tachyon

Tachyon Tachyon is a fast web application security reconnaissance tool. It is specifically meant to crawl a web application and look for left over or non-indexed files with the addition of reporting pages or scripts leaking internal data. User Requirements Linux Python 3.6+ User Installation...

binary-ninja-headless-mcp

Binary Ninja Headless MCP A headless Binary Ninja server that speaks MCP Model Context Protocol, giving AI agents full access to deep reverse-engineering workflows — disassembly, IL, patching, types, xrefs, and more — without a GUI. Designed to run in the same Docker container as the agent runtim...

conjur

Conjur Maintainability Test Coverage Conjur provides secrets management and application identity for modern infrastructure: Machine Authorization Markup Language "MAML" , a role-based access policy language to define system components & their roles, privileges and metadata A REST web service to:...

CVE-2019-17137

CVE-2019-17137 Info CVE: https://vulners.com/cve/CVE-2019-17137 POC GET /index.htm%00currentsetting.htm HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:78.0 Gecko/20100101 Firefox/78.0 Accept: / Accept-Language:...

POC-CVE-2025-68613

POC-CVE-2025-68613 My poc to exploit this vuln :D...

CVE-2024-49328-exploit

CVE-2024-49328-exploit 🌟 Description: This script exploits a privilege escalation vulnerability in the WP REST API FNS Plugin for WordPress. The vulnerability affects all versions up to and including 1.0.0, allowing unauthenticated attackers to gain administrator privileges. ⚙️ Usage options: -h,...

CVE-2019-10708

Scms - SQL Injection exploit.py is a PoC for the CVE-2019-10708 vulnerability, implementing multiprocessing for injection to obtain the database name and backend administrator credentials recommended for versions before 20190401 Usage 測試是否可注入 python3 exploit.py http:localhost/js/scms.php --test...

FML-Network

FLNET2023: Realistic Network Intrusion Detection Dataset for Federated Learning Paper: FLNET2023: Realistic Network Intrusion Detection Dataset for Federated Learning Dataset: FLNET2023 Introduction FLNET2023 is a state-of-the-art benchmark dataset for intrusion detection systems, specifically fo...

BiBi-Windows-Wiper-Analysis

Technical Analysis of BiBi-Windows Wiper Targeting Israeli Organizations On 30th October, Security Joes Incident Response team discovered a new Linux Wiper named "BiBi-Linux" Wiper been deployed by Pro-Hamas Hacktivist group to destroy their infrastructure. And then on November 1 2023, ESET...

CVE-2025-10035

CVE-2025-10035 How does this detection method work? Detects vulnerable GoAnywhere MFT instances by extracting version numbers from the login page and matching against affected version ranges. How do I run this script? 1. Download Nuclei from here 2. Copy the template to your local system 3. Run t...

CVE-2017-10271

CVE-2017-10271 Weblogic wls-wsat Component Deserialization Vulnerability CVE-2017-10271 Detection and Exploitation Script Usage $ python CVE-2017-10271.py -l 10.10.10.10 -p 4444 -r http://will.bepwned.com:7001/ Features Standalone Python script Check functionality to see if any host is vulnerable...

ivre

IVRE IVRE Instrument de veille sur les réseaux extérieurs or DRUNK Dynamic Recon of UNKnown networks is a network recon framework, including tools for passive and active recon. IVRE can use data from: Passive tools: Zeek Argus Nfdump p0f airodump-ng Active tools: Nmap Masscan ZGrab2 ZDNS Nuclei...

CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

cve-2025-55182-react2shell_reproduction

CVE-2025-55182 — React2Shell CVSS 10.0 CRITICAL | Pre-Auth Remote Code Execution in React Server Components Discovered by Chinese threat actors. Actively exploited by China-nexus APT groups. Overview Dubbed "React2Shell" , this vulnerability enables unauthenticated remote code execution via unsaf...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ https://github.com/user-attachments/assets/89310771-f704-45d1-a6c3-d910de1dbc74 Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where...

fetchfox

FetchFox FetchFox is an AI powered scraping, automation, and data extraction library. It can scrape data from any webpage using just plain English. It is made by the developers of the FetchFox AI scraper. Getting started Install the package and playwright: npm i fetchfox npx playwright install-de...

webshell-analyzer

Web Shell Analyzer Web shell analyzer is a cross platform stand-alone binary built solely for the purpose of identifying, decoding, and tagging files that are suspected to be web shells. The web shell analyzer is the bigger brother to the web shell scanner project...

