Tools

jenish-sojitra/jsanalyzer

Burp Suite extension for JavaScript static analysis: extracts API endpoints, URLs, secrets, and emails with noise filtering for web security testing.

berraesen/nextjs-middleware-auth-bypass-lab

Bu laboratuvar ortamını sıfırdan kendim oluşturdum. Next.js uygulaması içerisinde giriş, ana sayfa ve admin sayfalarını hazırladım. Middleware ile…

welfordian/mitm-proxy

Go-based MITM HTTP/HTTPS proxy with HTTP/2 and HTTP/1.1 interception, local CA/per-host cert generation, CONNECT/WebSocket tunneling, disk caching,…

victorbonato/pocs

Proof-of-concept exploits for CVE-2026-56197 demonstrating remote code execution in Windows Admin Center, implemented in Python for vulnerability…

unpredictable21/halo-cors-csrf-cve-2026-67921

Proof-of-concept demonstrating a combined CORS misconfiguration and CSRF protection bypass in Halo CMS, enabling cross-site request forgery attacks…

kavishkagihan/cve-2022-24112-poc

Apache APISIX 2.12.1 Remote Code Execution by IP restriction bypass and using default admin AIP token

randomrobbiebf/learndash

Rubbish SQLI that requires Admin

m4xsec/apache-apisix-cve-2022-24112

Apache APISIX Remote Code Execution (CVE-2022-24112) proof of concept exploit

h2non/toxy

Hackable HTTP proxy for resiliency testing and simulated network conditions

ilhomjonr/cve-2026-70376

Advisory and Python PoC for Pluck CMS CSRF: fail-open Referer check plus double-extension upload enables webshell deployment and remote code…

flame-11/cve-2016-15041-mainwp-dashboard

Vuln lab: MainWP Dashboard <= 3.1.2 Unauthenticated Stored XSS

hunt-benito/e-is-for-exploit-cve-2026-17543-php-pgsql-sql-injection-backslash-breakout

PoC exploit for CVE-2026-17543: SQL injection in PHP ext/pgsql via backslash breakout, with data exfiltration and admin privilege-escalation payloads…

nxploited/cve-2024-31114

Shortcode Addons <= 3.2.5 - Authenticated (Admin+) Arbitrary File Upload

xmcyber/machound

Extends BloodHound to collect and ingest Active Directory relationships from macOS hosts, including logged-in users, admin groups, SSH/VNC/AppleEvent…

sshuttle/sshuttle

Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS…

watchtowrlabs/watchtowr-vs-cpanel-whm-authbypass-to-rce.py

Detection artifact generator that verifies cPanel/WHM authentication bypass (CVE-2026-41940) and demonstrates RCE via CRLF injection, targeting WHM…

dwisiswant0/proxylogscan

A fast tool to mass scan for a vulnerability on Microsoft Exchange Server that allows an attacker bypassing the authentication and impersonating as…