Tools

dxc-strikeforce/burp-log4j-hammertime

Burp Active Scan extension to identify Log4j vulnerabilities CVE-2021-44228 and CVE-2021-45046

vulnbe/burpsuite-copy-as-xmlhttprequest

BurpSuite extension that converts HTTP requests into JavaScript XMLHttpRequest code for streamlined XSS proof-of-concept generation and web…

portswigger/http-request-smuggler

Burp Suite extension for automated detection and exploitation of HTTP request smuggling vulnerabilities, supporting HTTP/1.1 and HTTP/2-downgrade…

bytev0rtex/cve-2026-64788

Proof-of-concept for CVE-2026-64788, a use-after-free in IOGPUFamily kernel extension on iOS 26.6, demonstrating exploitation via Metal texture…

jackadamson/cve-2021-26700

Proof-of-concept for CVE-2021-26700: remote code execution in the VSCode npm-script extension via malicious workspace settings.json, with detailed…

sektioneins/suidguard

SUIDGuard - a TrustedBSD Kernel Extension that adds mitigations to protect SUID/SGID processes a bit more

stvm8/cve-2026-2005_lab

Self-contained Docker lab for practicing exploitation of CVE-2026-2005, a heap buffer overflow in PostgreSQL's pgcrypto extension, enabling privilege…

cerberusmrxi/wp-contest-gallery-28.1.4-exploit

Complete exploitation toolkit for CVE-2026-3180 - WordPress Contest Gallery SQL Injection vulnerability. Features automated data extraction, WAF…

crynomore/cve-2024-34102

Burp Suite extension for detecting and testing CVE-2024-34102, a critical web vulnerability, enabling automated security assessment and exploitation…

hoodoer/js-tap

JavaScript beacons and C2 to be used for XSS payload or post exploitation implants on webapp servers or desktop software to monitor users and…

mrknow001/rsc_detector

Supports RSC fingerprinting and exploitation of the React component vulnerability CVE-2025-55182.

shinthink/pbck-exploit

📤 Mass exploitation framework for CVE-2026-56290 — Page Builder CK Joomla unauthenticated file upload to RCE

p0dalirius/joomla-webshell-plugin

A webshell plugin and interactive shell for pentesting a Joomla website.

lascc/hacktools

The all-in-one browser extension for offensive security professionals 🛠

maxchehab/css-keylogging

Chrome extension and Express server that exploits keylogging abilities of CSS.

daem0nc0re/privfu

Kernel mode WinDbg extension and PoCs for token privilege investigation.

kagancapar/cve-2022-29072

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents…