45867 matches found
haruspex
haruspex "Hacking is the discipline of questioning all your assumptions all of the time." -- Dave Aitel Haruspex is a blazing-fast IDA headless plugin that extracts pseudocode generated by IDA's decompiler in a format that should be suitable to be imported into an IDE, or parsed by static analysi...
udpx
Fast and lightweight, UDPX is a single-packet UDP scanner written in Go that supports the discovery of over 45 services with the ability to add custom ones. It is easy to use and portable, and can be run on Linux, Mac OS, and Windows. Unlike internet-wide scanners like zgrab2 and zmap, UDPX is...
crime-mapper
Enabling cyber investigations from a browser A prototype tool for mapping cyber crime Created by @UKDanielCard The experimental version is the live, bleeeding edge version Live Demo is largely where I'm storing a relatively stable version... but this is all DEV! IF YOU WANT TO REALLY TEST THIS,...
CVE-2018-19131
CVE-2018-19131 Demo Author: Jonathan M. Wilbur Copyright Year: 2018 License: MIT License Do not do anything illegal with this. This is not malware. This is just a proof of concept. This is a demo of CVE-2018-19131, which runs in a Docker Compose app. This library builds Squid version 3.5.27, whic...
CVE-2021-40449
CVE-2021-40449 My exploit for CVE-2021-40449, a Windows LPE via a UAF in win32kfull!GreResetDCInternal. short wu along with the UAF vulnerabilty other primitives are being used to make this exploit possible: leaking the exploit's access token address in ring0 via NtQuerySystemInformation function...
linux_mint_poc
Linux Mint 18.3-19.1 'yelp' command injection bug Root cause The URI handlers help://, ghelp://, and man:// are defined in the file /usr/share/applications/yelp.desktop which will execute /usr/local/bin/yelp via Exec=yelp %u whenever one of those URI handlers is invoked. The file...
s3enum
s3enum s3enum is a fast and stealthy Amazon S3 bucket enumeration tool. It leverages DNS instead of HTTP, which means that requests are not logged in S3 server access logs. It was originally built back in 2016 to target GitHub. Installation go install github.com/koenrh/s3enum@latest Usage You nee...
SpoolFool
SpoolFool Exploit for CVE-2022-21999 - Windows Print Spooler Elevation of Privilege Vulnerability LPE Details The provided exploit should work by default on all Windows desktop versions. Please see the blog post for full technical details here. Usage PS C:\SpoolFool .\SpoolFool.exe SpoolFool By...
misp-galaxy
misp-galaxy MISP galaxy is a simple method to express a large object called cluster that can be attached to MISP events or attributes. A cluster can be composed of one or more elements. Elements are expressed as key-values. There are default knowledge base such as Threat Actors, Tools, Ransomware...
CVE-2021-21551
Exploit CVE-2021-21551 for LPE by creating System cmd Tested on Windows 11 21H2 22000.1335...
CVE-2025-29927
CVE-2025-29927 Next.Js permission bypass vulnerability CVE-2025-29927 More PoCs at https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X path default /, multi-thread default 10 Batch detection: python poc.py -f url.txt -p /path -t 10 Single detection: python poc.py -u your-ip -p /path -t 10...
trellix-tarslip-patch-bypass
trellix-tarslip-patch-bypass In 2023, Trellix announced 1 that they patched +61,000 open-source projects for CVE-2007-4559, an old path traversal vulnerability. Analyzing their patch, it's easy to notice that it can be bypassed using a symlink. Symlink path traversal is an old technique, and it h...
pyc2
pyc2 simple c2 written in python2 to demonstrate security concepts. use icmp echo requests and replies to trade base64 encoded commands and replies. Video explaining some of the security concepts and implementation decisions: https://www.youtube.com/watch?v=DHrEn7oK9vQ requires scapy pip install...
CVE-2021-33831
Introduction The application is used for tracking people according to German infection laws to be able to trace Covid-19 infection chains. It was created by a student project called iCampus and is used not only at the university in Wildau but also at Cottbus-Senftenberg. Around 10.000 people are...
log4j2-prosecutor
log4j2-prosecutor Motivation This fundamental vulnerability was reported by CVE-2018-3149 and patched by this article. 8u121 Release Notes However, the logging library for java called log4j2 had JNDILookupCVE-2021-44228, which allowed access to protocols such as LDAP, which allowed code injection...
eval-stdin
Util PHP eval-stdin.php CVE-2017-9841 vulnerability is RCE vulnerability in outdated eval-stdin.php. This exploit is just automation for mentioned vulnerability and is still in development. Scripted in Ruby 3.0.4 within 2 hours, tested on Kali linux, Arch Linux, Ubuntu minimal and Termux. How to...
owasp-java-encoder
OWASP Java Encoder Contextual output encoding for Java 8+. Choose an encoder for the parser context receiving untrusted text: HTML, JavaScript, CSS, XML or a URL component. The core has no runtime dependencies; optional JSP and Jakarta adapters provide view-layer bindings. Encoding is one part of...
