CVE-2024-24919

Takes in a ip list and you can specify threads with -t python3 exploit.py -i ips.txt -t 15 -o output.txt For educational purposes only...

CVE-2021-44228-PoC

Self-contained lab environment PoC that runs a reverse-shell with Log4Shell CVE-2021-44228 This is a self-contained lab environment that runs the exploit safely, all from docker compose. The affected versions are Apache Log4j =2.0–2.14.1 and the CVE is tracked as CVE-2021-44228 CVSS score: 10.0. ...

CVE-2023-51214

Suggested description Cross Site Scripting vulnerability in Implementing an Activity Log in Your Web App Using PHP v.1 allows a remote attacker to execute arbitrary code via a crafted payload to the URL. Vulnerability Type Cross Site Scripting XSS Vendor of Product sourcecodester.com Affected...

NeuroCore

NeuroCore High-Performance Structural Binary Analysis and Visualization Utility Abstract NeuroCore is a native macOS utility engineered for the structural analysis of binary data through high-velocity visualization. By leveraging General-Purpose Computing on Graphics Processing Units GPGPU via...

-Pegasus-Suite

Pegasus-Suite A comprehensive security toolkit with 1000+ penetration testing and security assessment tools. Author Letda Kes Dr. Sobri, S.Kom. Contact: [email protected] GitHub: github.com/sobri3195 Overview Pegasus-Suite is an all-in-one cybersecurity framework designed for security...

pmotadeee

🧠 FLATLINE - Consciousness Injection Protocol WARNING: This is not a game. It's a cognitive interface for reality hacking. 🎮 HOW TO PLAY Basic Gameplay 1. Download consciousness modules CSV files from this repository 2. Inject directly into AI interfaces as file uploads 3. Experience accelerated...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

HikvisionExploiter_fixed

HikvisionExploiter Educational security tool for testing unsecured Hikvision exposures and checking CVE-2021-36260 in authorized environments. ⚠️ Legal and Ethical Warning This project should be used only on systems you own or have explicit permission to test. Scanning/exploitation without...

onionshare

OnionShare OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Installing OnionShare You can download OnionShare for Windows and macOS from the OnionShare website. For macOS you can also use Homebrew:...

CVE-2022-23773-Reproduce

CVE-2022-23773-Reproduce Execute the demo root@kitploit: git clone https://github.com/Liuyushung/CVE-2022-23773-Reproduce.git cd CVE-2022-23773-Reproduce/testenv/ ./execmain.sh...

agent-bom

Supported backends vary by capability. Capability matrix...

web-mitm-lab

WebMITM Lab - Security Research Framework Python 3.x | Educational License | View License ⚠️ For Educational Purposes and Authorized Security Research Only 📌 Description WebMITM Lab is an educational framework designed to demonstrate Man-in-the-Middle MITM attack concepts in cybersecurity training...

logdata-anomaly-miner

logdata-anomaly-miner This tool parses log data and allows to define analysis pipelines for anomaly detection. It was designed to run the analysis with limited resources and lowest possible permissions to make it suitable for production server use. Requirements In order to install...

CVE-2021-39512-BigTreeCMS-v4.4.14-AccountTakeOver

BigTreeCMS-v4.4.14-Unauthenticated-CSRF-AccountTakeOver Unauthenticated CSRF Account TakeOver in BigTreeCMS v4.4.14 All searchable modules in the admin panel of BigTreeCMS v4.4.14 are vulnerable to reflected DOM-XSS via the URI. Search queries are reflected on the page without proper sanitization...

CVE-2022-29056

CVE-2022-29056 Exploit Automation For Educational Purposes 🚨 📌 Description This is a Python script with a graphical interface Tkinter that allows the user to test automated request submissions to a login endpoint. The goal is to simulate how servers respond to different payload sizes and analyze...

Narthex

Narthex Narthex Greek: Νάρθηξ, νάρθηκας is a modular & minimal dictionary generator for Unix and Unix-like operating system written in C and Shell. It contains autonomous Unix-style programs for the creation of personalised dictionaries that can be used for password recovery & security assessment...

linWinPwn

linWinPwn - Swiss-Army knife for Active Directory Pentesting using Linux Description linWinPwn is a bash script that wraps a number of Active Directory tools for enumeration LDAP, RPC, ADCS, MSSQL, Kerberos, SCCM, vulnerability checks noPac, ZeroLogon, MS17-010, MS14-068, object modifications...

badssl.com

Visit badssl.com for a list of test subdomains, including: self-signed.badssl.com expired.badssl.com mixed.badssl.com rc4.badssl.com hsts.badssl.com Server Setup Stock Ubuntu VM, DNS A records for badssl.com. and .badssl.com. pointing to the VM. Testing and development...

pentestagent

PentestAgent AI Penetration Testing https://github.com/user-attachments/assets/a67db2b5-672a-43df-b709-149c8eaee975 Requirements Python 3.10+ API key for OpenAI, Anthropic, or other LiteLLM-supported provider Install root@kitploit: Clone git clone https://github.com/GH05TCREW/pentestagent.git cd...

cve-2018-1002105

This was modified from https://gravitational.com/blog/kubernetes-websocket-upgrade-security-vulnerability/. All credit goes to the kind folks at Gravitational. The original PoC code was modified to go a bit beyond checking for vulnerability and to actually run a command inside the first container...

