CVE-2019-11510

CVE-2019-11510 Exploit for Arbitrary File Read on Pulse Secure SSL VPN CVE-2019-11510 You can use a single domain, either a list of domains. You must include https:// in front of the domain. Usage : cat targetlist.txt | bash CVE-2019-11510.sh / bash CVE-2019-11510.sh -d https://vpn.target.com/ If...

unblob

unblob Accurate, fast, and easy-to-use extraction suite for binary blobs. unblob parses unknown binary blobs for 78+ archive, compression, and file-system formats , extracts their content recursively, and carves out unknown chunks. It is the perfect companion for extracting, analyzing, and revers...

volatility3

Volatility 3: The volatile memory extraction framework Volatility is the world's most widely used framework for extracting digital artifacts from volatile memory RAM samples. The extraction techniques are performed completely independent of the system being investigated but offer visibility into...

LPE---CVE-2020-0796

Usage: Make sure Python is installed, then run poc.py. Windows Kernel Write-What-Where CVE-2020-0796 Exploit Intended only for educational and testing in corporate environments. MasterSpl0it takes no responsibility for the code, use at your own risk. Rewritten CVE-2020-0796 Local Privilege...

Vulnerable-Docker-Engine

CVE-2021-41091 This exploit offers an in-depth look at the CVE-2021-41091 security vulnerability and provides a step-by-step guide on how to utilize the exploit script to achieve privilege escalation on a host. Vulnerability Summary CVE-2021-41091 is a flaw in Moby Docker Engine that allows...

http-protocol-exfil

http-protocol-exfil Use the HTTP protocol version to send a file bit by bit "HTTP/1.0" is a 0 and "HTTP/1.1" is a 1. It uses GET requests so the Blue Team would only see the requests to your IP address. However, it takes a long time to send bigger files, for example it needs 1 hour to send 200 KB...

proftpd-CVE-2026-42167-poc

ProFTPD Vulnerability POCs Proof-of-concept demonstrations for CVE-2026-42167, a SQL injection vulnerability in ProFTPD's modsql logging pipeline that allows an unauthenticated attacker to execute arbitrary SQL — and to inject backdoor users into the FTP authentication database or achieve remote...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...

shellcide

Shellcide x8664 shellcode IDE for Linux. You can find an online demodoes not support debugging here: Shellcide Online Demo Status This is a tool I tried to make back in around 2018, but never finished because of my lack of skills and interest in GUI development. I'm now using this as an excuse to...

CVE-2023-20198-Checker

Cisco-IOS-EX-Scanner CVE-2023-20198 CVE-2023-20198 & 0Day Implant Scanner tested in a lab and works, YMMV Quick and dirty scanner to run checks if the host is vulnerable/been compromised using 0day in Cisco IOS XE. This tool is designed to scan a given target or a list of targets to determine...

Email-Vulnerability-Checker

Email Vulnerability Checker v2.1 Verify whether the domain is vulnerable to spoofing by Email-vulnerablity-checker Features of Version 2.1 Added Support to save output on a file using -o flag Added more checks that will accurately tell you the Vulnerability Status. Updated the code completely wit...

lenovo_exec

lenovoexec CVE-2022-3699 with arbitrary kernel code execution capability original exploit: https://github.com/alfarom256/CVE-2022-3699...

ios_triage

iOS Triage Bash script to extract data from a "checkra1ned" iOS device Developed and tested on Mac OS X Mojave 10.14.6 Mandatory Requirements checkra1n https://checkra.in/ libimobiledevice https://www.libimobiledevice.org/ SSHPASS for Mac OS X https://gist.github.com/arunoda/7790979 dialog for Ma...

CVE-2023-36424

Information ============== Windows Kernel Pool clfs.sys Corruption Privilege Escalation. CVE-2023-36424 This repo contains technical analysis & working exploit. Author: Nassim Asrir @p1k4l4 || https://www.linkedin.com/in/nassim-asrir-b73a57122/ Vulnerability ================ There is a pool...

Android-Security-Teryaagh

AST - Android Security Teryaagh 🔥 Android security guides, roadmap, tools, docs, courses, write-ups and teryaagh. 📚Check out the full Documentation Website here! Auto-generated using MkDocs Buy me a coffee ☕ USDTERC20 : 0x36811c0544E09b48Fe491f67C5743a43067b280B Contents 📜 0. Roadmap Programing...

AwesomeXSS

AwesomeXSS This repository is a collection of Awesome XSS resources. Contributions are welcome and should be submitted via an issue. Awesome contents Challenges Reads & Presentations Tools Mind maps DOM XSS Payloads Polyglots Tags and event handlers Context breaking HTML context Attribute context...

