#1Cybersecurity research, materials, labs, and learning paths, including CTFs and curated educational resources.
Kitploit recommended
endrazine/rocq-cve-poc-22287CVE-2026-72714 — Rocq Universe Checking State Desynchronised After Module Close
endrazine/rocq-cve-poc-21683CVE-2026-72705 — Rocq Guard Checker Accepts Fixpoint Passed as Higher-Order Argument
endrazine/rocq-cve-poc-22024CVE-2026-72704 — Rocq Guard Checker Trusts Corrupted Recursive Tree After Transport
endrazine/lean-cve-poc-14484CVE-2026-72711 — Lean 4 Kernel Soundness Bug: Inference Cache Poisoning
adam-atlassoftware/krakenReverse-engineering workbench built on Ghidra's decompiler with a native Java-free engine, AI-assisted function analysis, byte patching, sandboxed…
neitzert/picardProtocol-Introspecting Chunk Adapter for Resilient Data
ardakocadoru/xss-cheatsheetComprehensive XSS reference covering reflected, stored, DOM and blind payloads, filter bypass, WAF evasion, CSP bypass, mXSS, and real-world CVE case…
owasp/agentic-evidenceOWASP reference project for agentic AI security evidence: correlates agent execution, identity, tool calls, and authorization decisions into…
owasp/robotics-security-testing-guideOWASP guide defining a standardized penetration testing methodology for humanoid, industrial, and autonomous robots, covering ROS/ROS2, DDS, CAN bus,…
owasp/the-agents-epistemic-baggageAn audit-oriented risk model for how agent-generated inferences can change epistemic status, gain operational authority, and influence later…
abraxas/php-oom-longjmpPHP 8.4.26 - Critical - Remote - OOM longjmp - CVE-2026-109618 PHP2Shell. Unauth chunked multipart hits memory_limit before app code on Apache…
abraxas/php-stale-global-uafPHP 8.5.11 - Critical - Remote - UAF - CVE-2026-109619 PHP2Shell. Same-worker fatal backtrace then INI diagnostic on Apache mod_php. Lab vs 8.5.12.…
k0keoyo/ssctf-pwn450-ms16-034-writeupWriteup of an SSCTF pwn450 challenge covering Windows kernel exploitation of MS16-034, including vulnerability analysis and privilege escalation…
eqstlab/cve-2026-109619Proof-of-concept exploit for PHP session.upload_progress pre-auth RCE (PHP2Shell), with heap/ASLR leak, per-build offset profiles, and an all-in-one…
gmh5225/obs-graphics-hook32-hookDemonstrates hooking OBS graphics-hook32.dll's D3D9 Present pointer to achieve stream-proof rendering that evades anti-cheat game capture detection.
mrhackercharlie/netspecterReal-time system monitoring tool for detecting process activity and network exposure!
odomojuli/regextokenslist of regex patterns for oauth / api tokens with provided source
asngs/agenttriage-open-sourceCross-agent tracing and security-diagnosis system for tool-using LLM agents: normalizes trace events, builds provenance graphs, extracts…
