CVE-2022-25012

CVE-2022-25012 Argus Surveillance DVR v4.0 employs weak password encryption. Compilation root@kitploit: gcc pocland.c -o pocland Usage Example root@kitploit: ./pocland B4A1ECB4F539C48C7357F641C9C49083 References CVE-2022-25012 More PoCs available at: pocland...

go-get-rce

This repository does not have a README...

CVE-2022-46169

Cacti | Auth Bypass | RCE | CVE-2022-46169 Cacti: Unauthenticated Remote Code Execution Exploit in Ruby Cacti Docker This is a dockerized application that is vulnerable to the Cacti RCE vulnerability CVE-2022-46169. Follow the link to get Cacti running root@kitploit:...

CVE-2025-65321

CVE-2025-65321 The Language Sloth Discord bot is vulnerable to Directory Traversal in the gif and png functions. The functions build file paths using unsanitized user input for the 'name' parameter, allowing attackers to reference files outside the intended resource directories. The functions "gi...

security-research

Security Research Vulnerability research write-ups. Every entry here corresponds to a fixed, publicly tracked issue — no theoretical findings. Adel Bouachraoui — hydrasecurity.fr/v10/ · LinkedIn · YesWeHack Published...

CVE-2026-34197

CVE-2026-34197 CVE-2026-34197 activemq PoC PoC for the ActiveMQ as per Horizon3 post https://horizon3.ai/attack-research/disclosures/cve-2026-34197-activemq-rce-jolokia/ root@kitploit: krasn@icestorm cve-2026-34197-activemq % docker compose up -d krasn@icestorm cve-2026-34197-activemq % python3...

CVE-2026-48778

CVE-2026-48778 POC Notepad++ RCE via config.xml commandLineInterpreter Usage root@kitploit: .\CVE-2026-48778.exe calc.exe Demo https://github.com/user-attachments/assets/79ec82c9-ab37-4923-b62d-325710095e86 Vulnerability Summary...

catsploit

CATSploit🐈 CATSploit es una herramienta de pruebas de penetración automatizada que utiliza el método de Puntuación de Técnicas de Ataque Cibernético CATS y que puede ser utilizada sin la necesidad de un pentester. Actualmente, los pentesters realizaban implícitamente la selección de técnicas de...

catsploit

CATSploit🐈 CATSploit is an automated penetration testing tool using Cyber Attack Techniques Scoring CATS method that can be used without pentester. Currently, pentesters implicitly made the selection of suitable attack techniques for target systems to be attacked. CATSploit uses system...

xmlsec

XMLSec Library XMLSec library provides C based implementation for major XML Security standards: XML Signature Syntax and Processing XML Encryption Syntax and Processing Detailed information about supported features and algorithms can be found in the XMLDsig and the XMLEnc interoperability reports...

MalConfig

MalConfig This is part of a module for the framework that i'm constantly developing. Robots images are provided by robohash.org Flag icons are provided by famfamfam The decoders were mostly making use of Androguard to extract the C2 or malware authors' credentials One of the decoder is making use...

Gh0st-light

Gh0st-light The old thing after simplification Based on Gh0st3.6...

Exploitarium-Detections

Exploitarium KQL Detection Coverage KQL detection rules for Microsoft Sentinel and Defender XDR covering the bikini/exploitarium anonymous disclosure — a personal research archive of 15+ distinct vulnerability targets across 109+ tracked files, released without vendor notification on June 23, 202...

aigate

aigate Secret hygiene for AI-generated code. Catches hardcoded credentials in prompts, tool inputs, generated code, and existing files. Quick start root@kitploit: pip install aigate && aigate setup-all That's it. This installs a background proxy redact mode, a PostToolUse hook for file scanning,...

OpenCLAW-P2P

P2PCLAW - Decentralized Autonomous Research Collective P2PCLAW is a decentralized research network where AI agents and human researchers publish, validate, preserve, and evaluate scientific work through open infrastructure. Latest public paper: arXiv:2604.19792, currently revised as OpenCLAW-P2P...

PassBreaker

PassBreaker PassBreaker is a command-line password cracking tool developed in Python. It allows you to perform various password cracking techniques such as wordlist-based attacks and brute force attacks. Features Wordlist-based password cracking Brute force password cracking Support for multiple...

faxhell

faxhell "Fax Shell" Un shell de enlace de prueba de concepto que utiliza el servicio Fax y un secuestro de DLL basado en Ualapi.dll. Consulte nuestro análisis en: https://windows-internals.com/faxing-your-way-to-system/ Cómo usar Compila Ualapi.dll y colócalo en c:\windows\system32 Inicia el...

faxhell

faxhell "Fax Shell" A Proof-of-Concept bind shell using the Fax service and a DLL hijack based on Ualapi.dll. See our writeup at: https://windows-internals.com/faxing-your-way-to-system/ How to use Build Ualapi.dll and place in c:\windows\system32 Start the Fax service, which will load the DLL an...

dotdotpwn

DESCRIPTION DotDotPwn - The Directory Traversal Fuzzer It's a very flexible intelligent fuzzer to discover traversal directory vulnerabilities in software such as HTTP/FTP/TFTP servers, Web platforms such as CMSs, ERPs, Blogs, etc. Also, it has a protocol-independent module to send the desired...

cve_2026_31431

CVE-2026-31431 "Copy Fail" Toolkit Detector and proof-of-concept LPE for the Linux algifaead / authencesn page-cache scratch-write bug disclosed 2026-04-29. Disclosure writeup: https://xint.io/blog/copy-fail-linux-distributions Authorization Use only on hosts you own or are explicitly engaged to...

