pywhisker

pyWhisker pyWhisker is a Python equivalent of the original Whisker made by Elad Shamir and written in C. This tool allows users to manipulate the msDS-KeyCredentialLink attribute of a target user/computer to obtain full control over that object. It's based on Impacket and on a Python equivalent o...

xnLinkFinder

About - v8.2 This is a tool used to discover endpoints, discover potential parameters, generate a target specific wordlist and find secrets for a given target. It can find them by: crawling a target pass a domain/URL crawling multiple targets pass a file of domains/URLs searching files in a given...

bindiff

Copyright 2011-2026 Google LLC. BinDiff This repository contains the BinDiff source code. BinDiff is an open-source comparison tool for binary files to quickly find differences and similarities in disassembled code. Table of Contents About BinDiff Quickstart Documentation Codemap Building from...

CyberSources

Welcome to the Cybersources! This project serves as a central hub for a wide range of tools, resources, and educational materials designed for cybersecurity professionals, enthusiasts, and learners. Whether you're just starting out or an experienced expert, you'll find everything you need to...

IntruderPayloads

IntruderPayloads A collection of Burpsuite Intruder payloads, BurpBounty payloads https://github.com/wagiro/BurpBounty, fuzz lists and pentesting methodologies. To pull down all 3rd party repos, run install.sh in the same directory of the IntruderPayloads folder. Author: [email protected] -...

CVE-2020-24032

CVE-2020-24032 Suggested description tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone. VulnerabilityType Other OS command injection Vendor of Product XoruX s.r.o. Affected Product Code Base LPAR2RRD and...

CVE-2023-38831-winrar

Constructor CVE-2023-38831 Constructor rápido de exploits para CVE-2023-38831, una vulnerabilidad que afecta a las versiones de WinRAR anteriores a la 6.23. Creé este constructor de exploits principalmente para aprender el lenguaje Rust, así que no esperes encontrar código limpio y optimizado...

certgraveyard_yara

CertGraveyard YARA Rules Generator Automated YARA rule generation from the CertGraveyard compromised certificate database. Features 🔄 Daily Updates : Automatically checks CertGraveyard for new compromised certificates 📝 YARA Rule Generation : Creates individual YARA rules for each certificate ✅...

w11_shadow_copies

Windows 11 Shadow Copies On Windows 11, the built-in vssadmin can list, delete or resize Shadow Copies, but Microsoft removed the ability to create them. However, you can still do it by interacting directly with the Volume Shadow Copy Service VSS API, which I already used in my other tool SAMDump...

CVE-2025-43529

CVE-2025-43529 TL; DR Apple recently shipped iOS 26.2 and iPadOS 26.2, along with a security advisory that includes fixes for WebKit vulnerabilities. One bug in the DFG JIT compiler CVE-2025-43529 stood out, so I decided to dig into it. The JIT compiler correctly recognized that a Phi node where...

pecli

PEcli Tool to analyze PE files in python 3. Current features : Show information about the file import, exports, resources Search for interesting information in the file abnormal resources, peid... Dump sections or resources Check size Search for a string in the file Installation You can install i...

ipv4Bypass

ipv4Bypass Using IPv6 to Bypass Security Dependences tested on Kali Linux python3 nmap arp-scan apt-get install arp-scan python-nmap https://pypi.org/project/python-nmap/ Example on how to run the tool root@kitploit: $ python bypass.py -i eth0 -r 10.5.192.0/24 $ python bypass.py -h Usage: bypass....

analyzeMFT

AnalyzeMFT Status : All tests passing across Python 3.8-3.12 on Windows, macOS, and Linux. Quick Start root@kitploit: Install pip install analyzeMFT Basic usage python analyzeMFT.py -f MFTFILE -o output.csv --csv Generate test MFT for testing python -c "from src.analyzeMFT.testgenerator import...

Awesome-LLMs-for-Vulnerability-Detection

Awesome Large Language Models for Vulnerability Detection A curated list of papers, projects, and agent skills on using LLMs for vulnerability detection and discovery. 📄 Papers Only showing 2025 and later. For earlier work, see Papers Archive 2024 and earlier...

java-insecure-random-cve-2021-27568

java-insecure-random-cve-2021-27568 Demo of CVE-2021-27568: Insecure randomness in token generation...

cve-2022-28944

CVE-2022-28944 EMCO Software Múltiples productos Vulnerabilidad de ejecución remota de código sin autenticación en la actualización. Uso: python3 cve-2022-28944poc.py Detalles en el informe en gerr.re. Pasos para reproducir 1. Instale un producto afectado de EMCO Software; 2. Configure la...

flopz

Flopz - Firmware Liberation on Python Flopz is an assembler toolkit written in pure python. Use it to: Create shellcode for embedded systems Dynamically patch large collections of binaries Instrument firmware images, for debugging and fuzzing Currently, Flopz supports: ARM: Thumb Mode PPC: VLE,...