ROPInjector

ROPInjector A tool written in C Win32 to convert any shellcode in ROP and patch it into a given portable executable PE. It supports only 32-bit target PEs and the x86 instruction set. Published in Blackhat USA 2015, "ROPInjector: Using Return Oriented Programming for Polymorphism and Antivirus...

frogy2.0

Orbis - Attack Surface Intelligence Full-Spectrum Attack Surface Intelligence Orbis automatically maps your organisation's entire internet-facing attack surface, subdomains, open ports, web applications, cloud infrastructure, TLS certificates, email posture, exposed secrets, login panels, and mor...

smbcrawler

SmbCrawler SmbCrawler is no-nonsense tool that takes credentials and a list of hosts and 'crawls' or 'spiders' through those shares. Features: takes host names, IP addresses, IP ranges, or an nmap xml file as input checks permissions check for 'write' permissions is opt-in, because it requires...

BlueToolkit

Extensible Bluetooth vulnerability testing framework for BR/EDR and BLE. Docs • Installation • Usage • Exploits • Hardware • TODOs • Automotive Evaluation • Bluetooth Resources • License BlueToolkit is a modular, black-box Bluetooth security testing framework for Bluetooth Classic BR/EDR and...

AWE

AWE: Adaptive Agents for Dynamic Web Penetration Testing Akshat Singh Jaswal · Ashish Baghel Accepted at NDSS LAST-X 2026 Abstract Modern web applications are increasingly produced through AI-assisted development and rapid no-code deployment pipelines, widening the gap between accelerating softwa...

CVE-2019-12401

CVE-2019-12401: XML Bomb in Apache Solr Solr versions prior to 5.0.0 are vulnerable to an XML resource consumption attack a.k.a. Lol Bomb via its update handler. By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML...

CVE-2014-6271

CS4238 CS4238 Computer Security Practices...

CVE-2020-1472-Easy

CVE-2020-1472-Easy This is definitely not something you would want to run on anything that you care about. Built from a writeup and work from @obfuscatee and another source Uses code from https://github.com/dirkjanm/CVE-2020-1472 https://github.com/SecuraBV/CVE-2020-1472...

XXRF-Shots

What is SSRF vulnerability? Server Side Request Forgery SSRF is a type of vulnerability that enables attackers to send specially crafted requests through a vulnerable web application. With this technique, attackers can gain unauthorized access to internal resources behind a firewall, which would...

CVE-2019-16662

CVE-2019-16662 The official exploit for rConfig 3.9.2 Remote Code Execution CVE-2019-16662...

rover

rover Proof of Concept code for CVE-2016-5696 Rover is a small python program to discover abitrary client source ports as shown in CVE-2016-569. Once the source port is known, the 4 tuple of information needed to confirm that two host are communicating can be completed. When run, rover establishe...

QuickAsm

Quick Assembler Simple experimental x86/x64 assembler and emulator. Quick Assembler is a Windows application built with WTL and my WTLHelper library, with light and dark themes. Here is a list of currently supported features: Editing, opening, and saving ASM files, including undo/redo, with synta...

Honeypot-Project

OWASP Honeypot-Project The goal of the OWASP Honeypot Project is to identify emerging attacks against web applications and report them to the community, in order to facilitate protection against such targeted attacks. Based around the earlier OWASP/WASC Distributed Web Honeypots Project...

CVE-2025-64512

CVE-2025-64512 – pdfminer.six Deserialization PoC Overview This proof-of-concept demonstrates a vulnerability in pdfminer.six CVE-2025-64512 that can lead to arbitrary command execution when a malicious PDF is processed. The exploit uses a crafted PDF that references a malicious, gzip-compressed...

CVE-2025-28121

💥 CVE-2025-28121 - Reflected XSS in Online Exam Mastering System 1.0 📝 Description code-projects Online Exam Mastering System 1.0 is vulnerable to Reflected Cross-Site Scripting XSS in the feedback.php file via the q parameter. This issue allows remote attackers to inject malicious JavaScript int...

CVE-2025-10952-ml-logger-AFR

CVE-2025-10952 — ml-logger streamhandler Arbitrary File Read This repository provides a standalone Python script — CVE-2025-10952.py — that exploits an unauthenticated arbitrary file read vulnerability in ml-logger's streamhandler, chained with the /glob endpoint for filesystem enumeration. When...

Awesome_shiro

Awesome-shiro CVE-2016-4437 Shiro Base64 decode -- AES decrypt -- Deserialize Environment Works on both linux/win10 Works on both python2/python3 Since the module directory contains ysoserial.jar, the project is a bit large. Please bear with us. Local Target Setup docker pull...

