Skip to content
KitploitKITPLOIT
StrumentiBlog
Invia
StrumentiBlog
Invia

Strumenti di Hacking, PenTest e Cybersecurity per il tuo Arsenale di Sicurezza!

Kitploit è una directory di strumenti di hacking, cybersecurity e pentesting. Scopri gli ultimi aggiornamenti dei progetti per trovare vulnerabilità, analizzare sistemi, automatizzare i test e rafforzare la tua sicurezza.

··Feed·Contatto·Privacy·© 2026 Kitploit

Directory degli strumenti

Categorie

Vedi tutte le categorie
Loading categories
My-Exploits — Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474). | Kitploit
Strumenti/GitHubGitHub/m4xsec/my-exploits
Container SecurityExploit FrameworksVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCloud SecurityLearning & EducationPayload DevelopmentLabs & Practice
GitHubm4xsec/my-exploits
11119 giorni faNon ancora revisionato

Più Popolari

Vedi tutti →

Scopri gli strumenti più utilizzati dalla nostra community.

Esplora tutti gli strumenti

Sfoglia la nostra collezione di strumenti

Vedi tutti gli strumenti →
Condividi

My-Exploits

Metasploit modules, Python PoCs and throwaway Docker labs for four platform CVEs: Keycloak (CVE-2026-18963), Apache NiFi (CVE-2026-39816), HashiCorp Vault (CVE-2026-5006), HashiCorp Nomad (CVE-2026-7474).

Vedi Repository
Contenuto non disponibile nella lingua richiesta. Visualizzazione della versione inglese.

My-Exploits

Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of concept, and a small Docker lab that stands up only the vulnerable service so anyone can reproduce the bug without taking my word for it.

Nothing here targets a live environment. The labs are throwaway containers on your own host.

Findings

CVEComponentClassAffectedMetasploitPoCLab
CVE-2026-18963KeycloakReset-credentials sticky-selector account takeover< 26.7.2yesyesyes
CVE-2026-39816Apache NiFiTinkerpop / ExecuteGraphQuery Groovy RCE past the execute-code gate2.0.0-M1 .. 2.8.0yesyesyes
CVE-2026-5006HashiCorp VaultTemplated-policy metadata slash injection (HCSEC-2026-32)<= 2.0.3yesyesyes
CVE-2026-7474HashiCorp NomadDynamic host-volume plugin_id path traversal to root (HCSEC-2026-15)<= 2.0.0yesyes

Layout

root@kitploit:~
metasploit-custom-modules/   Metasploit modules + module docs, in the normal framework tree
exploits/                    one self-contained Python PoC per CVE
docker-lab/                  one throwaway Docker lab per CVE, spins up only the vulnerable service

Each of those three has its own README with the details. Short version:

  • metasploit-custom-modules/ drops straight into a framework checkout (or your ~/.msf4). Three modules: the Keycloak takeover, the Vault metadata slash injection, and the NiFi RCE.
  • exploits/ is four dependency-light Python scripts, one per CVE. They run against the matching lab with no edits.
  • docker-lab/ is four independent labs. Each pins the last vulnerable release, wires up whatever the bug actually needs (the graph bundle for NiFi, a real Docker engine for Nomad), and nothing more. No flags, no chained scenario, just the bug.

Reproducing a finding

Pick a CVE, bring its lab up, fire the PoC. For example, Keycloak:

root@kitploit:~
cd docker-lab/keycloak-cve-2026-18963
docker compose up -d
cd ../..
python3 exploits/kc_ato_18963.py \
    --base http://127.0.0.1:8080 --realm larkspur \
    --victim j.okonkwo --newpass Chang3d-by-attacker!

The other three follow the same pattern. Read the per-lab README first, a couple of them need --build and a minute to provision.

Disclosure

All four were reported to the respective vendors and are fixed in the versions noted above. Everything published here runs against the deliberately outdated images in docker-lab/. Point it at anything you do not own and that is on you.

License

MIT. See LICENSE.

Scarica lo strumento