CVE-2014-6271
CVE-2014-6271 Shellshock Vulnerability Scanner...
mapcidr
A utility program to perform multiple operations for a given subnet/CIDR range. Features β’ Install β’ Usage β’ Library β’ Join Discord mapCIDR is developed to ease load distribution for mass scanning operations; it can be used both as a library and as an independent CLI tool. Features CIDR expansion...
secator
The pentester's swiss knife. Features β’ Supported commands β’ Installation β’ Usage β’ Documentation β’ Join us on Discord ! secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and it is designed to improve productivity for pentesters a...
awesome-list
Awesome Cybersecurity List My personal collection of awesome blog posts, write-ups, and papers focusing on cybersecurity. For a deeper dive into cybersecurity-related tools, check out the dedicated Cybersecurity Tools list. Outline 2026 2025 2024 2023 2022 2021 2020 2019 2018 2017 2016 2014 2011...
Fix-WinVerifyTrustSignatureValidationVuln
Fix-WinVerifyTrustSignatureValidationVuln Fix WinVerifyTrust Signature Validation Vulnerability, CVE-2013-39001, QID-3783322 This Fix is intended for 64-bit Windows Computers This PowerShell code is one way to fix the vulnerability - aside from creating a .reg file and using reg import to import...
CVE-2021-38602
CVE-2021-38602 A stored cross site scripting vulnerability is present on the Article editing page in version 5.8.7 of PluXML. User input is not properly sanitized in multiple fields. Vulnerable Fields: Headline optional: Content: Once inserted, XSS can be triggered by visiting the posted article ...
CVE-2024-54383
CVE-2024-54383 CVE-2024-54383, https://vulners.com/cve/CVE-2024-54383...
redis-stack-CVE-2024-55656
CVE-2024-55656 - Redis Stack - RedisBloom Integer Overflow Remote Code Execution Vulnerability Title: Redis Stack RedisBloom Integer Overflow Remote Code Execution Vulnerability ZDI: ZDI-25-009 CVE: CVE-2024-55656 Credits: rick2600 and gqsilva CVSS: 8.8 HIGH Affected version: RedisBloom v2.6.12...
CVE-2024-41290
CVE-2024-41290 FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data Additional Information: FlatPress CMS version 1.3.1 insecurely stores authentication-related data, including usernames and hashed passwords, directly in client-side cookies. This practice...
lpe-toolkit
Linux LPE Toolkit Multi-architecture privilege escalation toolkit with 24 exploits amd64 pre-built; other architectures compiled via gcc at runtime. Supports amd64, arm64, 386, mips, mipsle, mips64, and mips64le. Detects kernel version, filters patched exploits, and tries each in order until root...
Zapscape
The KVM Escape Trilogy ITScape CVEβ2026β46316 | Januscape CVEβ2026β53359 | Zapscape CVEβ2026β64561 ---|---|--- Zapscape: Guest-to-Host Escape in KVM/x86 Abstract This document describes the Zapscape CVE-2026-64561 vulnerability discovered and reported by Hyunwoo Kim @v4bel. It is a KVM escape...
CVE-2020-0688
Exploit and detect tools for CVE-2020-0688Microsoft Exchange default MachineKeySection deserialize vulnerability build csc ExchangeCmd.cs csc ExchangeDetect.cs usage ExchangeDetect ExchangeCmd sub commands: exec args exec command arch get remote process architecturefor shellcode shellcode run...
StackRot
StackRot CVE-2023-3269: Linux kernel privilege escalation vulnerability GitHub-CI-verified exploit A flaw was found in the handling of stack expansion in the Linux kernel 6.1 through 6.4, aka "Stack Rot". The maple tree, responsible for managing virtual memory areas, can undergo node replacement...
Cybersecurity-Mastery-Roadmap
π‘οΈ Ultimate Cybersecurity Mastery Roadmap A comprehensive, step-by-step guide to mastering cybersecurity from beginner to expert level with curated resources, tools, and career guidance π Table of Contents Introduction How to Use This Roadmap Roadmap Overview Foundation Phase Technical Skills Phas...
faraday
Open Source Vulnerability Manager Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your termin...
CVE-2024-29973
CVE-2024-29973 - Remote Command Injection Vulnerability Description CVE-2024-29973 is a critical vulnerability found in certain Zyxel networking devices. This vulnerability allows an unauthenticated attacker to execute arbitrary commands on the target device by exploiting improper input validatio...