Libssh-server-CVE-2018-10933

libssh Authentication Bypass VulnerabilityCVE-2018-10933 中文版本Chinese version libssh is a multiplatform C library implementing the SSHv2 protocol on client and server side. A logic vulnerability was found in libssh's server-side state machine. The attacker can send the MSGUSERAUTHSUCCESS message...

irule-cve-2022-22965

irule-cve-2022-22965 This is a basic iRule to provide some mitigation against CVE-2022-22965 a.k.a. Spring4Shell. Tested on BIG-IP 15.x. Overview On March 30, 2022, a remote code execution RCE vulnerability was found in the Java Spring Framework, identified by the CVE 2022-22965. I am sharing an...

heartbleed-dtls

heartbleed-dtls-test POC for CVE-2014-0160 Heartbleed for DTLS. License This code is licensed uder the BSD 3-Clause License file LICENSE, which is 99% identical to Go's license file LICENSE.golang. Given that large parts of this code are copied/inspired by golang's tls code, both license files ar...

CVE-2025-1868

CVE-2025-1868: Advanced IP Scanner & Advanced Port Scanner NTLM Leakage HTTP Tester Small dockerized PHP app that triggers an NTLM handshake and extracts the claimed domain , user , and workstation from NTLM Type 3 messages. It does not validate passwords. It does not store challenges. It only lo...

CVE-2024-9935

CVE-2024-9935 - PDF Generator Addon for Elementor Page Builder = 1.7.5 - Unauthenticated Arbitrary File Download Overview The PDF Generator Addon for Elementor Page Builder plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5 via the rtwpgaepbdwnldpdf...

Heartbleed-PoC-Exploit-Script

Heartbleed-PoC-Exploit-Script This Python Proof-of-Concept PoC script detects the Heartbleed vulnerability CVE-2014-0160 by performing a TLS handshake with the heartbeat extension and sending a crafted heartbeat request. It parses server responses to identify leaked memory, helping assess...

liferay-ga4-rce-research

Liferay CE 7.0.3 GA4 — Vulnerability Research RAPTOR Loop-Hunt A security audit of Liferay Portal CE 7.0.3 GA4 git tag 7.0.3-ga4, commit b2d7cc68a performed with the RAPTOR loop-hunt methodology: deterministic recon → 25 isolated generator agents reading raw source → 22 independent judge agents...

zeroheight-account-verification-bypass-CVE-2025-65925

CVE-2025-65925 — Zeroheight Incorrect Access Control in Account Creation Flow Disclosure Date: 2025-06-11 Vendor fix date per vendor: 2025-06-13 Researcher validation date: 2025-06-26 Discovered by: Sneden Rebello Summary A legacy user creation API pathway allowed accounts to be created without...

quantum-security-project

OWASP Quantum Security Project Prepare Today. Protect tomorrow. An official OWASP community project mapping the security risks of the quantum era in a practical, vendor-neutral, and risk-based way - the antidote to hype and fear. Status: Bootstrap phase. The OWASP Top 10 for Quantum Security Risk...

CodeAnalysis

TCA, Tencent Cloud Code Analysis code-named: CodeDog English | 简体中文 TCA Official Official website: https://tca.tencent.com Official introduction: https://cloud.tencent.com/product/tcap TCA CNB PagesBetter Internet Speed Domestic: https://cnb.cool/tencent/cloud/tca/code-analysis Domestic:...

awesome-industrial-control-system-security

awesome-industrial-control-system-security A curated list of resources related to Industrial Control System ICS security. Feel free to contribute. Tools...

CVE-2024-6387

OpenSSH CVE-2024-6387 Vulnerability Checker This Python script checks if servers are running a vulnerable version of OpenSSH that is susceptible to the CVE-2024-6387 vulnerability. It scans the specified IP addresses or network ranges for the OpenSSH banner and compares it against known vulnerabl...

CVE-2026-1492

CVE-2026-1492 User Registration & Membership = 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration 🔴 Vulnerability Overview CVE-2026-1492 — Unauthenticated Privilege Escalation via Membership Registration Description: The User Registration & Membership plugin for WordPress is...

