XXERipper
kamalx06/xxeripperBlack-box XXE scanner detecting in-band, error-based, and blind out-of-band injection via statistical baselining, parser fingerprinting, and OOB…
api-security-testingdata-exfiltrationexploitation+9
10
kamalx06/xxeripperBlack-box XXE scanner detecting in-band, error-based, and blind out-of-band injection via statistical baselining, parser fingerprinting, and OOB…
ivancabrera02/srhollowExtracts LSA secrets and DPAPI keys from Windows registry hives via existing or newly created VSS shadow copies, with an inline regf parser and…
christophe.duvernois/usb-spyIntercepts and analyzes USB Mass Storage traffic at the block and file level, emulates USB devices, and supports custom Python stubs for security…
byt3bl33d3r/pymalleablec2Python interpreter for Cobalt Strike Malleable C2 Profiles. Allows you to parse, build and modify them programmatically.
24520597-blip/cve-2026-999999A critical Server-Side Template Injection (SSTI) vulnerability exists in the X-Trading Portal v1.4.2 dashboard metadata rendering engine. The flaw…
w4r10ck423/envvisualizerParse and visualize /proc/self/environ on compromised Linux boxes — categorizes env vars by tech stack (AWS, Django, Rails, NodeJS, MySQL, K8s,…
rnb-team/loghoundPost-Exploitation EVTX Analyzer for BloodHound Mapping
frkngksl/silentnimvestNim implementation for sud0Ru's Credential Dumping from SAM/SECURITY Hives Method (a.k.a. SilentHarvest)
thoxy67/zig-peReflective PE loader written in Zig. Loads and executes native and .NET PE files directly from memory.
biitts/roundcube-cve-2025-49113Proof-of-concept to CVE-2025-49113
ricardojoserf/whoamialternativesDifferent methods to get current username without using whoami
r0xdb/cve-2024-23897Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a…
h4x0r-dz/cve-2024-23897Python exploit for Jenkins CVE-2024-23897: arbitrary file read via CLI args4j parsing, enabling RCE. Scans hosts and extracts sensitive files from…
vmtyan/poc-cve-2024-23897Proof-of-concept exploit for CVE-2024-23897 enabling remote code execution on Jenkins instances via vulnerable args4j command-line parser. Written in…
laokoon-security/cortex-xdr-config-extractorParses Cortex XDR agent database lock files to extract agent settings, uninstall password hash/salt, and security exclusions for red team assessments…
sec-consult/aggrokatzAggrokatz is an aggressor plugin extension for Cobalt Strike which enables pypykatz to interface with the beacons remotely and allows it to parse…
tylous/sniffairA framework for wireless pentesting.
awesome-pentest-gadgets/skyliftWiFi Geolocation Spoofing with the ESP8266