CVE-2025-24752-POC

CVE-2025-24752-POC Introduction This python application checks whether a site is vulnerable to CVE-2025-24752. Install Clone this repo and run: root@kitploit: pip3 install -r requirements.txt Usage root@kitploit: python3 cve-2025-24752.py --url http://example.com or root@kitploit: python3...

CVE-2020-5902

This repository does not have a README...

dark-web-osint-tools

🕵️‍♂️ OSINT Tools for the Dark Web 🔎 Dark Web Search Engine Tools Katana - https://github.com/adnane-X-tebbaa/Katana OnionSearch - https://github.com/megadose/OnionSearch Darkdump - https://github.com/josh0xA/darkdump Ahmia Search Engine - ahmia.fi, https://github.com/ahmia/ahmia-site Darkus -...

CVE-2024-21626

PoC of CVE-2024-21626 Read my full article for detailed explanation here. Related article While investigating CVE-2024–21626 , I discovered an overlooked vulnerability in older versions of Docker and runC. To learn more about what I found, read the following article: “Exploring Hidden...

CVE-2021-35215

CVE-2021-35215 SolarWinds Orion Platform ActionPluginBaseView Deserialization RCE, requires login. PoC root@kitploit: POST /Orion/RenderControl.aspx HTTP/1.1 Host: 192.168.137.130:8787 Content-Length: 3648 Cache-Control: max-age=0 Origin: http://192.168.137.130:8787 Upgrade-Insecure-Requests: 1...

OpenPetya

OpenPetya A Proof-of-Concept bootkit and UEFI boot application inspired by Petya ransomware, written in Assembly, C, and C++ If you find this project helpful or informative, I would truly appreciate a ⭐ on the repository. Your support would be a great motivation for me to continue improving this...

Grafxploit

Automated Exploit Tool for Grafana CVE-2021-43798 Overview This project is an automated exploit tool designed to scan for and extract sensitive information from compromised Grafana instances vulnerable to CVE-2021-43798. The tool identifies vulnerable plugins and extracts SSH keys from compromise...

CVE-2024-32030-Nuclei-Template

CVE-2024-32030 Nuclei Template Description This repository contains a Nuclei template for detecting the CVE-2024-32030 vulnerability. This vulnerability allows for remote code execution via JMX Metrics Collection JNDI Resolution. Vulnerability Details ID: CVE-2024-32030 Name: JMX Metrics Collecti...

bad-dicom

Bad-DICOM PoC of my handcrafted CVE-2019-11687's exploit tool. I've crafted this PEDICOM as a Proof of Concept for my college's capstone: "Detection and prevention of attacks based on vulnerabilities of DICOM files against medical management services ". What is a PEDICOM DoomDicom.dcm is a PEDICO...

PcapViz

PcapViz PcapViz draws networks as device topologies and as information flows using the packet information in pcap files captured from a network device using tcpcap or other capture software. It filters and optionally displays the captured packets at any one of 3 "layers". These are: device level...

PiKarma

root@kitploit: ██████╗ ██╗██╗ ██╗ █████╗ ██████╗ ███╗ ███╗ █████╗ ██╔══██╗██║██║ ██╔╝██╔══██╗██╔══██╗████╗ ████║██╔══██╗ ██████╔╝██║█████╔╝ ███████║██████╔╝██╔████╔██║███████║ ██╔═══╝ ██║██╔═██╗ ██╔══██║██╔══██╗██║╚██╔╝██║██╔══██║ ██║ ██║██║ ██╗██║ ██║██║ ██║██║ ╚═╝ ██║██║ ██║ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝...

ProtOSINT

ProtOSINT ProtOSINT is a Python script that helps you investigate Proton Mail accounts. Version This is ProtOSINT v2. The first version has been around for a few years, but Proton's API changed and the old checks stopped working, so this is a rewrite that brings the tool back to life. Big thanks ...

wazuh

Wazuh Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. Wazuh solution consists of an endpoint security agent, deployed to the monitored...

