~/hackyfeed $

udbg is a cross-platform Rust library designed for binary debugging and memory manipulation, providing uniform interfaces across various operating systems. Its primary use case is to facilitate the inspection and control of multiple debug targets without invasive attachment, supporting comprehensive target information retrieval and debugging functionalities. Notable features include support for multiple architectures, non-invasive operation modes, and capabilities for breakpoint and watchpoint management.

The tool "Tor-0day-JavaScript-Exploit" serves as a comprehensive educational resource and demonstration of the CVE-2024-9680 vulnerability, a critical use-after-free exploit in the Tor Browser's animation handling. It includes both the original exploit code used in the wild and a modified version with detailed analyses, showcasing the exploitation process through various stages such as initialization, DOM crafting, and trigger mechanisms. This repository is intended primarily for security education, defensive research, and authorized vulnerability assessments, emphasizing ethical and legal usage.

TokenElevation is a Windows utility that facilitates privilege escalation by enabling the SeImpersonatePrivilege, allowing the user to impersonate a logged-on user and duplicate the token of a specified target process. This tool is primarily used in administrative and debugging scenarios, enabling users with local Administrator access to execute new processes under the context of a target process to perform elevated tasks. Notable features include process token manipulation and the capability to spawn a new command prompt with the privileges of the target process specified by its PID.

TI-MultiView-data-recovery is a tool designed to recover entries from the TI-30XS MultiView™ and TI-30XB MultiView™ scientific calculators after they have been reset. The procedure allows users to restore inputs and answers displayed on the home screen, leveraging specific key sequences, while noting that it does not recover settings or statistical data. The tool highlights the persistence of memory even after a reset, providing a workaround for users to retrieve valuable calculations.

testbuild_exploit is a tool designed to achieve elevated privileges (UID 1000) on vulnerable Android devices running test-signed ROMs by patching system apps to inject a backdoor. This allows users to execute commands with nearly root-level access, although functionality may be limited by SELinux configurations. Key features include the ability to modify any app, not just system ones, and integration with ADB for command execution.

SeTcbPrivilege Local Privilege Escalation (LPE) is a tool implemented in Go that leverages the SeTcbPrivilege privilege escalation technique to allow users to execute arbitrary commands with elevated permissions on Windows systems. Its primary use case is for gaining administrative access by manipulating service configurations, and it features automatic service deletion post-execution, with a manual clean-up option available. This tool provides a streamlined method for executing commands that would normally require higher privileges.

SettingContent-MS-File-Execution is a proof-of-concept tool that exploits the SettingContent-MS file execution vulnerability in Windows 10. It facilitates the automatic launch of Internet Explorer to load a specified website, which can be utilized to exploit existing vulnerabilities within the browser or to execute online payloads. Notable features include the ability to maximize the browser window and target specific online resources.

PDB2JSON is an Azure Functions-based application designed for secure authentication of running memory in Windows systems through its extensive SHA256 hash database. The tool provides a JSON-based interface for remote interactions with a Code+PDB analysis server, enabling functionalities like symbol resolution and hash verification without uploading binary data. Its notable features include a just-in-time hashing methodology for integrity protection and automation support for memory dump analysis through various scripting examples.

ronin-exploits is a Ruby micro-framework designed for the creation and execution of exploit code, allowing exploits to be implemented as Ruby classes. Its primary use case is to simplify the process of writing exploits while providing a modular structure similar to Metasploit, featuring support for various exploit types such as stack overflows, command injections, and cross-site scripting. Notable features include a succinct API, the ability to load exploits from Ruby files or external git repositories, and a minimal memory footprint, making it efficient for security research and development.

Red Team Rising is a comprehensive resource repository designed for red and purple team professionals, encompassing topics like Penetration Testing, Digital Forensics, Exploit Development, and Malware Analysis. It provides curated study materials, reference links to training platforms and notable YouTube channels, as well as practical commands and tools for various OS distributions suited for cybersecurity tasks. Notable features include a wide array of recommended resources for self-study and a focus on both offensive and defensive security strategies.

React2Shell is an exploit tool designed to leverage a critical remote code execution (RCE) vulnerability in React Server Components (CVE-2025-55182), featuring multiple techniques to bypass Web Application Firewalls (WAFs). Its primary use case includes executing arbitrary JavaScript commands via HTTP requests while providing options for non-destructive vulnerability detection and sophisticated WAF evasion strategies, such as charset manipulation and junk data padding. The tool supports a variety of customization flags to enhance exploitation efficacy and evade detection mechanisms effectively.

React2Shell is an advanced exploitation toolkit specifically designed to target the React2Shell vulnerability (CVE-2025-55182) in Next.js applications. It offers an interactive shell experience with features such as command history, automated privilege escalation through pipe injection, and secure file transfer capabilities using base64 encoding. The tool consolidates its exploit logic into a single executable file, making it portable and easy to deploy for ethical penetration testing and security research.

