Nicolas Krassas

CVE-2022-22963 PoC

Hikvision log4j PoC

CVE-2024-20931, this is the bypass of the patch of CVE-2023-21839

Spring core rce

Bug bounty focused JavaScript security analysis for crawling web assets, source maps, and secret discovery

Python Duo Push API

Top passwords as per HaveIBeenPwned

A basic proxylogon scanner

Search for github leaks by combining gitleaks and git-hound capabilities with rate control and exhaustive search.

No description.

No description.

CVE-2026-26980 — Ghost CMS Content API SQL Injection Lab (unauthenticated blind SQLi via slug filter ordering)

Heap OOB write in MariaDB JSON_SCHEMA_VALID() → persistent privilege escalation (lab-assisted)

PoC for GHSA-xq3m-2v4x-88gg: Critical RCE in protobuf.js via code injection (CVSS 9.4)

CVE-2026-42779: Apache MINA AbstractIoBuffer.resolveClass() deserialization filter bypass to RCE (CVSS 9.8)

Citrix CVE-2023-4966 from assetnote modified for parallel and file handling

Redis Cluster Bus Full Takeover — Lab & PoC

Drupal SA-CORE-2026-004 (PostgreSQL Entity Query SQLi via JSON:API filter array keys) — reproduction lab + generic detection PoC + line-by-line analysis. Patch available upstream.

CVE-2026-34197 activemq PoC

PHP 8.5.5 — var_destroy __destruct reentrancy UAF. Sister bug to Calif MAD Bugs finding; survives their proposed patch. ASAN-confirmed PoCs + leak primitive.

CVE-2026-44578: Next.js WebSocket Upgrade SSRF — pre-auth credential theft via localhost:80. Lab + exploit + audit.

Apache ActiveMQ Classic RCE research: CVE-2026-34197 / CVE-2026-42588 bypass chain + hardened-6.2.6 audit findings + Crowdfense comparison

CTF-style Docker lab for CVE-2026-41651 (Pack2TheRoot): PackageKit permissive-polkit local privilege escalation

CVE-2026-3844: Breeze Cache <= 2.4.4 Unauthenticated Arbitrary File Upload to RCE (CVSS 9.8)

Collection of SAP resources for penetration testing

Reproducible Docker lab for CVE-2024-21182 — Oracle WebLogic T3/IIOP OpaqueReference JNDI injection → unauthenticated RCE (CVE-2023-21839 patch-bypass family). One-command validate.sh.

Redis security assessment with RAPTOR autonomous offensive research framework

No description.

No description.

Independent reproduction, code-level root-cause analysis, and realistic-exposure write-up for CVE-2026-42167 (ProFTPD mod_sql is_escaped_text() bypass).

Verbatim, local, cross-project search over your Claude Code memory notes (ripgrep + SQLite FTS5). No cloud, no daemon.

No description.

Netscaler simple python exploit for mass checks

ysoserial.net docker image

Kubei is a flexible Kubernetes runtime scanner, scanning images of worker and Kubernetes nodes providing accurate vulnerabilities assessment, for more information checkout:

Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1

CVE-2026-42945 nginx 32-bit exploit lab ASLR enabled

TencentDB Agent Memory delivers fully local long-term memory for AI Agents via a 4-tier progressive pipeline, with zero external API dependencies.

Simple exploit test for benigncertain (Equation Group's BENIGNCERTAIN tool - a remote exploit to extract Cisco VPN private keys)

A suite of services (SOCKS, FTP, shell, etc.) over Citrix, VMware Horizon and native Windows RDP virtual channels.

Ultra fast snmp scanner on go

🕵️‍♂️ Collect a dossier on a person by username from thousands of sites

jolokia-exploitation-toolkit

Weblogic exploits

Simple script to get subdomain information given a domain name using securitytrails API

SSRF (Server Side Request Forgery) testing resources

Exploit for CVE-2022–22718 - Windows Print Spooler Elevation of Privilege Vulnerability (LPE)

Two memcached heap buffer overflows — default-config LRU-crawler metadump + proxy backend-response length truncation (→ RCE). Responsibly disclosed and fixed in memcached 1.6.44. PoCs, ASAN evidence, reproduction & fix-validation.

Raptor turns Claude Code into a general-purpose AI offensive/defensive security agent. By using Claude.md and creating rules, sub-agents, and skills, and orchestrating security tool usage, we configure the agent for adversarial thinking, and perform research or attack/defense operations.

CVE-2025-13673: Tutor LMS SQL Injection PoC + Docker lab

Apache Camel 4.18.0 — CVE Security Assessment: 3 critical vulnerabilities with working PoC exploits (CVE-2026-33453, CVE-2026-40473, CVE-2026-40858)

Lab kit for CVE-2026-6379 — WP Photo Album Plus < 9.1.11.001 unauthenticated SQL injection. Docker lab + time-based blind PoC. For authorized security research and education.

CVE-2019-13132 — libzmq CURVE INITIATE stack overflow → RCE. Working exploit + Docker lab.

End-to-end pre-auth RCE lab for CVE-2019-6250 (libzmq <= 4.3.0, ZMTP/2.0 wire-protocol)

A visual, example-driven guide to Claude Code — from basic concepts to advanced agents, with copy-paste templates that bring immediate value.