CVE-2025-29927-PoC-Exploit

CVE-2025-29927-PoC-Exploit Proof-of-Concept for Authorization Bypass in Next.js Middleware You can run this against a vulnerable version here: https://github.com/lirantal/vulnerable-nextjs-14-CVE-2025-29927 Running Execution is straightforward. 1. Python3 CVE-2025-29927-PoC-Exploit.py It will...

fortilogger_arbitrary_fileupload

CVE-2021-3378 | FortiLogger - Unauthenticated Arbitrary File Upload Metasploit Date: 30-01-2021 Exploit Author: Berkan Er [email protected] Vendor Homepage: https://www.fortilogger.com/ Software Link: https://www.fortilogger.com/download Version: 4.4.2.2 Tested on: Windows 10 Enterprise x64...

CVE-2017-7529_PoC

CVE-2017-7529PoC CVE-2017-7529PoC...

ipsourcebypass

This Python script can be used to bypass IP source restrictions using HTTP headers. Features 17 HTTP headers. Multithreading. JSON export with --json outputfile.json. Auto-detecting most successful bypasses. Usage $ ./ipsourcebypass.py -h IP source bypass using HTTP headers, v1.2 usage:...

SoIG

SoIG The Instagram OSINT Tool gets a range of information from an Instagram account that you normally wouldn't be able to get from just looking at their profile. Getting Started The information includes : profile : Username, Profile Name, URL, Followers, Following, Number of Posts, Bio, Profile...

Zircolite

Standalone SIGMA-Based Detection Tool for EVTX, Auditd, Sysmon for Linux, XML, CSV, or JSONL/NDJSON Logs Zircolite is a standalone tool written in Python 3 that allows you to use SIGMA rules on: MS Windows EVTX EVTX, XML, and JSONL formats Auditd logs Sysmon for Linux EVTXtract CSV and XML logs...

ThreatMapper

ThreatMapper - Runtime Threat Management and Attack Path Enumeration for Cloud Native !NOTE This project is maintained by https://threatmapper.org Deepfence ThreatMapper hunts for threats in your production platforms, and ranks these threats based on their risk-of-exploit. It uncovers vulnerable...

next-CVE-2025-29927

CVE-2025-29927: Authorization Bypass in Next.js Middleware A critical vulnerability in Next.js CVE-2025-29927 allows unauthorized access to protected routes by bypassing the middleware logic. The issue affects Next.js versions 11.1.4 to 13.5.6, and versions 14.x 14.2.25 or 15.x 15.2.3. To mitigat...

CVE-2024-30896

CVE-2024-30896 Summary A business logic flaw in influxdb allows users who own a valid allAccess token to escalate their privileges at operator level by listing current authorization tokens. Scenario Attacker might be a user which was gained access by an administrator via an allAccess token only...

crack

crackserver XMLRPC Server & Client for hash cracking crackserver.py - server component crackclient.py - client component crack.py - same cracking functionality but performed locally instead of client / server Copyright 2011 Stephen Haywood aka AverageSecurityGuy...

cryptr

cryptr A simple shell utility for encrypting and decrypting files using OpenSSL. Installation git clone https://github.com/nodesocket/cryptr.git ln -s "$PWD"/cryptr/cryptr.bash /usr/local/bin/cryptr Requirements shred if optionally deleting original file. Bash tab completion Add...

mxmap

MXmap — municipal email infrastructure maps !IMPORTANT MXmap has a successor. This project grew into a team research effort covering all municipalities in Germany, Austria and Switzerland: secassure2026.mxmap-project.org source. The Swiss map at mxmap.ch stays online, but its data is frozen as of...

Swego

Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...

bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

airgap

airgap Security for the modern AI age. No security layer is perfect. airgap is still experimental. Contributions welcome! Protected secrets airgap launches a target program e.g. an AI coding agent inside its own mount namespace and transparently replaces secrets with redacted versions. A program...

cve-2021-44228

CVE-2021-44228 A Zeek package which raises notices, tags HTTP connections and optionally generates a log for Log4J CVE-2021-44228 attempts. Detects payload contained in HTTP headers: See Simplifying Detection of Log4Shell for details. Uses Zeek signatures to generate notices when a Java file is...

threadfire

threadfire Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application. I was 15 years old when I made this - please ignore the substandard code. About I developed this small project to continue my experiences of different code injection methods and to allow RedTeam...

Hwacha

Hwacha https://www.n00py.io/2017/12/raining-shells-on-linux-environments-with-hwacha/ Hwacha is a tool to quickly execute payloads on Nix based systems. Easily collect artifacts or execute shellcode on an entire subnet of systems for which credentials are obtained. $python hwacha.py &&&& && && &&...

