Tools

halildeniz/trafficwatch

PCAP-based packet sniffer and analyzer supporting ARP, ICMP, TCP, UDP, DNS, DHCP, HTTP, SNMP, LLMNR, and NetBIOS protocol inspection with filtering…

audiopump/cve-2025-66723

CVE-2025-66723: inMusic Brands Engine DJ >=3.0.0 through <4.3.4 exposes local and network files to external parties

p0dalirius/dumpsmbshare

A python script to dump files and folders remotely from a Windows SMB share.

smarttfoxx/cve-2025-65321

Language Sloth Sloth Bot 1.0 is vulnerable to Directory Traversal in the gif() and png() functions. The functions build file paths using unsanitized…

george0papasotiriou/cve-2026-21015-php-filter-chain-arbitrary-file-read

PoC exploit for CVE-2026-21015 that abuses PHP filter chains to read arbitrary files through a vulnerable include() call, disclosing source and…

0xterror/cve-2023-22047-oracle-peoplesoft-lfi

CVE-2023-22047 is a critical unauthenticated Local File Inclusion (LFI) vulnerability in Oracle PeopleSoft Enterprise PeopleTools. This exploit…

m57/dnsteal

DNS Exfiltration tool for stealthily sending files over DNS requests.

badsectorlabs/sccm-http-looter

Find interesting files stored on (System Center) Configuration Manager (SCCM/CM) shares via HTTP(s)

1d8/spybrowse

Code developed to steal certain browser config files (history, preferences, etc)

acceis/leakscraper

LeakScraper is an efficient set of tools to process and visualize huge text files containing credentials. Theses tools are designed to help…

jfriedli/cve-2025-12137

Proof-of-concept exploit for CVE-2025-12137 demonstrating local file disclosure via a WordPress plugin's REST API importer endpoint. Includes…

ustayready/golddigger

Recursively searches files for sensitive information using customizable regex patterns, designed for penetration testers to rapidly discover secrets…

thestingr/cve-2024-36991-tool

This binary POC automates the exploitation of CVE-2024-36991 by sending crafted curl requests to a vulnerable Splunk instance. It retrieves sensitive…

brittonhayes/pillager

Pillage filesystems for sensitive information with Go 🔍

seifelsallamy/xssfire

A standalone Blind XSS Script.

viralmaniar/ddwpasterecon

DDWPasteRecon tool will help you identify code leak, sensitive files, plaintext passwords, password hashes. It also allow member of SOC & Blue Team…

graysignal/cve-2024-23897-jenkins-arbitrary-read-file-vulnerability

Unauthenticated Jenkins CLI exploit scanner for CVE-2024-23897 that detects vulnerable versions and reads arbitrary files from the controller through…

abdulazizalsewedy/cve-2021-29447

Step-by-step demonstration of CVE-2021-29447, a WordPress Media Library XXE vulnerability leaking sensitive files via crafted WAVE uploads, including…