No description.

Java Message Exploitation Tool

MS17-010

Weaponize DLL hijacking easily. Backdoor any function in any DLL.

Initial Access and Post-Exploitation Tool for AAD and O365 with a browser-based GUI

AutoRMM is a collection of scripts and instructions we are organizing, to test delivery mechanisms for RMM and screen sharing tools, along with post exploitation strategies for blue and red teams wanting to more realistically simulate adversary capabilities using these strategies.

No description.

PoCs and tools for investigation of Windows process execution techniques

Open CVS clone for pentest / bugbounty process

Information stealer logs parser

CVE-2025-1974

Elasticsearch access control validation

网络摄像头漏洞扫描工具 | Webcam vulnerability scanning tool

No description.

My POCs for CVEs & stuff

一个验证对CVE-2024-21733

ChatGPT Jailbreaks, GPT Assistants Prompt Leaks, GPTs Prompt Injection, LLM Prompt Security, Super Prompts, Prompt Hack, Prompt Security, Ai Prompt Engineering, Adversarial Machine Learning.

A comprehensive tool that provides an insightful analysis of Microsoft's monthly security updates.

Multilayered AV/EDR Evasion Framework

Because AV evasion should be easy.

Attack to induce LLMs within hallucinations

ZigStrike, a powerful Payload Delivery Pipeline developed in Zig, offering a variety of injection techniques and anti-sandbox features.

:arrow_up: :skull_and_crossbones: :fire: Automatic Linux privesc via exploitation of low-hanging fruit e.g. gtfobins, pwnkit, dirty pipe, +w docker.sock

A Go-Based Synack Mission Bot

A Rust implementation of Internal-Monologue — retrieving NetNTLM hashes without touching LSASS, leveraging SSPI for NTLM negotiation and indirect NTAPIs for core operations.

ai-generated apps , full stack + generative UI

Weblogic exploit

Here you can get full exploit for SAP NetWeaver AS JAVA

WeblogicScan一键检测

SAP memory pipes(MPI) desynchronization vulnerability CVE-2022-22536.

CVE-2021-2109 basic scanner

此项目的POC来源为2024年以来各大威胁情报的高危漏洞复现，POC已通过nuclei或xray武器化，本项目旨在为网络安全爱好者们提供一点参考资料，可供个人研究使用，共勉

CVE-2024-21006 exp

Welcome to the page where you will find each trick/technique/whatever I have learnt in CTFs, real life apps, and reading researches and news.

No description.

对原版https://github.com/feihong-cs/JNDIExploit 进行了实用化修改

Execute shellcode files with rundll32

🚀🚀🚀Free,Open-Source,Cross-platform agent and Post-exploiton tool written in Golang and C++.

This map lists the essential techniques to bypass anti-virus and EDR

A collection of exploits created or modified by me

Analyse your malware to surgically obfuscate it

No description.

No description.

Encrypted shellcode Injection to avoid Kernel triggered memory scans

No description.

Security-oriented list of resources about industrial network protocols.

Get redis keys from open redis, or by using a password. This is to create a proof of concept to be used later in reports.

No description.

WebLogic vulnerability exploration from beginner to expert.

Dumping DPAPI credz remotely

The swiss army knife of LSASS dumping

POC of CVE-2022-36537

60+ Gadgets(30 More than ysoserial). JNDI-Injection-Exploit-Plus is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server.

Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation , it contains Anti-sandbox , if you run it under unperformant Virtual Machine you need to uncomment the code related to it and recompile.

KubeStalk discovers Kubernetes and related infrastructure based attack surface from a black-box perspective.

ADCS abuser

WeblogicEnvironment docker setup for research

:no_entry: offsec batteries included

Base64-based encryption oracle exploit for CVE-2017-9248 (Telerik UI for ASP.NET AJAX dialog handler)

No description.

One day based on https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html

Collection of Threat Models

w13scan custom

the metasploit script(POC) about CVE-2022-41040. Microsoft Exchange are vulnerable to a server-side request forgery (SSRF) attack. An authenticated attacker can use the vulnerability to elevate privileges.

POC of CVE-2021-2394

Pentesting notes

MySQL注入绕安全狗Tamper / Code By:Tas9er

Redis(<=5.0.5) RCE

weblogic 漏洞扫描工具。目前包含对以下漏洞的检测能力：CVE-2014-4210、CVE-2016-0638、CVE-2016-3510、CVE-2017-3248、CVE-2017-3506、CVE-2017-10271、CVE-2018-2628、CVE-2018-2893、CVE-2018-2894、CVE-2018-3191、CVE-2018-3245、CVE-2018-3252、CVE-2019-2618、CVE-2019-2725、CVE-2019-2729、CVE-2019-2890、CVE-2020-2551、CVE-2020-14750、CVE-2020-14882、CVE-2020-14883

Passive Security Scanner

Repo for proof of concept exploits and tools.

No description.

A quick way to retrieve your token whilst working and too lazy to fetch your phone

No description.

