Repository Index

Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname

• osint
• osint-python
• python3
• instagram

CTF framework and exploit development library

• ctf
• exploit
• python
• pwntools

🐚 Python-powered shell. Full-featured, cross-platform and AI-friendly.

• xonsh
• devops
• iterm2
• data-engineering

Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor

• post-exploitation
• hacking
• backdoor
• stealth

CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.

• cve-2026-109618
• cve-2026-109619
• detection-rules
• exploit

A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.

Python low-interaction honeyclient

• honeyclient
• client-honeypot
• python
• security-tools

:hammer: Manage your website via terminal

• php
• security-tools
• python
• pentest

Operational information regarding the 2026 php2shell vulnerabilities

CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.

• cve-2026-109618
• cve-2026-109619
• exploit
• mod-php

Automated Tactics Techniques & Procedures

• empire
• tactics
• procedure
• cybersecurity

:hammer: A multiple reverse shell session/client manager via terminal

• socket
• python
• ctf
• attack-defense

PHP2Shell exploit framework — CVE-2026-109618/619 PHP session.upload_progress UAF to RCE

Unauthenticated RCE toolkit for PHP 5.4–8.4.26 (CVE-2026-109619/109618) — pure-HTTP chain, JA3 impersonation, prpenetration-testingoof-of-access design

• exploit
• php
• php2shell
• php2shell-cve

PHP CVE-2026-109618/109619 — self-contained unauthenticated RCE on stock PHP 8.5.11 (in-band PS(id)→cookie memory disclosure + UAF chain), full control ladders, fixed-version negative control on 8.5.12

• cve-2026-109618
• cve-2026-109619
• exploit
• memory-corruption

Non-destructive scanner for CVE-2026-109618 / CVE-2026-109619 (PHP core RCE). Subdomain recon via crt.sh + subfinder, robust banner grabbing, version-based detection.

• crtsh
• cve
• cve-2026-109618
• cve-2026-109619

A honeypot for the Log4Shell vulnerability (CVE-2021-44228).

Security and Hacking Tools, Exploits, Proof of Concepts, Shellcodes, Scripts.