CVE-2020-3452
CVE-2020-3452 CVSS 7.5 base wget https://bit.ly/32Q065t wget https://vpn.target.local:443/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portalinc.lua&default-language&lang=../ wget...
AirmonGUI
AirmonGUI A local web interface for the aircrack-ng wireless toolkit. Screenshots Β· Quick start Β· Features Β· Roadmap Β· Contributing !WARNING Use this only on networks you own or have written permission to test. Scanning, deauthenticating, or capturing traffic from networks you don't control is...
powershell-reverse-tcp
PowerShell Reverse TCP PowerShell scripts for communicating with a remote host. Remote host will have a full control over the client and all the underlying system commands. Check shells based on: Invoke-Expression PowerShell command here, process pipes here. Tested with PowerShell v5.1.19041.2673...
frinet
Frinet By combining Frida with an enhanced version of Tenet, Frinet facilitates the study of large programs, vulnerability research and root-cause analysis on iOS, Android, Linux, Windows, and most architectures. Blogpost on the Synacktiv website This version is a complete rewrite of...
phantun
Phantun A lightweight and fast UDP to TCP obfuscator. Table of Contents Phantun Latest release Overview Usage 1. Enable Kernel IP forwarding 2. Add required firewall rules Client Using nftables Using iptables Server Using nftables Using iptables 3. Run Phantun binaries as non-root Optional 4...
CVE-2020-10131
CVE-2020-10131 - CVE-2020-10131 - SearchBlox Product before V-9.2.1 is Vulnerable to CSV macro injection. Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure encryption, and low total...
curveball-plus
curveball-plus simulation experiment of Curveball CVE-2020-0601 attacks under ECQV implicit certificates with Windows-like verifiers This file is constantly updated!...
CVE-2017-5123
CVE-2017-5123 Linux privilege escalation exploiting waitid syscall. The exploit is brought to you by @XeR0x2A and @chaignc from HexpressoTeam for educational purposes only. The bug was introduced the 2017-05-21 and fixed 2017-10-09, 4.14.0-rc4+ is known vulnerable. asciicast If you have a...
CVE-2022-46087
CVE-2022-46087 CloudSchool v3.0.1 is vulnerable to Cross Site Scripting XSS. A normal user can steal session cookies of the admin users through notification received by the admin user. Reffer to: https://github.com/G37SYS73M/AdvisoryG37SYS73M/blob/main/CVE-2022-46087/poc.md...
CAPE-parsers
CAPE-parsers CAPE core and community parsers Configs structure CNCs: campaign: str botnet: str dgaseed: hex str version: str mutex: str useragent: str build: str cryptokey: str cryptokeytype: str algorithm. Ex: RC4, RSA public key. salsa20, xchacha20 raw: any other data goes here All CNC entries...
CVE-2026-48908-by-yora
π CVE-2026-48908 Scanner & Safe PoC Joomla SP Page Builder β Unauthenticated File Upload / Potential RCE Developed byyora π About This project is a security research and vulnerability detection tool developed by yora to help identify CVE-2026-48908 affecting SP Page Builder for Joomla. The...
CVE-2020-9484
CVE-2020-9484 Reproduce Apache Tomcat Session Deserialization Code Execution Vulnerability CVE-2020-9484 with Kali 2.0 Environment: 1. Kali 2.0 2. apache-tomcat-7.0.61-CVE-2020-9484.tar.gz webapp is s2-053, added commons-collections4-4.0.jar under its lib Start /yourtomcatdir/bin/startup.sh...
zynos-attacker
IMPORTANT : These scripts are intended for educational purposes only. Description : With these scripts you can attack ZynOS routers and modify/extract anything you want on the target router from extracting ISP username and password to injecting rogue DNS servers IPs...
witcher
witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ docker build ...
CVE-2019-16278-PoC
CVE-2019-16728-PoC CVE-2019-16728 Reference https://git.sp0re.sh/sp0re/Nhttpd-exploits/src/branch/master/CVE-2019-16278.sh...
SharpSCOM
SharpSCOM A C tool for interacting with Microsoft System Center Operations Manager SCOM. This tool has been tested against SCOM Server version 10.22.10118.0. SSPI integration is provided via the nsspi library from Kevin Thompson antiduh released under the BSD-2 license. Command Line Usage ββ β β...
interactsh
An OOB interaction gathering server and client library Features β’ Usage β’ Interactsh Client β’ Interactsh Server β’ Interactsh Integration β’ Join Discord Interactsh is an open-source tool for detecting out-of-band interactions. It is a tool designed to detect vulnerabilities that cause external...