Full-featured C2 framework which silently persists on webserver with a single-line PHP backdoor
- post-exploitation
- hacking
- backdoor
- stealth
Repository Index
47,133 repositories indexed
25–48 of 64 · Most stars
The best tool for finding one gadget RCE in libc.so.6
- ctf
- pwnable
- pwn
- glibc
Reverse Shell as a Service
- reverse-shell
- exploit
- vulnerability
- pentesting
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
- cve-2026-109618
- cve-2026-109619
- detection-rules
- exploit
The Offensive Manual Web Application Penetration Testing Framework.
- web-penetration-testing
- reconnaissance
- vulnerability-analysis
- scanning-enumeration
A php2shell exploit that requires no modifications to the official version, and does not require display_errors or limit_memory.
The Prime Cross Site Request Forgery (CSRF) Audit and Exploitation Toolkit.
- csrf
- crawler
- csrf-attacks
- token-generation
An automated, modular cryptanalysis tool; i.e., a Weapon of Math Destruction
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only.
Find exploit tool
- exploit-database
- python
- pentest-tool
- exploits
A collection of android Exploits and Hacks
Detect deauthentication frames using an ESP8266
Ephemeral root via the CVE-2026-43284 page-cache exploit
Ronin is a Free and Open Source Ruby Toolkit for Security Research and Development. Ronin also allows for the rapid development and distribution of code, exploits, payloads, etc, via 3rd-party git repositories.
Malware exploits
Samsung Tizen root
- embedded-linux
- firmware-analysis
- hardware-hacking
- mali-gpu
DNS Rebinding Exploitation Framework
MQTT-PWN intends to be a one-stop-shop for IoT Broker penetration-testing and security assessment operations.
- python
- mqtt
- mqtt-broker
- mqtt-client
Open PS5 firmware 14.10 research: Lua userland experiments, syscall and attack-surface analysis. Kernel read/write and a complete exploit are not demonstrated.
- ps5
- ps5-homebrew
- ps5-jailbreak
- ps5-tools
Automated client-side template injection (sandbox escape/bypass) detection for AngularJS v1.x.
CVE-2026-109618 / CVE-2026-109619 pre-auth RCE in PHP session.upload_progress (mod_php): version-aware exploit profiles, Docker labs, heap calibration and detection guidance.
- cve-2026-109618
- cve-2026-109619
- exploit
- mod-php
:hammer: A multiple reverse shell session/client manager via terminal
- socket
- python
- ctf
- attack-defense
HTTP/2 Last Frame Synchronization (also known as Single Packet Attack) low Level Library / Tool based on Scapy + Exploit Timing Attacks
- http2
- race-condition
- race-conditions
- scapy
This is an aspiring project aimed at accumulating knowledge from the world of cybersecurity and presenting it in a cogent way, so it is accessible to as large an audience as possible and so that everyone has a good resource to learn hacking from.