Ghostwriter

Ghostwriter Ghostwriter is an open-source platform designed to enhance offensive security operations by simplifying report writing, asset tracking, and assessment management. It offers tools for managing clients, creating a reusable findings library, and organizing the infrastructure and domains...

Learning-to-Detect

Learning to Detect Unknown Jailbreak Attacks in Large Vision-Language Models Official implementation of “Learning to Detect Unknown Jailbreak Attacks in Large Vision-Language Models.” This repository contains the data-processing, hidden-state extraction, classifier training, safety-pattern...

CVE-2025-7771-Vulnerability-Exploration

🔓 ThrottleStop.sys Kernel Exploit — HVCI-Compatible Physical Memory Mapper CVE-2025-7771 — Arbitrary Physical Memory Read/Write via ThrottleStop.sys IOCTLs ⚠️ Disclaimer This project is published for educational and research purposes only. The goal is to demonstrate how a signed, trusted kernel...

DWF-CVE-2017-1000000

This repository does not have a README...

CVE-2024-23108

CVE-2024-23108 POC Proof of concept exploit to blindly execute commands as root on vulnerable FortiSIEM appliances. I just quickly added the option to supply a list and added some coloring. The orginal and all the cred goes to horizon3 see blog post below Blog Post Root cause and indicators of...

wslink-vm-analyzer

WslinkVMAnalyzer WslinkVMAnalyzer is a tool primarily developed to facilitate analysis of Wslink, which is a unique loader running as a server and executing received modules in-memory. This tool uses Miasm, an open source framework that provides us with a symbolic execution engine. The tool and...

attack-surface-framework

Attack Surface Framework Overview ASF aims to protect organizations acting as an attack surface watchdog, provided an “Object” which might be a: Domain, IP address or CIDR Internal or External, ASF will discover assets/subdomains, enumerate their ports and services, track deltas and serve as a...

0day-Rubbish

0day Rubbish 0day vulnerabilities have become rubbish in the AI era. 🌐 Official Website : https://0day-rubbish.com/blog 🎯 Why This Exists Traditional vulnerability disclosure is broken. It's slow, bureaucratic, and ineffective. In the AI era, we can mass-produce 0days at scale—making individual...

FullPowers

FullPowers FullPowers is a Proof-of-Concept tool I made for automatically recovering the default privilege set of a service account including SeAssignPrimaryToken and SeImpersonate. Rationale On Windows, some services executed as LOCAL SERVICE or NETWORK SERVICE are configured to run with a...

TCPViewer

TCP Viewer A simple, native packet viewer for Mac. Website · Download · Docs · Releases TCP Viewer captures and reads network packets on macOS. It uses system libpcap for capture and Wireshark libraries for deep packet details. Features Native macOS app, built with AppKit Built on top of Wireshar...

byp4xx

/ / / // / / / / / / / // /| |// |// / // / // / // / / Some cURL options you may use as example: -L follow redirections 30X responses -x : to set a proxy -m to set a timeout -H for new headers. Escape double quotes. -d for data in the POST requests body -... Built-in options: --all Verbose mode...

CVE-2017-8759

CVE-2017-8759 CVE-2017-8759 use file...

ChromSploit-Framework

ChromSploit Framework v3.0 Professional Security Research Platform for Browser Vulnerability Analysis Multi-CVE exploitation chains with advanced obfuscation, intelligent detection, and comprehensive analytics Overview ChromSploit Framework is a cutting-edge educational security research tool...

hatiyar

Hatiyar Modern security toolkit for penetration testing, vulnerability assessment, and security research. ⚠️ IMPORTANT: Hatiyar is intended for educational, research, and defensive security use only. Do not use this software on systems you do not own or do not have explicit written permission to...

hardening-k8s-containers

Intentionally Vulnerable Note Taking Application This repository contains a very simple and vulnerable application used to demonstrate the differences between deploying this application with the default settings to a Kubernetes cluster, versus adding some extra security settings that WILL NOT fix...

AntiKernelDebug-POC

AntiKernelDebug-poc What's this? A POC about how to detect windows kernel debug by pool tag. How does this poc actually work? Query system pool tag information matches TagUlong == 'oIdK'. Tested in Win10 1809 Compile Visual Studio 2019 llvm-msvc link...