CVE-2019-0708

CVE-2019-0708 Goby support CVE-2019-0708 "BlueKeep" vulnerability check. Respect to @JaGoTu and @zerosum0x0 How to use 1. Download Goby http://gobies.org/ 2. Download and instrall npcap https://nmap.org/npcap/ 3. Scan network of 3389 port ScreenShots About Goby Goby - Make Cybersecurity More...

nGixshell

nGixShell es un escáner de CVE de nginx y un framework de explotación RCE. Incluye una prueba de concepto funcional para CVE-2026-42945 — un desbordamiento crítico de heap buffer en ngxhttprewritemodule — y un escáner que cubre 53 CVEs de nginx con sondas HTTP automatizadas, huella digital,...

CVE-2021-27905

CVE-2021-27905 Sr No| Title ---|--- 1| Overview 2| Root Cause 3| Proof Of Concept 4| Mitigation 8.8.2+ 5| Reference For educational and research purposes only. Do not use this code on systems you do not own or have explicit permission to test. I am not responsible for any misuse. Overview This is...

FrisbeeLite

Frisbee Lite A GUI-based USB device fuzzer Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Andy Davis, andy dot davis at nccgroup dot com https://www.github.com/nccgroup/FrisbeeLite Released under AGPL see LICENSE for more information Documentation In order to get...

chomtesh

CHOMTE.SH Be sure to :star: this repo so you can keep up to date on any daily progress! CHOMTE.SH is a versatile framework designed for automating reconnaissance tasks in penetration testing. It's useful for bug bounty hunters and penetration testers in both internal and external network...

dcsgonebadge

DEF CON Singapore One Badge This project manages the hardware design of the Circuit Crafters first project, an electronic hardware badge intended for distribution at the DEF CON Singapore 2026 security conference at the Marina Bay Sands Expo and Convention Centre. License This project is licensed...

LazyHook

Overview LazyHook is a stealthy API hooking framework that bypasses Host Intrusion Prevention Systems HIPS through call stack spoofing. By leveraging CPU-level hardware breakpoints and Vectored Exception Handling, it executes arbitrary code as if it originated from trusted, Microsoft-signed...

Krb5RoastParser

Krb5RoastParser 📑 Table of Contents ❓ What is Krb5RoastParser? ⭐ Features ⚙️ Installation ▶️ Execution 📈 Post Execution 📜 License ❓ What is Krb5RoastParser? Krb5RoastParser is a tool designed to parse Kerberos authentication packets AS-REQ, AS-REP and TGS-REP from .pcap files and generate...

PyHook

PyHook PyHook is the python implementation of my SharpHook project, It uses various API hooks in order to give us the desired credentials. PyHook Uses frida to inject it's dependencies into the target process Supported Processes...

OpenAttack

Documentation • Features & Uses • Usage Examples • Attack Models • Toolkit Design OpenAttack is an open-source Python-based textual adversarial attack toolkit, which handles the whole process of textual adversarial attacking, including preprocessing text, accessing the victim model, generating...

DigiDuck-Framework

DigiDuck Framework Framework for Digiduck Development Boards running ATTiny85 processors and micronucleus bootloader! alt text Screenshot of DDF Welcome Screen Roadmap: Plan to implement a command for Duckyspark translation within the framework. Requirements: - ATTiny85 or other compatible...

IoT-Pentest-devices-and-purpose

IoT Pentest Devices and Their Purpose - 2025 Edition This document outlines the latest tools and hardware for IoT security testing in 2025, covering different protocols and technologies. It includes cutting-edge attacks, newly discovered vulnerabilities, and updated hardware and software tools wi...

rewerse-engineering

rewerse engineering An unofficial REWE API client in Go and Python. It implements the publicly accessible unauthenticated endpoints the REWE app uses for querying current discounts Angebote, products, markets and recalls. Current supported APK version: 5.16.2 as of 06.08.26 !CAUTION The...

SharpEventPersist

SharpEventPersist Persistence by writing/reading shellcode from Event Log. Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:\path\to\shellcode.bin" -instanceid 1337 -source Persistence -eventlog "Key Management Service". The shellcode is converted to hex and written to...

jaeles-signatures

This project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine This repo only contain Default Signatures for Jaeles project. Pull requests or any ideas are welcome. Please read the Official Documentation here for writing your own signature. Installation root@kitploit...

EphemeralNet

EphemeralNet A secure P2P network with custom Relay for hostile NATs, built in C++20. Programmable forgetting for high-assurance peer-to-peer storage. Why EphemeralNet? Shardian designs infrastructure for teams that take deletion guarantees as seriously as confidentiality. EphemeralNet is our C++...

SAMDump

SAMDump Extrae archivos SAM y SYSTEM de Windows usando el Servicio de Copia de Sombra de Volumen VSS con múltiples opciones de exfiltración y ofuscación XOR: Lista las copias de sombra de volumen usando VSS y crea una si es necesario Extrae los archivos SAM y SYSTEM de la copia de sombra Utiliza...