AzureRedOps

AzureRedOps A Swiss Army tool for Azure / Entra ID red teaming. Author: Mr.Un1k0d3r TrueCyber Inc Version: 0.1 Language: Python 3.12+ Overview AzureRedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID and Azure tenants. It wraps the most common red-team...

aws_exposable_resources

AWS Exposable Resources The goal of this repo is to maintain a list of all AWS resources that can be publicly exposed, and eventually, those that can be shared with untrusted accounts that section is still in development and not included here yet. The following concepts are applied in this list:...

CVE-2025-2945_PgAdmin_PoC

CVE-2025-2945PoC pgAdmin Proof of Concept pgAdmin Query Tool RCE CVE-2025-2945 – Python Proof of Concept ⚠️ Disclaimer This repository contains a proof-of-concept exploit for CVE-2025-2945, a critical remote code execution vulnerability in pgAdmin 4 versions prior to 9.2. Use this code only in...

PowEnum

PowEnum Penetration testers commonly enumerate AD data – providing domain situational awareness and helping to identify soft targets. PowEnum helps automate the cartological view of your target domain. PowEnum executes common PowerSploit Powerview functions and combines the output into a...

DraculaOS

Kali Linux based OVA file for OSINT investigations and Cyber Intelligence. DOWNLOAD The download link for the DRACULA Os OVA can be found at the following link. The DraculaOs OVA download file is 8 GB in size. https://easyupload.io/o1y3jt...

ProxyLogon

ProxyLogon For Python3 ProxyLogonCVE-2021-26855+CVE-2021-27065 Exchange Server RCESSRF-GetWebShell usage: python ProxyLogon.py --host=exchange.com [email protected] python ProxyLogon.py --host=exchange.com --mails=./mails.txt args: --host: target's address. --mail: exists user's mail. --mail...

OpenPetya

OpenPetya A Proof-of-Concept bootkit and UEFI boot application inspired by Petya ransomware, written in Assembly, C, and C++ If you find this project helpful or informative, I would truly appreciate a ⭐ on the repository. Your support would be a great motivation for me to continue improving this...

fortress

One browser engine to rule them all Stealth Chromium engine · v3 Chromium 153 Fortress is a stealth Chromium engine that stops your scrapers and browser agents from getting blocked, with one line of code change. Bot detectors flag automation by reading the browser fingerprint; Fortress corrects...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 critical Remote Code Execution RCE vulnerability discovered in Apache Tomcat affect systems with HTTP PUTs enabled via setting the "read-only" initialization parameter of the Default servlet to "false" are affected. Tomcat versions before 9.0.1 Beta, 8.5.23, 8.0.47 a...

CVE-2022-26134

CVE-2022-26134 1. First run the shodan scripts to grabs all the ips python3 shodanscript.py -API yourapi -L limit -D "http.favicon.hash:-305179312 200" log.txt ex: python3 shodanscript.py -API xxxxxxx -L 10 -D "http.favicon.hash:-305179312 200" log.txt 2. For all valid ips : cat log.txt | httpx -...

WAF_buster

WAFbuster Disrupt WAF by abusing SSL/TLS Ciphers About WAFbuster This tool was created to Analyze the ciphers that are supported by the Web application firewall being used at the web server end.Reference:https://0x09al.github.io/waf/bypass/ssl/2018/07/02/web-application-firewall-bypass.html.It...

CVE-2026-23918

CVE-2026-23918 Double-free in Apache httpd modhttp2 stream cleanup leading to pre-auth RCE. Affected: httpd 2.4.66 with modhttp2 and multi-threaded MPM event/worker. Fixed in: 2.4.67. Found and reported by Bartlomiej Dmitruk striga.ai and Stanislaw Strzalkowski isec.pl. Writeup:...

creepy-plugins

creepy-plugins Description Plugins for cree.py The architecture of cree.py allows for multiple user-defined sources for geolocation information. These sources are defined as plugins and can be installed in creepy by copying them into the plugins folder under the installation directory. New plugin...

CVE-2025-68921

CVE-2025-68921 A local privilege escalation vulnerability exists in Nahimic, an audio enhancement software pre-installed on many gaming laptops. The issue allows a low-privileged user to escalate privileges to NT AUTHORITY\SYSTEM . This vulnerability was reported to Lenovo PSIRT, tracked as...

brutas

brutas Wordlists handcrafted and automated with ♥ A random passwords sample: 1qaz2wsx | panel197111 | @bcd1234 | Root!22020 1q2w3e4r5t6y | catalog841@@ | Zaq@$m,. | 1Qazxsw@222 qwerty12345 | Asdzxc129191 | testguest | User@$12@ password123 | qwerty!@12345 | Guest1120 | ?99998888? 123321! |...

KubiScan

!GitHub releaserelease-imgrelease !Licenselicense-imglicense A tool for scanning Kubernetes cluster for risky permissions in Kubernetes's Role-based access control RBAC authorization model. The tool was published as part of the "Securing Kubernetes Clusters by Eliminating Risky Permissions"...