MS_T120

MST120 CVE-2019-0708 make the poc step by step, day by day https://docs.microsoft.com/en-us/openspecs/windowsprotocols/ms-rdpbcgr/5073f4ed-1e93-45e1-b039-6e30c385867c...

callstranger-detector

Zeek Package that detects CallStranger CVE-2020-12695 attempts http://callstranger.com/ This package attempts to detect CallStranger CVE-2020-12695 exploitation attempts and data exfiltration. It does so by looking for three key things: 1. UPnP SUBSCRIBE commands with a Notify URL that contains a...

ULTIMATE-CYBERSECURITY-MASTER-GUIDE

🛡️ ULTIMATE CYBERSECURITY MASTER GUIDE Professional Cybersecurity Knowledge Base · Red Team · Blue Team · Purple Team Compiled from 70+ expert books · 90+ PNWC internal documents · custom tools & scripts Abide by theLegal Terms of Use & Disclaimer for the use and misuse of this repository. "Under...

CookieCatcher

CookieCatcher CookieCatcher is an open source application which was created to assist in the exploitation of XSS Cross Site Scripting vulnerabilities within web applications to steal user session IDs aka Session Hijacking. The use of this application is purely educational and should not be used...

Amnesiac

Amnesiac Amnesiac is a post-exploitation framework designed to assist with lateral movement within active directory environments. Amnesiac is being developed to bridge a gap on Windows OS, where post-exploitation frameworks are not readily available unless explicitly installed. In fact, it is...

docker-hacklab

Docker Hacklab My personal hacklab, create your own. French article: https://blog.ston3o.me/creer-hacklab-virtuel-docker/ Quick Start root@kitploit: $ docker run --name hacklab --net=host --privileged -it ston3o/docker-hacklab zsh | || | /\ / | |/ / | /\ | | |/ \ | ' /dev/null 2&1; docker start...

cve-2022-26134

Atlassian Confluence OGNL Injection POC Vulnerability CVE-2022-26134 arbitrary code execution Usage: pip3 install termcolor python3 exploit.py http://example.com documentation :...

LWHP

LWHP Linux and Windows Hardening Points Hardening guides can never be complete as every system needs a different configuration. Consideration it when using these documents and take the points written in this repository as guidelines...

redherd-framework

...

SharpShares

SharpShares Multithreaded C .NET Assembly to enumerate accessible network shares in a domain Built upon djhohnstein's SharpShares project root@kitploit: .\SharpShares.exe help Usage: SharpShares.exe /threads:50 /ldap:servers /ou:"OU=Special Servers,DC=example,DC=local"...

BugBountyScanner

BugBountyScanner A Bash script and Docker image for Bug Bounty reconnaissance, intended for headless use. Low on resources, high on information output. Helpful? BugBountyScanner helped you net a bounty? Description ⚠ Note: Using the script over a VPN is highly recommended. It's recommended to run...

secretlint

Secretlint Secretlint is a Pluggable linting tool to prevent committing credentials. Features Scanner : Find credentials in a project and report these Project Friendly: Easy to set up your project and integrate CI services Pre-Commit Hook : Prevent committing credential files Pluggable : Allow...

talisman

Talisman A tool to detect and prevent secrets from getting checked in Table of Contents What is Talisman? Installation Install onto path recommended approach Installation as a global hook template Configuring a project...

CVE-2024-0582

Introduction This exploit implements a Dirty Cred attack method to gain unauthorized write access to /etc/passwd. Unlike many similar exploits that create numerous pages or aggressively spray file descriptors, this approach takes a more targeted route to corrupt the necessary kernel structures...

jsteg

jsteg root@kitploit: go get lukechampine.com/jsteg jsteg is a package for hiding data inside jpeg files, a technique known as steganography. This is accomplished by copying each bit of the data into the least-significant bits of the image. The amount of data that can be hidden depends on the...

KRBUACBypass

Background This POC is inspired by James Forshaw @tiraniddo shared at BlackHat USA 2022 titled “ Taking Kerberos To The Next Level ” topic, he shared a Demo of abusing Kerberos tickets to achieve UAC bypass. By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake...

dnscontrol

DNSControl DNSControl is Infrastructure as Code for DNS. It includes a full-featured configuration language Javascript-compatible, plus "plug-ins" that speak to DNS provider APIs such as AWS Route 53, Cloudflare, and Gandi. It can send the same DNS records to multiple providers. It runs anywhere ...

dirtyfrag

Dirty Frag: Universal Linux LPE Abstract This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim @v4bel, which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write CVE-2026-43284 vulnerability and the...

gping

gping 🚀 Ping, but with a graph. Comes with the following super-powers: Graph the ping time for multiple hosts Graph the execution time for commands via the --cmd flag Custom colours Windows, Mac and Linux support Table of Contents Install 💿 Usage 🎷 Install 💿 macOS Homebrew: brew install gping...