CVE-2020-14882-weblogicRCE

Detection of RCE in Oracle's "WebLogic Server" CVE-2020-14882 / CVE-2020-14750 Summary: Detection of attempts to exploit CVE-2020-14882 and CVE-2020-14750 - Unauthenticated RCE in Oracle's Weblogic Server. References: Oracle's advisories: CVE-2020-14882...

awesome-cybersec

awesome-cybersec A collection of awesome platforms, blogs, documents, books, resources and cool stuff about security While this repository is still a work in progress , the goal is to build a categorized community-driven collection of very well-known resources. All the good stuff in one place...

conpot

Conpot About Conpot is an ICS honeypot with the goal to collect intelligence about the motives and methods of adversaries targeting industrial control systems. Documentation The documentation can be found here. If you are just checking out conpot, we suggest that you go for quick install. If you...

peerd

!...

Invoke-LinkSpray

Invoke-LinkSpray Powershell script to create malicious SMB or WebDAV links to steal NTLM authentication. Takes UNC or local folder paths from a file specified by the -ShareList parameter. Optionally, -Depth can be used to specify how many folders to recurse when creating URL files. Also supports ...

CVE-2026-0073-Research

CVE-2026-0073-Research CVE-2026-0073 is an RCE with a CVSS severity score of 8.3, and here we will explain how it works. First Part : Code analysis: At first, the only thing that could possibly be interesting is learn more about the bug itself. My first source is :...

CVE-2023-36146

CVE-2023-36146 PoC of CVE-2023-36146 - Multilaser RE 170 Firmware 2.2.6733 Authenticated stored Cross Site Scripting Steps to Reproduce: 1. Log in the equipment via your web browser 2. Go to Security IP Filtering 3. In the "Description" field inject the payload "" 4. Click Add 5. Exploit!...

dockernymous

SCROLL DOWN FOR REQUIREMENTS AND INSTRUCTIONS IT JUST WON'T WORK IF YOU DON'T FOLLOW THEM Warning: Dockernymous is in a very early state of development. Only use it for educational purposes. DON'T use it if you rely on strong anonymity! News 13.10.2018 I completely changed the overall function...

CVE-2024-6387

CVE-2024-6387.py - PoC Important Notes!!! The exploit works ONLY for 32-bit OpenSSH-Servers. This is due to the POC uses 32-bit pointers! It is also known that some versions are already patched, and not every server is vulnerable. Tested on: Kali Linux, ParrotSec, Ubuntu 22.04 📜 Description Remot...

querytool

QUERYTOOL - Google Sheet designed for OSINT About QueryTool is a specialized OSINT framework integrated within Google Sheets, aimed at simplifying the process of generating queries for various search engines to obtain specific results. Designed as an initial step in reconnaissance, QueryTool...

JavaSecLab

JavaSecLab - A Comprehensive Java Vulnerability Lab 中文文档 Overview JavaSecLab is a comprehensive Java vulnerability lab for application security learning, code audit practice, secure development training, and security tool evaluation. Built on Spring Boot, it provides vulnerable code, fixed...

waf-checker

A powerful web application to test how well your Web Application Firewall WAF protects against common attack vectors. → waf-checker.com ← Features Security Testing 19+ attack categories out of the box: SQL Injection, XSS, Path Traversal, Command Injection, SSRF, NoSQL Injection, LFI, LDAP...

mailinabox

Mail-in-a-Box By @JoshData and contributors. Mail-in-a-Box helps individuals take back control of their email by defining a one-click, easy-to-deploy SMTP+everything else server: a mail server in a box. Please seehttps://mailinabox.email for the project's website and setup guide! Our goals are to...

CVE-2022-1388

CVE-2022-1388 - F5 BIG-IP iControl REST Authentication Bypass RCE This Python script exploits CVE-2022-1388, a critical vulnerability in F5 BIG-IP iControl REST that allows unauthenticated remote command execution via improper access control and HTTP header handling. ⚠️ For educational and...

CVE-2024-28397-RCE

CVE-2024-28397-RCE CVE-2024-28397 - Remote Code Execution From Vulnerable JS2PY Usage: python3 exploit.py...

CVE-2025-56381

CVE-2025-56381 — Authenticated SQL Injection in ERPNext / Frappe via orderby and groupby Parameters 📌 Summary ERPNext v15.67.0 and Frappe Framework v15.72.4 contain multiple authenticated SQL injection vulnerabilities in the frappe.desk.reportview.get API endpoint. Malicious input to the orderby ...

CVE-2020-1337

CVE-2020-1337 - Binary Planting CVE-2020-1048 bypass Peleg Hadar @peleghd and Tomer Bar at SafeBreach @safebreach were acknowledged by Microsoft by the CVE-2020-1048, a Windows Spooler Vulnerability that allows an elevation of privilege on Windows 7 and later. Some details were disclosed by Alex...

