GEF (GDB Enhanced Features) is a production-grade GDB plugin for exploit development, reverse engineering, and binary analysis. It is a single Python script (gef.py) that loads into GDB (>=10.0) and provides over 90 commands covering memory inspection, heap analysis, security mitigation checks (checksec), pattern generation, format string detection, and remote debugging. The architecture is monolithic but well-organized, with a clear separation of concerns via class hierarchies for architectures, memory regions, heap structures, and command registration. The test suite is extensive, using a Docker-based CI matrix that runs on multiple architectures (x86, ARM, AARCH64, etc.) and validates behaviour through RPyC-driven remote GDB sessions. While primarily an application, it also serves as a research tool for heap allocator internals and glibc version-specific behaviour, blending practical utility with deep system understanding.
This repository implements a full 4G/5G telecommunications protocol stack (likely based on srsRAN) for software-defined radio applications. It provides implementations for User Equipment (UE), evolved Node B (eNB), gNB (next generation Node B), and Evolved Packet Core (EPC) network elements. The architecture follows a layered approach mirroring the telecommunications protocol stack (PHY, MAC, RLC, PDCP, RRC, NAS) with clear interfaces between layers. The system supports various SDR hardware platforms through a plugin-based radio frequency abstraction layer and can be used to build experimental 4G/5G networks for research and development. Key entry points include main.cc files in each application directory (srsenb, srsue, srsepc, srsgnb) and example applications in lib/examples/.
PayloadsAllTheThings is a curated knowledge base of web application security payloads, bypass techniques, and exploitation methodologies. It is organized by vulnerability type (e.g., SQL Injection, XSS, SSRF, SSTI, File Inclusion) with each category containing a README.md explaining the technique, references to original research, and subdirectories for payload wordlists (Intruder/), exploit scripts (Files/), and diagrams (Images/). The repository also includes methodology guides for Active Directory, cloud pentesting, and privilege escalation. While primarily a static reference, it contains hundreds of standalone exploit scripts (Python, PHP, Ruby, shell) and configuration files (e.g., .htaccess, web.config) that can be directly reused in penetration testing engagements. The content is actively maintained with recent commits and CI/CD workflows, though some payloads reference older CVEs and may require adaptation for modern environments. This is a hybrid resource: a research-oriented payload collection with embedded executable components.
This repository is a comprehensive, curated collection of cybersecurity references, scripts, tools, code, labs, and training resources, primarily authored by Omar Santos. It serves as supplemental material for his books, video courses, and live training, covering a vast range of domains including offensive security, defensive security, application security, cloud/container security, hardware/embedded security, AI/ML security, and certification preparation (Cisco, CompTIA, ISC2, etc.). The repo is hybrid in nature: while it contains hundreds of runnable scripts and tools (e.g., network scanners, exploit examples, API security testers, AI-powered log analyzers), its dominant character is that of an educational knowledge base and reference library rather than a deployable application. The content is organized into clear domain directories, with extensive READMEs acting as curated indexes of tools, papers, talks, and labs. The AI security section is particularly well-developed, including course materials on agentic AI, prompt engineering, and the Foundry Security Spec. The repository is actively maintained, with recent commits and automated CI workflows, though the breadth of content introduces risks of link rot and technology churn in fast-moving areas like AI frameworks and certification blueprints.
KubeHound is a security analysis tool for Kubernetes clusters that automatically models and computes attack paths. It collects Kubernetes resources (pods, roles, bindings, endpoints, nodes) via a live API or offline dump, transforms them into a property graph stored in JanusGraph (with MongoDB as an intermediate store), and computes privilege escalation and lateral movement paths mapped to MITRE ATT&CK techniques. The system exposes a CLI for local analysis and a gRPC API (KHaaS) for service-oriented deployments, with optional Jupyter notebooks for querying the graph using a custom Gremlin DSL. The architecture is modular: a collector abstraction handles rate-limited streaming from the Kubernetes API; an ingestion pipeline converts raw objects into normalized store models and graph vertices/edges; an edge registry defines over 20 attack types (e.g., PodExec, TokenSteal, ContainerEscape); and a graph builder executes Gremlin traversals to connect vertices into paths. Storage layers use asynchronous writers with micro-batching for high throughput, and an in-memory cache deduplicates identities and roles. Telemetry (Datadog APM, metrics, logs) is integrated throughout. While primarily an application, the repository includes experimental research components (exp/khaudit) for audit reports and MITRE Attack Flow conversion, plus Jupyter notebooks for interactive graph queries, giving it a hybrid character. The codebase demonstrates strong engineering practices: provider interfaces, test mocking, worker pools, retry logic, and comprehensive system tests against real Kind clusters. However, some areas (large cluster optimizations, experimental code, deprecated flags) indicate ongoing evolution and minor technical debt.
This repository contains a proof-of-concept exploit for CVE-2026-41089, a critical stack buffer overflow in the Windows Netlogon service via CLDAP (UDP 389). The poc.py script sends a malformed LDAP search request with an oversized username to trigger the vulnerability, causing LSASS to crash and the domain controller to reboot. The implementation includes correct BER/DER encoding primitives for LDAP packet construction, which can be reused in other projects requiring LDAP protocol handling.
