso SAM THE ADMIN CVE-2021-42278 + CVE-2021-42287 chain positional arguments: domain/username:password Account used to authenticate...