UAC bypass, Elevate, Persistence methods

attackRmi

This script helps to identify CVE-2021-26855 ssrf Poc

During the exploitation phase of a pen test or ethical hacking engagement, you will ultimately need to try to cause code to run on target system computers. Whether accomplished by phishing emails, delivering a payload through an exploit, or social engineering, running code on target computers is part of most penetration tests. That means that you will need to be able to bypass antivirus software or other host-based protection for successful exploitation. The most effective way to avoid antivirus detection on your target's computers is to create your own customized backdoor. Here is a simple way to evade anti-virus software when creating backdoors!

A collection of awesome API Security tools and resources. The focus goes to open-source tools and resources that benefit all the community.

A collection of more than 170+ tools, scripts, cheatsheets and other loots that I have developed over years for Red Teaming/Pentesting/IT Security audits purposes. Most of them came handy on at least one of my real-world engagements.

The cheat sheet about Java Deserialization vulnerabilities

.NET, PE, & Raw Shellcode Packer/Loader Written in Nim

Chrome Android and Windows 0day RCE+SBX.. DPRK

PHP binary bugs advisory

Blackbox tool to disable SSL certificate validation - including certificate pinning - within iOS and macOS applications.

No description.

Python exploit for the CVE-2021-22204 vulnerability in Exiftool

grep rough audit - source code auditing tool

Checklist of the most important security countermeasures when designing, testing, and releasing your API

Collection of Cyber Threat Intelligence sources from the deep and dark web

Pre-Built Vulnerable Environments Based on Docker-Compose

No description.

vulnerable OAuth 2.0 applications: understand the security implications of your OAuth 2.0 decisions.

Poc

Burp Suite Extension useful to verify OAUTHv2 and OpenID security

SysWhispers Shellcode Loader (Work in Progress)

Weblogic IIOP CVE-2020-2551

forked from frohoff/ysoserial and added my own payloads.

A cheat sheet that contains advanced queries for SQL Injection of all types.

self-written exploits for all Nday vulnerabilities

CVE-2019-0708 (BlueKeep) proof of concept allowing pre-auth RCE on Windows7

Proper JNDI

Command line utilities for the SONiC project

No description.

No description.

No description.

An ike-scan wrapper to simplify penetration testing IKE and encourage stronger IKE implementations.

A repository that includes all the important wordlists used while bug hunting.

This repository contains cutting-edge open-source security tools (OST) for a red teamer and threat hunter.

win32k LPE

Vulnerability Exploitation Code Collection Repository

No description.

That repository contains my updates to the well know java deserialization exploitation tool ysoserial.

goby poc or exp,分享goby最新网络安全漏洞检测或利用代码

PHPGGC is a library of PHP unserialize() payloads along with a tool to generate them, from command line or programmatically.

Exphub[漏洞利用脚本库] 包括Webloigc、Struts2、Tomcat、Nexus、Solr、Jboss、Drupal的漏洞利用脚本，最新添加CVE-2020-14882、CVE-2020-11444、CVE-2020-10204、CVE-2020-10199、CVE-2020-1938、CVE-2020-2551、CVE-2020-2555、CVE-2020-2883、CVE-2019-17558、CVE-2019-6340

K8工具合集(内网渗透/提权工具/远程溢出/漏洞利用/扫描工具/密码破解/免杀工具/Exploit/APT/0day/Shellcode/Payload/priviledge/BypassUAC/OverFlow/WebShell/PenTest) Web GetShell Exploit(Struts2/Zimbra/Weblogic/Tomcat/Apache/Jboss/DotNetNuke/zabbix)

PoC exploits for software vulnerabilities

JMX enumeration and attacking tool.

渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss penetration-testing-poc csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypass oa-getshell cve-cms

PoC CVE-2020-6308

此项目将不定期从棱角社区对外进行公布一些最新漏洞。

PoC collection of Atlassian(Jira, Confluence, Bitbucket) products and Jenkins, Solr, Nexus

No description.

VMware vCenter earlier v(7.0.2.00100) unauthorized arbitrary file read

Automatic Exploit Generation (AEG) and remote flag capture for exploitable CTF problems

(PoC) Python version of CVE-2019-11043 exploit by neex

proxylogon, proxyshell, proxyoracle and proxytoken full chain exploit tool

Remote Code Injection In Log4j

apache log4j poc—— base Maven

No description.

My nots from Web application Hacker's Handbook

exploits and proof-of-concept vulnerability demonstration files from the team at Hacker House

Landing page for Software for Open Networking in the Cloud (SONiC) - http://azure.github.io/SONiC/

No description.

A toolbox for extracting RSA private keys from public keys.

Albatar is a SQLi exploitation framework in Python

RSA attack tool (mainly for ctf) - retreive private key from weak public key and/or uncipher data

A post exploitation framework designed to operate covertly on heavily monitored environments

A tool for generating fake code signing certificates or signing real ones

No description.

Covenant is a collaborative .NET C2 framework for red teamers.

This Metasploit-Framework module can be use to help companies to check the last Citrix vulnerability CVE-2020-8193, CVE-2020-8195 and CVE-2020-8196 (disclosed July 08, 2020).

No description.

Mind-Maps of Several Things