CVE-2026-33917_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-33917 - SQL Injection Vulnerability in OpenEMR Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize ...

Owasp-top-10-k8s-2025

OWASP Kubernetes Top 10 2025, hands-on A capture-the-flag built on the OWASP Kubernetes Top 10 — 2025. You've been hired to red-team NimbusMart , a fictional e-commerce company whose cluster grew faster than its security. Ten challenges, one per OWASP risk plus a bonus — exploit each weakness,...

iox

iox English | 中文 Tool for port forward & intranet proxy, just like lcx/ew, but better Why write? lcx and ew are awesome, but can be improved. When I first used them, I can't remember these complicated parameters for a long time, such as tran, slave, rcsocks, sssocks.... The work mode is clear, wh...

CVE-2024-25081_2025-47273

CVE-2024-25081 and CVE-2025-47273 Proof of Concept FontForge ≤ 20230101 version and Setuptools library Proof of concept for elevating privileges to the user running a task that uses Font Forge. The second CVE elevates privileges to root, provided you have write permissions to sensitive directorie...

Bashark

Bashark 2.0 Post exploitation toolkit Bashark aids pentesters and security researchers during the post-exploitation phase of security audit. Usage To launch this tool on compromised host, simply source the bashark.sh script from terminal: $ source bashark.sh Then type help to see the help menu...

EasY_HaCk

EasYHaCk 1. Hack the World using Termux this tool is developed by sabri.zaki for penetration testing using 2. metasploit-framework 3. sqlmap 4. nmap 5. metagoofil 6. RED HAWK 7. recon-ng and much more powerful testing tools EasYHaCk is a tool for network scanning and information gathering and for...

Claude-Code-MCP-Injection-PoC

Claude Code: MCP Tool Confirmation Prompt Misrepresentation A professional Proof-of-Concept PoC demonstrating a critical UI/UX flaw in Anthropic's Claude Code. This vulnerability allows a malicious MCP server to mislead users into approving arbitrary command execution by misrepresenting tool...

auth

Auth - Authentication and User Management by Supabase Auth is a user management and authentication server written in Go that powers Supabase's features such as: Issuing JWTs Row Level Security with PostgREST User management Sign in with email, password, magic link, phone number Sign in with...

wesng

Windows Exploit Suggester - Next Generation WES-NG WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 11, includin...

CVE-2026-36960

CVE-2026-36960: Cross-Site Request Forgery CSRF in Web Management Interface CVE ID: CVE-2026-36960 Date: 2026-04-29 Discoverer: Kirubel Solomne Vendor: U-SPEED Product: U-SPEED Router Firmware Version: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery CSRF Description The U-SPEED Router firmware...

CVE-2025-31864

CVE-2025-31864 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Beam me up Scotty – Back to Top Button Vulnerable version = 1.0.23 Component slug beam-me-up-scotty Component link https://wordpress.org/plugins/beam-me-up-scotty/ 3️⃣ OWASP 2017: TOP 10 Vulnerability class A3:...

TCL-xss-Labs

XSS Lab — The Cyber Ledger 💸 If this project helps you, consider supporting it with a $10 donation to keep it growing. Link: https://rzp.io/rzp/zgkC6h5B An interactive, self-hosted XSS training platform with 33 progressively harder challenges — designed for hackers, pentesters, and developers who...

CVE-2025-15260

CVE-2025-15260: Missing Authorization / Broken Access Control in Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. ...

Spring4shell-CVE-2022-22965-POC

Spring4shell RCE vulnerability This vulnerability affects Spring Core and allows an attacker to send a specially crafted HTTP request to bypass protections in the library’s HTTP request parser, leading to remote code execution. More info Here In order for this vulnerability to be exploited, sever...

CVE-2026-7878-eBPF-Verifier-Type-Confusion-Kernel-Memory-Read-Write

6. CVE-2026-7878 – eBPF Verifier Type Confusion → Kernel Memory Read/Write Overview A subtle integer overflow in the eBPF verifier’s bounds tracking allows an attacker to craft an eBPF program that accesses out‑of‑bounds kernel memory. Severity: Critical Kernel Privilege Escalation User‑mode eBPF...