CVE-2024-4577-PHP-RCE

CVE-2024-4577-PHP-RCE 项目简介与原理 全球首款利用PHP默认环境（XAMPP）的CVE-2024-4577 PHP-CGI RCE 漏洞 EXP。 The world's first CVE-2024-4577 PHP-CGI RCE exploit utilizing the default PHP environment. Sharing original exploit, supports SSRF, supports WAF bypass. 实现PHP默认环境RCE。原理：cgi.forceredirect + REDIRECT-STATUS。...

SHELL-POC-CVE-2022-46169

SHELL-POC-CVE-2022-46169 A bash proof of concept of the CVE-2022-46169 sendind a revserse shell payload. To make a vulnerable environement on your own, visit this repo : https://github.com/m3ssap0/cacti-rce-cve-2022-46169-vulnerable-application. Usage : root@kitploit: ./poc.sh -i -p -u...

frameworks_base_AOSP10_r33_CVE-2023-21251

This repository does not have a README...

hstsparser

HSTS Parser HSTS Parser is a simple tool to parse Firefox and Chrome's HSTS databases into actually helpful forensic artifacts! You can read more about the research behind this tool and potential uses for it over on my blog! Installation HSTS Parser can be installed via pip, or as a native...

gethspoit

Gethsploit gethsploit is a set of python scripts to enumerate ethereum peers which have rpc-ports enabled. Prerequisites Make sure you have geth installed, preferably the latest version, which has some fixes concerning attaching to other rpc-instances. Using Gethsploit Make sure geth is not...

nox-framework

root@kitploit: ███╗ ██╗ ██████╗ ██╗ ██╗ ████╗ ██║██╔═══██╗╚██╗██╔╝ ██╔██╗ ██║██║ ██║ ╚███╔╝ ██║╚██╗██║██║ ██║ ██╔██╗ ██║ ╚████║╚██████╔╝██╔╝ ██╗ ╚═╝ ╚═══╝ ╚═════╝ ╚═╝ ╚═╝ Cyber Threat Intelligence Framework OSINT framework for red teaming, digital forensics, and corporate exposure analysis...

packages_apps_Settings_AOSP10_r33_CVE-2020-0219_CVE-2020-0188_old

This repository does not have a README...

CVE-2019-5418

CVE-2019-5418 1. Vulnerability Description Ruby on Rails is a web application framework, a relatively newer web application framework built on the Ruby language. This vulnerability is mainly caused by Ruby on Rails using the render file method with a specified parameter to render views outside th...

auditpolCIS

auditpolCIS CIS Benchmark testing of Windows SIEM configuration This is an application for testing the configuration of Windows Audit Policy settings against the CIS Benchmark recommended settings. A few points: The tested system was Windows Server 2019, and the benchmark used was also Windows...

dorothy

Created by David French @threatpunter at Elastic Security Dorothy is a tool to help security teams test their monitoring and detection capabilities for their Okta environment. Dorothy has several modules to simulate actions that an attacker might take while operating in an Okta environment and...

PuttyRider

PuttyRider Hijack Putty sessions in order to sniff conversation and inject Linux commands. Download PuttyRider-bin.zip Documentation Defcamp 2014 presentation - pdf Defcamp 2014 presentation - video Examples List existing Putty processes and their status injected / not injected root@kitploit:...

CVE-2024-10914

CVE-2024-10914 - D-Link Remote Code Execution RCE Exploit This script is a proof-of-concept PoC exploit for CVE-2024-10914, a remote code execution vulnerability in certain D-Link devices. The script identifies and exploits vulnerable devices to execute arbitrary commands. Note: This script shoul...

CVE-2022-22947

CVE-2022-22947 Run: CVE-2022-22947.exe ip command Affected versions: Spring Cloud Gateway 3.1.1 Spring Cloud Gateway 3.0.7 Spring Cloud Gateway other no longer updated versions...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...

edge

Cloud edge - Whois for the Cloud Lookup an IP to find the cloud provider and other details based on the provider's published JSON, CSV, or text data Cloud edge is a recon tool focused on exploring cloud service providers. It can be used for cloud attribution and forensics, pentesting, bug bounty,...

LinkedInDumper

LinkedInDumper Python 3 script to dump company employees from LinkedIn API 💬 Description LinkedInDumper is a Python 3 script that dumps employee data from the LinkedIn social networking platform. The results contain firstname, lastname, position title, location and a user's profile link. Only 2 A...

rz-ghidra

rz-ghidra This is an integration of the Ghidra decompiler and Sleigh Disassembler for Rizin. It is solely based on the decompiler part of Ghidra, which is written entirely in C++, so Ghidra itself is not required at all and the plugin can be built self-contained. This project was presented,...