Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
My-Exploits — Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474). | Kitploit
Tools/GitHubGitHub/m4xsec/my-exploits
Container SecurityExploit FrameworksVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCloud SecurityLearning & EducationPayload DevelopmentLabs & Practice
GitHubm4xsec/my-exploits
16h 48m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

My-Exploits

Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474).

View Repository

My-Exploits

Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of concept, and a small Docker lab that stands up only the vulnerable service so anyone can reproduce the bug without taking my word for it.

Nothing here targets a live environment. The labs are throwaway containers on your own host.

Findings

CVEComponentClassAffectedMetasploitPoCLab
CVE-2026-18963KeycloakReset-credentials sticky-selector account takeover< 26.7.2yesyesyes
CVE-2026-39816Apache NiFiTinkerpop / ExecuteGraphQuery Groovy RCE past the execute-code gate2.0.0-M1 .. 2.8.0yesyesyes
CVE-2026-5006HashiCorp VaultTemplated-policy metadata slash injection (HCSEC-2026-32)<= 2.0.3yesyesyes
CVE-2026-7474HashiCorp NomadDynamic host-volume plugin_id path traversal to root (HCSEC-2026-15)<= 2.0.0yesyes

Layout

root@kitploit:~
metasploit-custom-modules/   Metasploit modules + module docs, in the normal framework tree
exploits/                    one self-contained Python PoC per CVE
docker-lab/                  one throwaway Docker lab per CVE, spins up only the vulnerable service

Each of those three has its own README with the details. Short version:

  • metasploit-custom-modules/ drops straight into a framework checkout (or your ~/.msf4). Three modules: the Keycloak takeover, the Vault metadata slash injection, and the NiFi RCE.
  • exploits/ is four dependency-light Python scripts, one per CVE. They run against the matching lab with no edits.
  • docker-lab/ is four independent labs. Each pins the last vulnerable release, wires up whatever the bug actually needs (real OIDC for NiFi, a real Docker engine for Nomad), and nothing more. No flags, no chained scenario, just the bug.

Reproducing a finding

Pick a CVE, bring its lab up, fire the PoC. For example, Keycloak:

root@kitploit:~
cd docker-lab/keycloak-cve-2026-18963
docker compose up -d
cd ../..
python3 exploits/kc_ato_18963.py \
    --base http://127.0.0.1:8080 --realm larkspur \
    --victim j.okonkwo --newpass Chang3d-by-attacker!

The other three follow the same pattern. Read the per-lab README first, a couple of them need --build and a minute to provision.

Disclosure

All four were reported to the respective vendors and are fixed in the versions noted above. Everything published here runs against the deliberately outdated images in docker-lab/. Point it at anything you do not own and that is on you.

License

MIT. See LICENSE.

Download Tool