CVE-2023-25136

OpenSSH Pre-Auth Double Free CVE-2023-25136 POC This repository contains a Proof of Concept POC script to check for the OpenSSH Pre-Auth Double Free vulnerability CVE-2023-25136 using the Paramiko library in Python. Prerequisites Before running this POC script, you need to make sure you have the...

ZeroLogon

ZeroLogon CVE-2020-1472 C++ version. This tool directly resets the machine account password. It does not have recovery functionality. Use with caution in real-world scenarios. Referencing the BOF version: ZeroLogon-BOF, this is a modified single-file EXE version. After compilation, it is only abo...

Exploits

This repository does not have a README...

CVE-2019-11043

CVE-2019-11043 php-fpm+Nginx RCE 0x01 install phuip-fpizdam-Mac go get github.com/neex/phuip-fpizdam go install github.com/neex/phuip-fpizdam ale@Pentest /go go get github.com/neex/phuip-fpizdam ale@Pentest /go go install github.com/neex/phuip-fpizdam ale@Pentest /go ls bin src ale@Pentest /go cd...

0x00sec_code

Source Code for 0x00sec.org posts This repository contains the source code for my posts at 0x00sec.org. Remote Shell Post available at: Part I : https://0x00sec.org/t/remote-shells-part-i/269/1 Part II. Crypt your link: https://0x00sec.org/t/remote-shells-part-ii-crypt-your-link/306 Source code a...

alg_check

⚠️ Important Disclaimer: Structural Hardening Risks This tool implements Structural Blocking to mitigate CVE-2026-31431 by physically renaming kernel modules and purging them from memory. Before use, please be aware of the following architectural risks: Kernel Update Volatility : Hardening effects...

CVE-2025-6018-6019-PoC

CVE-2025-6018 & CVE-2025-6019: Local Privilege Escalation PoC A robust Proof of Concept PoC for chaining CVE-2025-6018 PAM/Polkit Active Session Bypass and CVE-2025-6019 libblockdev SUID Mount Flaw to achieve root access on vulnerable Linux systems. Disclaimer This tool is for educational purpose...

PortGuard

Port-Guard Port-Guard is a USB port management and security tool designed for Debian. It allows you to control access to USB devices , maintain a custom whitelist , and run an automatic background scan to detect any unauthorized connection. ⚠️ Beta version : The software is functional, but...

mitmproxy_rs

mitmproxyrs !autofix.ci:...

decode-spam-headers

decode-spam-headers.py Whether you are trying to understand why a specific e-mail ended up in SPAM/Junk for your daily Administrative duties or for your Red-Team Phishing simulation purposes, this script is there for you to help! Idea arose while delivering a commercial Phishing Simulation...

nodejsscan

nodejsscan Static security code scanner SAST for Node.js applications powered by libsast and semgrep. Made with in India Support nodejsscan Donate via Paypal: Sponsor the Project: e-Learning Courses & Certifications OpSecX Node.js Security: Pentesting and Exploitation - NJS Run nodejsscan docker...

wmiexec-Pro

wmiexec-Pro New generation of wmiexec.py. Table of Contents 1. Info 2. Special thanks 3. Features 4. Getting Started Installation 5. Usage 6. Screenshots 7. How it works? 8. Disclaimer 9. References Info The new generation of wmiexec.py, more new features, whole the operations only work with port...

elpscrk

Elpscrk - v2.0 An Intelligent common user-password profiler that's named after the same tool in Mr.Robot series S01E01 😄 In simple words, elpscrk will ask you about all info you know about your target then will try to generate every possible password the target could think of, it all depends on t...

pypykatz

🚩 Sponsors If you like this project, consider purchasing licenses of OctoPwn, our full pentesting suite that runs in your browser! For notifications on new builds/releases and other info, hop on to our Discord pypykatz Mimikatz implementation in pure Python. At least a part of it : Runs on all OS...

extract75-cve-2020-13995

Control Flow Hijack Exploit for CVE-2020-13995 Build it: make Run it: make run Mayhem it: docker tag extract75-cve-2020-13955 /extract75-cve-2020-13955 docker push /extract75-cve-2020-13955 mayhem run --image /extract75-cve-2020-13955 \ --project /extract75 . Default runtime is 600 seconds;...

POC-IngressNightmare-CVE-2025-1974

Shell.so Builder Alpine-based This project allows you to build a shell.so payload using Alpine Linux inside a Docker container. Instructions 1. Clone the repository : git clone cd 2. Build the payload : ./runbuild.sh The compiled shell.so will be generated in the project root directory. ⚠️...

CVE-2019-20361-EXPLOIT

CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in the hash parameter a blind SQL injection vulnerability. This script is a "sanized-version" of original script avalible on...