CVE-2024-21534

CVE-2024-21534: Remote Code Execution Vulnerability in jsonpath-plus =10.0.7 Summary This repository contains a Proof of Concept PoC exploit for a critical Remote Code Execution RCE vulnerability in the jsonpath-plus package, affecting versions prior to 10.0.7. The issue stems from improper input...

CVE-2000-0114

Badges License MIT Installation 1. Install Python3 and pip Instructions Here If you can't figure this out, you shouldn't really be using this Install via pip pip install CVE-2000-0114 Run bellow command to check CVE-2000-0114 -h Configurations 2. We integrated with the Telegram API to receive...

CVE-2023-26035

CVE-2023-26035 ZoneMinder Snapshots - Unauthenticated Install Grab Repo $ git clone https://github.com/Yuma-Tsushima07/CVE-2023-26035.git Setup Note: Install the latest version of node $ npm init $ npm i axios cheerio yargs Usage ┌─✗─v37r1x@7h3B14ckKn1gh75─/Documents/Code/CVE-2023-26035 └──╼ $nod...

AperiSolve

Aperi'Solve Try it now: https://www.aperisolve.com Support Aperi'Solve: Aperi'Solve is an open-source steganalysis web platform that performs automated analysis on images to detect and extract hidden data using common steganography tools and techniques. Key features Visualize each bit layer LSB a...

algo

Algo VPN Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release announcement for more information. Features Supports only IKEv2 with strong crypto AES-GCM...

CVE-2025-55182-Typescript

Links https://github.com/msanft/CVE-2025-55182 https://nextjs.org/blog/CVE-2025-66478 https://vercel.com/changelog/cve-2025-55182 https://www.reddit.com/r/reactjs/comments/1pd8kxu/criticalvulnerabilitiesinreactandnextjs/...

GraphQLer

The only dependency-aware GraphQL API testing tool! GraphQLer is a cutting-edge tool designed to dynamically test GraphQL APIs with a focus on adaptability. It offers a range of sophisticated features that streamline the testing process and ensure robust analysis of GraphQL APIs. GraphQLer...

CVE-2025_9501-POC

CVE-20259501-POC...

watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428

CVE-2025-4427 and CVE-2025-4428 Ivanti EPMM Chain Ivanti EPMM Pre-Auth RCE Chain 1day Detection Artifact Generator Tool Detection in Action $ python3 watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428.py -H https://192.168.1.100 / | | |\ \ \ / / \ \ / | | | | / \ / / \ \ \ / / | | \ | Y |...

sudo-chroot

Description: Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option. Local Privilege Escalation by sudo-chroot -R...

thematrix

TheMatrix This project was created to ease the malware analysis process. The goal is to create an activator binary whose purpose is to load a user defined binary and monitor the execution by using Win32 API hooks. Relevant data is then saved to disk. The code supports both x86 and x64 binaries. D...

Minesweeper

A Burpsuite plugin BApp to aid in the detection of scripts being loaded from over 23000+ malicious cryptocurrency mining domains cryptojacking. Summary Minesweeper will passively scan in-scope items looking for matches against more than 23000+ known cryptojacking domains within the source of page...

firecracker

Our mission is to enable secure, multi-tenant, minimal-overhead execution of container and function workloads. Read more about the Firecracker Charter here. What is Firecracker? Firecracker is an open source virtualization technology that is purpose-built for creating and managing secure,...

CVE-2026-51788

Security Advisory: CVE-2026-51788 Denial of Service DoS Vulnerability in cleverangeauth v0.1.10 CVE ID: CVE-2026-51788 Status: Assigned Date Discovered: 2026-04-27 Researcher: Aykhan Isgandarli Severity: High CVSS v3.1: 7.5 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Produc...

Blackash-CVE-2025-14558

🚨 CVE-2025-14558 : Critical Remote Code Execution in FreeBSD IPv6 🧠 Overview CVE-2025-14558 is a critical Remote Code Execution RCE vulnerability affecting FreeBSD systems that use IPv6 router solicitation services. A flaw in how untrusted network input is handled allows attackers to execute...

ghostlock-sabrina

GhostLock Sabrina Root exploit for Chromecast with Google TV sabrina via CVE-2026-43499 -- a use-after-free in the Linux kernel's futex PI priority inheritance subsystem. Achieves root on a locked bootloader device running Android 14 with kernel 5.15.170 PGO+BOLT+LTO, clang 17. The vulnerability...