PoCForCVE-2015-1528

This PoC is divided into three Parts, the folder mediaserver help to inject code into mediaserver from a normal application. the folder surfaceflinger help to inject code to surfaceflinger after you got mediaserver permission. the folder systemserver help to inject code to systemserver after you...

ageverificationbypass

AgeVerificationBypass AVB The Sanctuary Protocol for Sovereign Systems Why do I need to provide an ID to log into a Linux VM? This is not appropriate. 🚨 The Problem: The Archon Age-Gate As of 2026/2027, major distributions Ubuntu and Fedora have begun integrating the...

rootOS

rootOS Tries to use various CVEs to gain sudo or root access. All exploits have an end goal of adding ALL ALL=ALL NOPASSWD: ALL to /etc/sudoers allowing any user to run sudo commands. Run root@kitploit: python root.py Exploits Name| CVE| Date| Links ---|---|---|--- ARDAgent| CVE-2008-2830|...

Evil-Droid

Evil-Droid Framework . version 0.3 root@kitploit: Author: Mascerano Bachir dev-labs Legal Disclamer: root@kitploit: The author does not hold any responsibility for the bad use of this tool, remember this is only for educational purpose. Description: root@kitploit: Evil-Droid is a framework that...

sx

sx is the command-line network scanner designed to follow the UNIX philosophy. The goal of this project is to create the fastest network scanner with clean and simple code. 📖 Table of Contents Features Install Build from source Quick Start References Contributing Credits License ✨ Features ⚡ 30x...

web

I have no data yet. It is a capital mistake to theorize before one has data. Insensibly one begins to twist facts to suit theories, instead of theories to suit facts. 🚧 ⚠️ Work in progress; Not ready for use,yet ⚠️ 🚧 Introducing OSINTBuddy Welcome to the OSINTBuddy project where you can connect,...

cve-2022-42889-text4shell-docker

Install maven - maven-linux 1. Maven install to create the fat jar root@kitploit: mvn clean install 2. Docker build root@kitploit: docker build --tag=text4shell . 3. Docker run root@kitploit: docker run -p 80:8080 text4shell 4. Test the app root@kitploit: http://localhost/text4shell/attack?search...

MemITM

What's the MemITM tool? The MemITM Mem In The Middle tool has been developped in order to easily intercept "messages" in Windows processes memory. We developped a lot of custom memory interception tools in order to capture network messages before encryption, or IPC messages, and to be able to...

Stracciatella

Stracciatella v0.7 Powershell runspace from within C aka SharpPick technique with AMSI, ETW and Script Block Logging disabled for your pleasure. Nowadays, when Powershell got severly instrumented by use of techniques such as: AMSI ETW Script Block Logging Transcript file Modules logging Constrain...

struts-pwn

struts-pwn An exploit for Apache Struts CVE-2017-5638 Usage Testing a single URL. python struts-pwn.py --url 'http://example.com/struts2-showcase/index.action' -c 'id' Testing a list of URLs. python struts-pwn.py --list 'urls.txt' -c 'id' Checking if the vulnerability exists against a single URL...

waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

LTESniffer

LTESniffer - An Open-source LTE Downlink/Uplink Eavesdropper LTESniffer is An Open-source LTE Downlink/Uplink Eavesdropper It first decodes the Physical Downlink Control Channel PDCCH to obtain the Downlink Control Informations DCIs and Radio Network Temporary Identifiers RNTIs of all active user...

SkillSpector

SkillSpector Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, and security risks before installing agent skills. Overview AI agent skills used by Claude Code, Codex CLI, Gemini CLI, etc. execute with implicit trust and minimal vetting. Research shows that 26.1% of...

CVE-2025-3243

CVE-2025-32433 Erlang SSH Library Exploit A proof-of-concept exploit for CVE-2025-32433 , a critical vulnerability in Erlang's SSH library that allows pre-authenticated code execution via malformed SSHMSGCHANNELREQUEST packets. Features Original exploit by Matthew Keeley Updated version by Tyler...

MAD-CAT

MAD-CAT Meow Attack Data Corruption Automation Tool Overview MAD-CAT Meow Attack Data Corruption Automation Tool is a comprehensive security tool designed to simulate data corruption attacks against multiple database systems. The tool supports both single-target attacks and bulk CSV-based attack...

blindy

Blindy Simple script for running brute-force blind MySql injection Note: this script was created for fun, helpful in some ctf challenges : description The script will run through queries listed in sets in provided file and try to brute-force any place where placeholder is found. GET & POST http...

chain-bench

📖 Documentation Chain-bench is an open-source tool for auditing your software supply chain stack for security compliance based on a new CIS Software Supply Chain benchmark. The auditing focuses on the entire SDLC process, where it can reveal risks from code time into deploy time. To win the race...