R2SAE is a command-line tool designed to exploit prototype pollution vulnerabilities in React Server Actions, facilitating remote command execution on affected servers. Key features include command execution on single or multiple hosts, an interactive shell for streamlined command input, and a vulnerability scanning capability with both passive and active methods. This tool is intended solely for authorized security testing and educational purposes.

pyFUD is a cross-platform, fully undetectable (FUD) remote access tool (RAT) designed for multi-client handling, allowing persistent shell access and additional functionality such as file upload and download capabilities. The tool supports both Windows and Linux, with features including auto-reconnect and client executable conversion using PyInstaller, aimed primarily at educational use. Users are cautioned against uploading payloads to VirusTotal to maintain its effectiveness.

PwnPasi is a professional automated binary exploitation framework tailored for CTF competitions and security research, streamlining the complex process of binary exploitation. It features smart vulnerability detection, advanced exploitation techniques like ROP chain construction and syscall exploitation, and supports multiple architectures with options for local and remote exploitation. Additionally, it offers flexible deployment modes and integrates various technical tools for thorough binary analysis.

PoE (Proof-of-Exploit) is a domain-specific language tailored for exploit development, offering an intuitive syntax that facilitates the writing of exploits. It features static typing, inline assembly integration, and the ability to manipulate bit-vectors, while supporting local, remote, and SSH modes for interacting with target systems. The tool is built on a .NET interpreter and includes automated patching functionalities, enhancing usability for cybersecurity practitioners.

The PoCs-and-Exploits repository offers a collection of exploits authored by the creator, categorized into three main directories: personal CVEs, their own exploits for external vulnerabilities, and third-party exploits for quick reference. The tool is primarily used for sharing research findings in cybersecurity, with an emphasis on privacy and documentation quality. Notable features include the organization of exploits by authorship and a commitment to including comprehensive README files for each exploit to elucidate their mechanics and root causes.

Padre is an advanced tool designed for conducting Padding Oracle attacks against CBC mode encryption, enabling the decryption of tokens and encryption of arbitrary data. It features automatic fingerprinting of padding oracles, detection of cipher block lengths, and provides hints for overcoming failures during operations, all while supporting various encoding rules for enhanced flexibility. Particularly useful for security researchers and penetration testers, Padre can effectively exploit vulnerabilities to disclose encrypted session information or bypass authentication mechanisms.

The n8n-CVE-2025-68613-exploit tool demonstrates a critical Arbitrary Code Execution vulnerability in n8n's workflow expression evaluation system for versions prior to v1.122.0. This exploit allows authenticated users to execute arbitrary commands by manipulating user-defined expressions in workflows, exposing the underlying runtime to system-level access. Notable features include injectible payloads for executing commands and a step-by-step reproduction process for testing the vulnerability.

Multi-Client Reverse Shell is a tool designed for establishing multiple concurrent reverse shell connections from target machines to a listener, allowing for remote access and control. Notable features include an automatic persistence mechanism on Windows that disguises the backdoor as a regular file, as well as capabilities for file upload and download between the target and the hacker's listening server. The tool supports usage on both Linux and Windows platforms and is specifically designed to provide notifications for incoming connection requests from the targets.

Misanthro.py is a multi-threaded injection framework designed for aggressive testing of HTTP headers, cookies, and GET/POST parameters, specifically targeting blind injection vulnerabilities such as blind XSS. It features high-throughput payload delivery, authenticated session support, and customizable attack vectors, while not interpreting application responses. The tool is optimized for speed and scalability, allowing users to perform extensive injection testing with minimal configuration.

Mirage is an Android application designed to facilitate the auto-injection of shared objects into target processes using the hxo framework. Its primary use case is to enhance the functionality of applications, specifically within the context of Android environments, while supporting versions from Android 9 onwards. Key features include easy installation via an APK, developer support for customization, and a community-driven approach for real-time assistance and feedback.

Litefuzz is a multi-platform fuzzer designed to identify security-related bugs in userland binaries, clients, and servers across Linux, Mac, and Windows operating systems. Notable features include easy setup, support for both CLI and GUI applications, and capabilities for handling network communication, making it suitable for a wide range of testing scenarios. It emphasizes simplicity in discovering vulnerabilities rather than high performance or academic accolades.

The Laravel RCE Exploitation Toolkit is a set of Python scripts designed for identifying and exploiting Remote Code Execution (RCE) vulnerabilities in Laravel applications via exposed .env files and compromised APP_KEYs. The first script, rce.py, generates a malicious payload to execute arbitrary code on the target server by writing a backdoor, while the second script, envtobase64.py, scans for .env files to extract APP_KEYs for reconnaissance purposes. Notable features include automated backdoor creation, result logging, and easy integration with target lists.

The KSMBD-CVE-2025-37947 repository provides a proof-of-concept exploit targeting the out-of-bounds write vulnerability identified as CVE-2025-37947 in the ksmbd kernel server. Its primary use case is to demonstrate the exploitation of the vulnerability through various provided scripts and configuration files, including a BPF tracer and a minimal trigger. Notable features include a ready-to-use build system and a script to launch a testing environment using QEMU.