#1Tools for testing and securing Internet of Things (IoT) devices, protocols, and platforms.
Kitploit recommended
wilfred-wulbou/hg532d-rce-exploitA Remote Code Execution (RCE) exploit for Huawei HG532d based on CVE-2017-17215 vulnerability. Modded from original PoC code from exploit-db.com
florentineprinzessinzusachsen/badbox-h713-projectorAnalysis and cleanup guide for BadBox malware on Allwinner H713 Android projectors: ADB access, infection proof, firmware backup, dropper removal,…
xw77cve/cve-2019-7642Proof-of-concept exploit for CVE-2019-7642 demonstrating unauthenticated access to DNS query logs and login history on vulnerable D-Link routers via…
gh-ost00/cve-2024-7120Proof-of-concept exploit for CVE-2024-7120 command injection vulnerability in RAISECOM gateway devices. Provides exploitation details, affected…
hanianis/cve-2025-63353A vulnerability in fiberhome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password (WPA/WPA2 pre-shared key) to be predicted…
misakamikato/cve-2017-7921-golangHikvision IP camera access bypass exploit, developed by golang.
olivierlaflamme/unibleedUnitree G1 RCE PoC & Scripts (CVE-2026-76639 / CVE-2026-76640) technical details at boschko.ca/g1-ble-rce/
h3xdum/xiaomi-c200-firmware-analysisFrom UART to Root: Breaking Into the Xiaomi C200 via U-Boot
0xkol/ripple20-digi-connect-exploitRCE exploit for CVE-2020-11896 (Ripple20 IP-in-IP Heap Overflow Vulnerability) targeting Digi Connect ME 9210
zzz66686/cve-2017-14262Exploit for CVE-2017-14262 targeting Samsung NVR devices: extracts admin MD5 password hash via unauthenticated CGI request and logs in with the hash…
v0lp3/cve-2022-39066Proof of concept of the SQL injection vulnerability affecting the ZTE MF286R router.
keowu/sjcamReverse engineering research and custom firmware for Allwinner V3-based IoT cameras, including firmware parsers, an AVIOCTRL client, and a…
dest-3/cve-2023-46012LINKSYS AC1900 EA7500v3 IGD UPnP Stack Buffer Overflow Remote Code Execution Vulnerability
0xnslabs/cve-2022-36267-pocPoC Script for CVE-2022-36267: Exploits an unauthenticated remote command injection vulnerability in Airspan AirSpot 5410 antenna.
bishopfox/shining-maskBLE-based tool that automatically discovers and exploits Shining LED Masks by uploading a custom image without user interaction, proving security…
dreadlocked/netwave-dosvulnerability[CVE-2018-6479] Netwave IP Camera server vulnerable to Denial of Service via one single huge POST request.
dylvie/cve-2024-9570_d-link-dir-619l-bofRemote buffer overflow exploit for D-Link DIR-619L router (CVE-2024-9570) targeting the formEasySetTimezone function for penetration testing and…