BeeLogger

BeeLogger Copyright 2017 BeeLogger Written by: Alisson Moretto - 4w4k3 Twitter: @4w4k3Official TOOL DESIGNED TO GOOD PURPOSES, PENTESTS, DON'T BE A CRIMINAL ! Only download it here, do not trust in other places. NOTE: BeeLogger just have official support for latin languages in this moment. HOW TO...

CVE-2014-1773

CClipStack::PushClipRect Invalid Array Indexing First, starting with the callstack from the crash with pageheap enabled: ChildEBP RetAddr 0919aac8 6b58459f MSHTML!CWorldTransform::IsAxisAligned 0919ab40 6ba228e9 MSHTML!CDispSurface::CClipStack::PushClipRect+0x1a2 0919aba4 6be25b58...

CVE-2024-27956

WP Automatic Plugin SQL Injection Exploit CVE-2024-27956 A proof-of-concept exploit for the SQL injection vulnerability in WP Automatic plugin CVE-2024-27956 affecting WordPress sites. 📌 Description This exploit targets a critical unauthenticated SQL injection vulnerability in the WP Automatic...

CVE-2021-41773

CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 CVE-2021-41773 Info A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document...

CVE-2025-40634

CVE-2025-40634 The TP-Link Archer AX50 router is vulnerable to a stack-based buffer overflow on its firmware version 1.0.14 Build 20240108 rel.426554555, leading to Remote Code Execution both in the LAN and in the WAN side. This vulnerability has the same root cause as CVE-2020-10881, found by th...

bouvet

Bouvet Isolated code execution sandboxes for AI agents About • How It Works • MCP Tools • Documentation What is Bouvet? Bouvet boo-veh is an MCP server that creates secure, isolated sandboxes for AI agents to execute code. When an AI agent needs to run Python, Node.js, or shell commands, Bouvet...

deptrust

deptrust root@kitploit: / / / / / / / / / / / / / / / / / / / // / / // / / // / ,// ./// ,/// // deptrust is a CLI that checks package versions for known vulnerabilities across npm, PyPI, crates.io, Go modules, RubyGems, NuGet, Maven, Packagist, pub.dev, CocoaPods, Hex.pm, Hackage, GitHub...

RedGridLink

Red Grid Link Offline MGRS navigation and proximity team coordination for small teams 2-8 people. No cell service needed. Built on the MGRS engine from Red Grid MGRS. Field Link adds zero-config proximity sync over Bluetooth, with Apple Multipeer Connectivity iOS and Google Play Services Nearby...

quasar

Quasar Quasar Is An Information Gathering Framework For Penetration Testers Coded By Belahsan Ouerghi Website Informations E-mail Address Checker Phone Number Information Credit Card Bin Checker Ip Locator Port Scanner Installation root@kitploit: sudo apt-get install git git clone...

PersistBOF

PersistBOF A tool to help automate common persistence mechanisms. Currently supports Print Monitor SYSTEM, Time Provider Network Service, Start folder shortcut hijacking User, Junction Folder User, Xll Add-In User. Usage Clone, run make, add .cna to Cobalt Strike client. run: help persist-ice in ...

CVE-2022-28368-handler

CVE-2022-28368-handler This repository contains a python script that will handle the majority of the dompdf cached font exploit CVE-2022-28368, all you need to do is create the request. It will even provide a trigger string to start the exploit : Usage root@kitploit: usage: CVE-2022-28368.py -h -...

CVE-2021-41805

CVE-2021-41805 - HashiCorp Consul Enterprise RCE !WARNING LEGAL DISCLAIMER: This tool is STRICTLY for EDUCATIONAL PURPOSES ONLY! Usage of this tool for attacking targets without prior mutual consent is ILLEGAL. It is the user's responsibility to obey all laws that apply whilst using this tool. Th...

CVE-2024-29272

CVE-2024-29272 This is a Proof-of-Concept for CVE-2024-29272, an unauthenticated arbritrary file upload vulnerability that leads to remote code execution on versions of VvvebJS -l -p in another terminal: root@kitploit: nc -lvnp...

CVE-2019-9193

EN GenPostgresRCEExploit is a PoC tool designed to exploit an authenticated Remote Code Execution RCE vulnerability in certain versions of PostgreSQL 9.3 - 11.7. It allows authenticated users to execute system commands on a PostgreSQL database server vulnerable to CVE-2019-9193. Features...