Tools

0xdea/tactical-exploitation

Offensive pentest toolkit combining OSINT, information gathering, SMB brute force, and Metasploit-compatible Meterpreter stagers for Windows/AD…

gquere/pwn_jenkins

Exploit Jenkins instances via CVE-specific PoCs: RCE through Groovy scripts and deserialization, dump builds for cleartext secrets, password…

mohammad-008/rsfiles-cve-2026-57827

Unauthenticated File Upload → RCE PoC for CVE-2026-57827 (RSFiles! Joomla < 1.17.12). Authorized security research use only.

3gstudent/homework-of-python

Collection of Python scripts for vulnerability exploitation, credential attacks, and post-exploitation on web applications, Exchange, vCenter, and…

al1ex/pentest-tools

Collection of PowerShell-based tools for intranet penetration testing, including reconnaissance, lateral movement, privilege escalation, and…

yucaerin/cve-2026-3584

Automated mass scanner for CVE-2026-3584, an unauthenticated RCE in WordPress Kali Forms. Executes a 4-phase pipeline: REST API enumeration, form…

shinthink/cve-2026-57827

Proof-of-concept exploit for CVE-2026-57827: unauthenticated file upload RCE in RSFiles! Joomla component. Includes mass scanning and automated shell…

imbas007/cve-2026-42533

Exploit for nginx heap buffer overflow (CVE-2026-42533) providing pre-auth RCE via two-pass capture clobbering. Includes info leak, heap spray, and…

ntkernel0/cve-2019-0708

Collection of proof-of-concept exploits and payloads for CVE-2019-0708 (BlueKeep) vulnerability, targeting RDP remote code execution for penetration…

lintstar/lstar

Comprehensive CobaltStrike post-exploitation plugin integrating modules for privilege escalation, lateral movement, credential dumping, persistence,…

cerberusmrxi/flowise-cve-2026-58057-exploit

Exploit for CVE-2026-58057 targeting Flowise Windows RCE via case-sensitive environment variable validation bypass. Supports reverse shell,…

melardev/xeytanwxcpp-rat

Work in Progress. RAT written in C++ using wxWidgets

xaitax/cve-2024-21413-microsoft-outlook-remote-code-execution-vulnerability

Proof-of-concept exploit for CVE-2024-21413 (MonikerLink) enabling remote code execution and NTLM credential leakage via crafted email links,…

zephrfish/wp2shell-scanner

Non-destructive WordPress exposure scanner and authorized PoC exploit tool for CVE-2026-63030/CVE-2026-60137. Features version fingerprinting, blind…

shinthink/solrradar

☄️ Mass reconnaissance & exploitation framework for Apache Solr CVE-2026-44825 — Velocity template injection to RCE

whattheslime/file-away-exploit

Remote code execution exploit scripts for the WordPress File-Away plugin (CVE-2025-2512 & CVE-2025-2539)

r0otk3r/cve-2024-25600

Python-based exploit for CVE-2024-25600 targeting Bricks Builder WordPress plugin RCE. Automates nonce extraction, payload injection, and arbitrary…