PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
This repository contains a proof-of-concept exploit for two Linux kernel vulnerabilities (CVE-2026-43284 and CVE-2026-43500), collectively called 'Dirty Frag'. The exploit chains an xfrm-ESP page-cache write vulnerability (requires user namespace creation) with an RxRPC page-cache write vulnerability (does not require namespace creation) to achieve root privilege escalation on major Linux distributions. The single C source file (exp.c) implements both exploit paths and a fallback chain: it first attempts to overwrite /usr/bin/su with a minimal root-shell ELF using the ESP variant, and if that fails (e.g., due to AppArmor blocking user namespaces), it falls back to patching /etc/passwd's root entry to have an empty password field via the RxRPC variant, then spawns a root shell via su. The code demonstrates advanced kernel exploitation techniques including splice-based page cache injection, in-place crypto manipulation, and user-space porting of kernel crypto primitives (fcrypt). It is not a reusable library or framework but a targeted exploit PoC.
This repository contains a proof-of-concept exploit for CVE-2023-3269 (StackRot), a use-after-free vulnerability in the Linux kernel's maple tree implementation for managing virtual memory areas (VMAs). The exploit demonstrates privilege escalation from an unprivileged local user to root, and also container escape, targeting kernel version 6.1.25. It is verified to work in the Google kCTF VRP environment and is built and tested via GitHub CI using QEMU. The exploit is structured into three main components: node_master (orchestrator), node_free (triggers the UAF), and node_use (reads /proc/self/maps to leak addresses and control execution). It uses a deep directory tree to prolong VMA iteration, allowing the RCU grace period to expire and convert a use-after-free-by-RCU into a genuine use-after-free. Then it employs slab feng shui to gain control of freed maple nodes, leaks kernel addresses via /proc/self/maps, and executes a ROP chain to gain root privileges and escape containers. The code is well-crafted with a custom minimal libc (nolibc) and inline assembly for syscalls. The syscall wrappers and clone helper are cleanly implemented and could be reused in other kernel exploit projects. The repository includes a Makefile, CI configuration, and environment files (kernel image, initramfs) for easy reproduction.
BrewServicesManager is a native macOS menu bar application built with SwiftUI and Swift 6 concurrency that provides a graphical interface for managing Homebrew services (start, stop, restart, view status, detect ports, configure service links). The architecture follows a SwiftUI-first pattern with an actor-based `BrewServicesClient` for serialized shell command execution against Homebrew, an `@Observable` `ServicesStore` as the central state manager, and a modular view hierarchy for the menu bar interface. It integrates with Sparkle for automatic updates, uses `NSAppleScript` for privilege escalation when managing system-level services, and employs `lsof`/`pgrep` for port detection. External dependencies include Homebrew, Sparkle framework, and standard macOS command-line tools. The code demonstrates modern Swift practices including strict concurrency, `@Observable` classes, and clean reactively-driven UI with `@Binding` and `@Environment` injection.
Stellar is a Shizuku-fork Android application that provides a privileged service framework enabling apps to use system-level APIs without root. The repository contains two main modules: a manager app with Jetpack Compose UI (including home dashboard, app permission management, terminal command execution, settings, and a startup wizard) and a server process that runs as a system service via app_process, managing Binder IPC, permissions, remote process creation, and Shizuku API compatibility. The manager app uses Room for persistent configuration and logs, while the server communicates with the manager and client apps through Binder and a ContentProvider bridge. The project demonstrates deep integration with Android internals (hidden APIs, ProcessObserver, UidObserver) and includes native C++ code for ADB wireless pairing via mDNS and TLS, as well as privilege drop and cgroup management. While the code is well-organized and modular in parts, it is tightly coupled to Android platform specifics and lacks automated tests, making it primarily useful as a reference for building similar privilege-escalation frameworks or for users wanting to manage Stellar on their devices.
This repository is a comprehensive OSCP pentesting cheatsheet composed of markdown notes and diagrams. It serves as a reference guide for penetration testing methodologies, covering enumeration, privilege escalation, web application testing, Active Directory attacks, and more. While not containing executable code or data processing pipelines, it curates actionable information from various security resources into an organized format. The content is structured as checklists and step-by-step guides for common pentesting tasks, making it immediately applicable for individuals preparing for the OSCP certification or conducting real-world assessments. The repository does not ingest or transform external datasets; instead, it represents synthesized knowledge intended for direct consumption. Despite lacking traditional data engineering components, the repository demonstrates value as a knowledge artifact. Its maintenance is active with recent updates, and the static nature ensures zero technical drift. Reproducibility is trivial as the entire content is self-contained within the repository.
CDK (Container Docker/Kubernetes Exploitation Toolkit) is a Go-based CLI penetration testing tool designed for container and Kubernetes environments. It evaluates security posture by running extensive checks against container runtime configurations, K8s API permissions, cloud metadata, and kernel exploit possibilities. It then executes a plethora of exploits covering container escape (cgroups, mount, eBPF, runc/containerd CVEs), K8s credential access (secrets, configmaps, tokens), persistence (backdoor daemonsets, cronjobs, shadow API server), privilege escalation (service account token theft, CVE-2026-31431), and remote control (reverse shells, kubelet exec). The binary bundles stripped-down versions of common tools (kubectl, netcat, vi, etc.) for post-exploitation use. The architecture follows a plugin pattern where exploits register themselves via init(), and evaluation uses a category-based check system. The codebase shows signs of organic growth with some legacy cruft (deprecated auto-escape task, commented-out code, future-dated CVEs) and moderate technical debt (global mutable state, panics, outdated Go idioms), but remains functional and actively maintained for penetration testers and security researchers.
This repository is a collection of Proof of Concept (PoC) implementations for various Windows process manipulation and evasion techniques, including process hollowing, DLL injection, spoofing, and memory analysis. Each technique is implemented as a standalone console application with a consistent structure separating command-line handling, core logic, and Windows API interop. The code demonstrates a clear understanding of Windows internals but suffers from significant code duplication (e.g., identical CommandLineParser and HexDump utilities across multiple projects) and relies on undocumented APIs that are prone to breaking with Windows updates. Many techniques are noted in the README as ineffective against modern Windows defenses due to security mitigations. The repository appears to be stale, with no recent updates to address evolving defenses, and exhibits high technical drift due to outdated dependencies and techniques.