
CVE-2026-55040
Proof-of-concept exploit for Microsoft SharePoint CVE-2026-55040 that forges JWT tokens, bypasses authentication, auto-discovers metadata, and…

Proof-of-concept exploit for Microsoft SharePoint CVE-2026-55040 that forges JWT tokens, bypasses authentication, auto-discovers metadata, and…

Automated phishing toolkit with pre-built login page templates and multiple port forwarding options (Ngrok, Serveo) for credential harvesting and…

An automated phishing tool with 30+ templates. This Tool is made for educational purpose only ! Author will not be responsible for any misuse of this…

HTML/CSS/JS templates for Browser-In-The-Browser phishing attacks, embedding fake login windows with customizable titles, domains, and phishing links…

Phishing framework with Flask backend that clones login pages and captures credentials along with 2FA tokens, featuring SSL support and an API for…

Emulates a Cisco ASA Anyconnect VPN service for credential harvesting and VBS payload delivery in red team phishing operations.

Relays NegoEx/PKU2U Kerberos authentication to arbitrary targets, enabling credentialless authentication, command execution, SMB hash dumping, and…

Automated social engineering toolkit for phishing credential capture, email spoofing, and OTP/SMS flooding attacks. Designed for penetration testing…

real time face swap and one-click video deepfake with only a single image

Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor…

Rogue Access Point framework for red team engagements and Wi-Fi security testing. Performs Evil Twin, KARMA, and Known Beacons attacks to achieve…

Simulate realistic phishing campaigns with credential harvesting, email tracking, and landing page cloning for security awareness training and…

Automated social-engineering bot that uses Twilio and Discord to call targets, impersonate brands, and capture SMS verification codes to bypass OTP…

Disables Windows Defender by creating a token with TrustedInstaller and Windefend service accounts; designed for one-click use in post-exploitation…

Automates vishing calls via Discord bot and API to intercept SMS one-time passwords, bypassing SMS verification for PayPal, Google, Instagram, and 3D…

PowerShell scripts to dump Kerberos tickets from LSA cache and inject stolen .kirbi or base64 tickets to impersonate users and move laterally across…

Advanced phishing tool combining OAuth Device Code authentication flow with QR codes to harvest Microsoft authentication tokens via MFA update…

Windows token impersonation tool to list tokens, execute commands as impersonated users, and add domain admin users during Active Directory pentests.