Tools

nxploited/cve-2026-77647

SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code

kostas-pa/lfitester

Python3 tool that detects and exploits Local File Inclusion vulnerabilities, with crawling, path traversal and filter bypass payloads, and automated…

codingranjith/hackingtoolkit

ALL IN ONE Hacking Tool For Hackers, Penetration Tester and Cybersecurity. New Version Beginner to Advanced Tool. This Tool is made for educational…

gmh5225/packer-payload-entropyreducer

Reduce Entropy And Obfuscate Youre Payload With Serialized Linked Lists

audrise/javaflood

Python multithreaded DoS tool that floods Minecraft Java servers with forged handshake packets, connection reuse, payload padding, and protocol…

baguette168/nmg

Generates parameterized .NET memory-shell payloads (VPP, MVC route, HttpListener) compatible with Godzilla, Behinder, and AntSword clients for red…

eballoon/common-registry

Proof-of-concept C code demonstrating registry-based communication, PFN clearing, and custom process attachment techniques for stealthy payload…

ricardojoserf/emqx-rce

EMQX Dashboard Malicious Plugin leading to RCE

lotus6/confluencememshell

Confluence CVE 2021，2022，2023 利用工具，支持命令执行，哥斯拉，冰蝎 内存马注入

whispergate/signet

Mythic C2 payload wrapper that applies Authenticode signatures to agent binaries using osslsigncode, with self-signed CA generation, PFX upload, and…

a-d-team/sharpmemshell

.NET in-memory webshell (memshell) payloads implemented via HttpListener and VirtualPath, compatible with the Godzilla 4.01 post-exploitation…

ghxstsec/php2shell-poc

Python exploit for CVE-2026-109618: abuses PHP session.upload_progress heap corruption to overwrite zend_call_function and achieve remote command…

prepouce/coercedpotato

Windows local privilege escalation tool that abuses SeImpersonatePrivilege via MS-RPRN and MS-EFSR RPC coercion to execute commands as SYSTEM.

code-zm/plex2shell

CVE-2026-96652 CVE-2026-96654 CVE-2026-96655 CVE-2026-96656

hexbytee/freepbx-sqli-rce

Python proof-of-concept exploiting CVE-2025-57819, an unauthenticated SQL injection in FreePBX that chains admin creation, cron webshell deployment,…

affolter-engineering/xssearch

Rust-based XSS scanner with context-aware payload selection, WAF detection and bypass, crawling, blind XSS callbacks, and static DOM sink analysis.

ripits-sec/couchpotato

Windows privilege escalation tool that patches ETW and AMSI and uses indirect syscalls to abuse SeImpersonatePrivilege, escalating service accounts…