#1Tools for maintaining access, exploring, and expanding control within compromised systems and networks.
Kitploit recommended
duck-sec/cve-2023-28252-compiled-exeA modification to fortra's CVE-2023-28252 exploit, compiled to exe
ysanatomic/io_uring_lpe-cve-2023-2598LPE PoC of a vulnerability in the io_uring subsystem of the Linux Kernel.
synacktiv/ica2tcpA SOCKS proxy for Citrix.
ifpdz/cve-2025-24104Technical writeup of CVE-2025-24104: an iOS sandbox escape via symlink validation bypass in backup restoration, enabling arbitrary file reads outside…
lame-projects/stratum-c2Cloud dead-drop C2 framework — RSA-4096 + AES-256-GCM, 5 cloud providers, Rust-only agents, P2P mesh, persistence engine, credential harvesting
lukegix/cve-2022-2602CVE-2022-2602
wh04m1001/diagtrackeopWindows privilege-escalation exploit abusing SeImpersonate via DiagTrack RPC, using Secondary Logon to get an INTERACTIVE token and gain SYSTEM.
connectedlucy/plagueDefault Detections for EDR
jonaslejon/ad-autopwnAutomated Active Directory attack chain from zero-auth to Domain Admin. Chains 25+ techniques including Kerberoast, AD CS ESC1-16, Shadow…
deadjakk/reg1c1deRegistry permission scanner written in C# for finding potential privesc avenues within registry
xforcered/scmkitSource Code Management Attack Toolkit
rubenformation/cve-2025-50154POCs for CVE-2025-50154 and CVE-2025-59214, zero day vulnerabilities on windows file explorer disclosing NTLMv2-SSP without user interaction. It is a…
nmulasmajic/cve-2018-8897Implements the POP/MOV SS (CVE-2018-8897) vulnerability by bugchecking the machine (local DoS).
geekben/towelrootResearch of CVE-2014-3153 and its famous exploit towelroot on x86
jollheef/libreoffice-remote-arbitrary-file-disclosureProof of concept of LibreOffice remote arbitrary file disclosure vulnerability
rvazarkar/antipwnyA host based IDS written in C# Targetted at Metasploit
wavestone-cdt/defcon-cicd-pipelines-workshopHands-on CI/CD pipeline security workshop with Terraform lab, AWS exploitation, Kubernetes escape, and artifact backdooring exercises for offensive…
cybrly/badsuccessorExploits the Windows Server 2025 dMSA privilege escalation vulnerability to enumerate writable OUs, escalate to arbitrary domain users, extract…