CVE-2021-4034

CVE-2021-4034 PoC for PwnKit: Local Privilege Escalation Vulnerability in polkit’s pkexec in Python Usage root@kitploit: git clone https://github.com/rvizx/CVE-2021-4034 cd CVE-2021-4034 python3 cve-2021-4034-poc.py Notes C : https://github.com/arthepsy/CVE-2021-4034 Fix root@kitploit: sudo chmod...

CVE-2025-34037

CVE-2025-34037 Python port of the Linksys tmUnblock.cgi RCE exploit For educational use only. Run against your own devices. Vulnerability The tmUnblock.cgi endpoint on several Linksys router models accept POST requests without validating the Authorization header. the ttcpip parameter is passed...

CVE-2026-53264

CVE-2026-53264 Description: https://vulners.com/cve/CVE-2026-53264 Donate Support the maintenance of this project with PayPal or by scanning the QR code below. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab...

CVE-2021-40449-Exploit

CVE-2021-40449-Exploit olny worker on windows 10 14393,and windows 10 17763 Use Palette to Spay and RtlSetAllBits to Write...

ropr

ropr ropr is a blazing fast multithreaded ROP Gadget finder What is a ROP Gadget? ROP Return Oriented Programming Gadgets are small snippets of a few assembly instructions typically ending in a ret instruction which already exist as executable code within each binary or library. These gadgets may...

SharpDecryptPwd

SharpDecryptPwd This project is no longer updated, the refactored source code project is as follows https://github.com/RowTeam/SharpDecryptPwd Introduction Parses passwords saved on Windows systems for some programs, including: Navicat, TeamViewer, FileZilla, WinSCP, Xmangager series products...

PoC---CVE-2018-6389

PoC - CVE-2018-6389 Proof of Concept of vunerability CVE-2018-6389 on Wordpress 4.9.2. This vulnerability lets a remote unauthenticated attacker to cause DoS of a Wordpress based web application. Presentazione: docs.google.com/presentation DoSer Python Tool root@kitploit: usage: mydoserget.py -h ...

CVE-2020-28243

CVE-2020-28243 A command injection vulnerability in SaltStack's Salt allows for privilege escalation via specially crafted process names on a minion when the master calls restartcheck. For a full writeup please see this blog post Affected Versions: All versions between 2016.3.0rc2 and 3002.2 Link...

joro

Joro A web exploitation framework for offensive security professionals. Intercepting proxy, blind vulnerability detection, web shell generation, C2 integration, and collaboration tools in a single binary with an embedded web UI. Warning: This tool is intended for authorized penetration testing an...

shellcode

shellcode “A vulnerability provides an assembly language for a computer that has never been programmed before, and that was not designed with programmability in mind.” -- Halvar Flake A collection of new and old shellcode samples. Article https://hnsecurity.it/blog/new-and-old-shellcode-samples/...

CVE_2025_68413-4

CVE202568413-4 Divulgación y PoCs para CVE-2025-68413 y CVE-2025-68414...

ipv6_frag_escape

IPV6FRAGESCAPE A reliable unprivileged container / jail escape proof of concept for CentOS / RHEL 10. It rides a now fixed IPv6 fragmentation bug in ip6appenddata closed upstream by 38becddc, no CVE, an in-slab linear overflow into the skbsharedinfo at the tail of a packet's own head object. This...

CVE-2025-34096

🐞 CVE-2025-34096: Easy File Sharing Web Server 7.2 - Stack-Based Buffer Overflow SEH SEH-based buffer overflow in Easy File Sharing Web Server 7.2, reachable through the password recovery endpoint. 📑 Table of Contents Why this repository exists Why this vulnerability is interesting Context and...

SharpFtpC2

SharpFtpC2 PoC SharpFtpC2 is a small, experimental project aimed at exploring the possibility of using FTPS for relaying commands and responses between two remote computers. It employs the FTP protocol as a makeshift tunnel through which the computers, both acting as clients connected to an FTP...

Skrull

Skrull Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted. It...

Gitea-Forgejo-CVE-2025-68937

Arbitrary template expansion vulnerability in Gitea and Forgejo This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. Summary While checking Forgejo's and Gitea's source code to better understand how templating is performed, I discovered a vulnerability...

wifipumpkin3

Wifipumpkin3 Powerful framework for rogue access point attack. Overview wifipumpkin3 is powerful framework for rogue access point attack, written in Python, that allow and offer to security researchers, red teamers and reverse engineers to mount a wireless network to conduct a man-in-the-middle...

apk.sh

🕹️ apk.sh apk.sh is a Bash script that makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding and patching an APK. Features apk.sh basically uses apktool to disassemble, decode and rebuild resources and some bash to automate the frida...