WES-NG (Windows Exploit Suggester - Next Generation) is a monolithic CLI tool written in Python. Its core function is to read the output of the Windows `systeminfo` command and compare the detected operating system version and installed patches against a bundled database of known vulnerabilities (CVEs). It outputs a prioritized list of likely exploitable vulnerabilities, including links to public exploits. The architecture centers on `wes.py`, which handles input parsing, OS fingerprinting, patch matching, and output formatting. The vulnerability database is shipped as `definitions.zip`, a compressed CSV file. The tool employs a recursive graph traversal algorithm (`mark_superseeded_hotfix`) to filter out patches that have been superseded by newer updates, significantly reducing false positives. Optional companion scripts (`missingkbs.vbs`, `missingkbs.ps1`) can enumerate missing patches directly on a Windows host. The repository also contains a complete data collection pipeline (`collector/*.ps1`) used by the maintainers to regenerate the vulnerability database from sources like the MSRC API, NVD, and Exploit-DB. A large corpus of validation data (`validation/*.txt`) ensures the OS fingerprinting logic works across a wide range of Windows versions and locales. While the core logic is robust and well-tested, the codebase shows signs of technical drift, including remnants of Python 2 compatibility and reliance on hardcoded URLs for data updates. Overall, it is a highly effective and practical security auditing tool that accurately fulfills its stated purpose.
This repository contains a proof-of-concept exploit for two Linux kernel vulnerabilities (CVE-2026-43284 and CVE-2026-43500), collectively called 'Dirty Frag'. The exploit chains an xfrm-ESP page-cache write vulnerability (requires user namespace creation) with an RxRPC page-cache write vulnerability (does not require namespace creation) to achieve root privilege escalation on major Linux distributions. The single C source file (exp.c) implements both exploit paths and a fallback chain: it first attempts to overwrite /usr/bin/su with a minimal root-shell ELF using the ESP variant, and if that fails (e.g., due to AppArmor blocking user namespaces), it falls back to patching /etc/passwd's root entry to have an empty password field via the RxRPC variant, then spawns a root shell via su. The code demonstrates advanced kernel exploitation techniques including splice-based page cache injection, in-place crypto manipulation, and user-space porting of kernel crypto primitives (fcrypt). It is not a reusable library or framework but a targeted exploit PoC.
This repository contains a proof-of-concept exploit for CVE-2023-3269 (StackRot), a use-after-free vulnerability in the Linux kernel's maple tree implementation for managing virtual memory areas (VMAs). The exploit demonstrates privilege escalation from an unprivileged local user to root, and also container escape, targeting kernel version 6.1.25. It is verified to work in the Google kCTF VRP environment and is built and tested via GitHub CI using QEMU. The exploit is structured into three main components: node_master (orchestrator), node_free (triggers the UAF), and node_use (reads /proc/self/maps to leak addresses and control execution). It uses a deep directory tree to prolong VMA iteration, allowing the RCU grace period to expire and convert a use-after-free-by-RCU into a genuine use-after-free. Then it employs slab feng shui to gain control of freed maple nodes, leaks kernel addresses via /proc/self/maps, and executes a ROP chain to gain root privileges and escape containers. The code is well-crafted with a custom minimal libc (nolibc) and inline assembly for syscalls. The syscall wrappers and clone helper are cleanly implemented and could be reused in other kernel exploit projects. The repository includes a Makefile, CI configuration, and environment files (kernel image, initramfs) for easy reproduction.
Ndless is a jailbreak and homebrew SDK for TI-Nspire calculators. It enables execution of unsigned ARM-native code and provides a complete development environment including cross-compilation toolchain, system libraries (libndls, libsyscalls), SDL 1.2 port, Lua scripting extensions, and support for multiple calculator models and OS versions (3.x through 6.x). The repository contains exploit-based installers for each OS version, a runtime loader with hooking infrastructure, and a custom executable format (Zehn). The SDK includes sample applications demonstrating graphics, input, particles, networking, and Lua integration. The codebase is heavily based on reverse-engineering of TI's firmware, with hardcoded memory addresses and syscall tables for dozens of OS releases. This is a hybrid project: primarily an application/SDK, but with a significant data/research component in the form of reverse-engineering artifacts (IDA IDC scripts) used to generate syscall mappings.
This repository is primarily a large collection of GPT prompt templates (markdown files) designed for use with AI chat platforms like FlowGPT or gptcall.net. Each prompt file defines a specific role or task for the AI, such as a resume editor, coding tutor, fitness planner, or creative writing assistant. The repository also includes an Android application (OpenClaw and Codex) referenced in the README, along with Node.js scripts (update.mjs, db.mjs) for managing the prompt data. The prompts are structured with placeholders for user input and often request specific output formats, enabling users to import them into chat interfaces to obtain specialized AI behavior without crafting prompts from scratch. While the prompt library is extensive, it contains significant duplication, minimal-effort entries, and some policy-risking content (e.g., jailbreaks, NSFW role-play), which affects overall quality and reuse potential.
This repository is a comprehensive collection of vulnerability proof-of-concept (PoC) exploits and detailed write-ups, primarily targeting Chinese enterprise software (OA, ERP, CMS, network devices, etc.). It contains over 1000 vulnerability entries organized by year and CVE identifier, each with structured risk assessments, HTTP request/response PoCs, FOFA search queries for asset discovery, and custom Snort/Suricata detection rules. The repository also includes executable Python scripts and YAML nuclei templates for automated exploitation and detection. While the majority of content is documentation, the scripts provide reusable scanning patterns with threading, proxy support, and output saving. The code quality is functional but basic, with many single-file scripts. The repository is actively maintained and serves as a practical reference for penetration testers and security researchers, though some CVE numbers appear speculative and PoCs may rely on future-dated vulnerabilities.