#1Tools for assessing, testing, and securing cloud environments (AWS, Azure, GCP) and their services.
Kitploit recommended
aaronm-sysdig/text4shell-dockerDockerized POC for CVE-2022-42889 Text4Shell
salman-sec/patch-management-Scenario-based training exercise for IT administrators: identify, approve, and deploy critical patches for financial systems under a 48-hour SLA…
resellnom/litespeed-cpanel-cve-2026-54420-fixDefensive mitigation and auditing toolkit for CVE-2026-54420 in LiteSpeed cPanel plugin, providing symlink detection, IOC hunting, and remediation…
abdurahmon3236/cve-2024-36539PoC exploit for insecure permissions in Contour v1.28.3 that retrieves a Kubernetes service account token and accesses the cluster API, demonstrating…
0xmrma/cve-2026-34048Admin-only terminal bootstrap routes checked only for login state, which let a normal team member drive Coolify's realtime terminal backend and…
mokokash/ejbca-pqc-labPure PQC two-tier PKI hierarchy using ML-DSA-65 (NIST FIPS 204) on EJBCA Community Edition — Root CA + Sub CA with CRL and OCSP
yym8538/cve-2026-20896Proof-of-concept lab and Python/cURL scripts demonstrating CVE-2026-20896, an authentication bypass in official Gitea Docker images via the…
poxsky/cve-2026-24516-digitalocean-rce.Technical analysis and PoC for CVE-2026-24516: Unauthenticated Root Remote Code Execution in DigitalOcean Droplet Agent (CVSS 10.0).
zavisco/cve-2026-64849.yamlDetects unauthenticated MLflow webhook SSRF (CVE-2026-64849) that accesses internal or cloud metadata services and leaks response details via…
hackerhouse-opensource/cve-2018-10933Docker-based CVE-2018-10933 libssh authentication bypass exploit with patched client for testing SSH server vulnerabilities and unauthorized access…
vectra-ai-research/derfCloud-based attack emulation framework for executing offensive techniques and generating repeatable detection samples across AWS and GCP via a UI or…
raesene/cve-2022-23648-pocPOC for CVE-2022-23648
sixpacksecurity/cve-2021-40438CVE-2021-40438 exploit PoC with Docker setup.
hmlio/vaas-cve-2014-0160Vulnerability as a service: showcasing CVS-2014-0160, a.k.a. Heartbleed
kingofbugbounty/nuclearpond-ofjaaahNuclear Pond is a utility leveraging Nuclei to perform internet wide scans for the cost of a cup of coffee.
gobysec/cve-2023-28432Exploit for CVE-2023-28432, a sensitive information disclosure vulnerability in MinIO's verify interface, allowing attackers to read system…
obscuritylabs/log4shell-poc-labA lab demonstration of the log4shell vulnerability: CVE-2021-44228
zwxxb/cve-2025-1974Poc for Ingress RCE
