~/hackyfeed $

iOS Shortcuts Exploits is a repository that catalogs a variety of exploits and unusual behaviors associated with iOS shortcuts, emphasizing vulnerabilities that can be used for memory overloading and crashing applications. Key features include detailed explanations and proofs of concept for various exploits, such as the wallpaper switching action that can overload memory, alongside methods to trigger system-level issues and manipulate functionality like dark/light mode transitions. It serves as a unique resource for understanding and leveraging specific weaknesses within the iOS shortcuts framework.

HackingAllTheThings is a curated repository of cybersecurity tools and notes, aimed at supporting the archiving and study of various IT security certifications. It includes both original tools developed by the author and additional resources collected from diverse sources, thereby providing a structured approach to cybersecurity learning and practice.

grafanaExp is a tool designed to exploit the CVE-2021-43798 vulnerability in Grafana, enabling automated detection of vulnerable instances, extraction of keys, and decryption of server database files. Its primary use case is to assist in the security assessment of Grafana installations by providing the capability to reveal sensitive configuration data and datasource information. Notable features include an 'exp' command for vulnerability detection and information retrieval, and a 'decode' command for local decryption of large database files.

The googlephotos-filestorage tool is a Java application that enables the steganographic encoding of files into image data for upload to Google Photos. Its primary use case is to allow users to exploit Google Photos' former unlimited storage policy by converting files into images, thus facilitating file storage and retrieval. Notable features include encoding file data into the RGB channels of pixels, with the ability to expand storage capacity by utilizing the alpha channel.

ExploitAddr is a reconnaissance tool primarily designed to uncover the real IP addresses of websites obscured by Cloudflare, as well as identifying any associated domains and server details. Key features include multi-IP detection, sorting by software vendor, fast searching with threading, and status code checks for domains. Users must provide a Censys API key for functionality.

The tool exploits a command injection vulnerability in the pdfkit Ruby gem, specifically in versions prior to 0.8.7.2, allowing attackers to execute arbitrary commands through specially crafted URLs. Key features include custom command generation and reverse shell capabilities, providing flexibility for targeting vulnerable web applications. The exploit serves solely for educational and authorized security research purposes.

This tool is an exploit for the vulnerable Windows kernel driver eneio64.sys, enabling the mapping of physical memory read/write operations to virtual memory read/write. It demonstrates how to leverage this vulnerability for privilege escalation via token theft, targeting Windows 11 versions, specifically builds 22H2, 23H2, and 24H2. The exploit also outlines the necessary offsets for different Windows versions and serves as an educational resource.

Domaineer is a semi-automated bot designed to extract data from domains, facilitating domain analysis and intelligence gathering. It supports multiple platforms, including Linux, Windows, and Android, and can be easily installed via Python dependencies. The tool is currently under maintenance for enhancements, with plans to transition to a desktop application using PyQT and Golang.

Defcon Arsenal Tools (DArT) is a curated repository designed to provide security professionals with a comprehensive collection of tools, scripts, and resources for various cybersecurity tasks, including network scanning, vulnerability assessment, and exploit development. Notable features include organized categories for tools based on specific functions, such as credential scanning, network attacks, and malware research, facilitating quick access to relevant resources for users within the DEFCON community. The project emphasizes educational use and knowledge sharing, promoting responsible application in security practices.

DEDSEC_CLICKFIX2 is a Linux-based social engineering tool that employs the ClickFix attack to deploy malware through a deceptive software activation interface. It features customizable malicious payload links, a realistic URL masking system, and integrated tunneling for remote access, while also attempting to disable security measures to ensure stealthy execution of its payload. The tool is designed for penetration testing and educational purposes, leveraging user trust to facilitate the delivery of malicious software effectively.

The illusionsec Archive is a comprehensive collection of Distributed Denial of Service (DDoS) tools, scanners, and botnet resources tailored for cybersecurity professionals and researchers. It features multiple versions of notable botnets, such as Mirai and QBot, alongside vulnerability exploits, various attack methods (Layer 4, Layer 7, UDP, TCP), and additional utilities for bot compilation and command/control management. This archive serves as an extensive toolkit for testing and analyzing DDoS attack methodologies and their defensive countermeasures.

The pwnfuzz/cve-pocs repository provides a collection of proof-of-concept (PoC) exploits for various CVEs, intended for educational and security testing purposes. Each exploit is organized by vulnerability, featuring specific scripts or research artifacts aimed at demonstrating the security flaws. Notably, the repository includes detailed links to individual exploits for different vulnerabilities, offering structured access for security professionals.

The CVE-2025-8088 WinRAR path traversal tool is a Python script designed to exploit a path traversal vulnerability found in WinRAR, facilitating the creation of malicious archives that deploy payloads to the Windows startup folder. Notable features include the ability to create customizable decoy files, employ alternate data streams (ADS) for payload concealment, and modify archive structures to ensure reliable execution. This tool serves primarily as an educational resource for cybersecurity testing within controlled environments.

CVE-2025-68613-POC is a Python-based proof-of-concept tool designed to demonstrate a critical Remote Code Execution (RCE) vulnerability in the n8n workflow automation platform. It includes a scanner for non-destructive detection of vulnerable instances and a Nuclei template for automated testing of expression injection capabilities, both facilitating the assessment of affected versions and helping security professionals identify potential exploits safely. Notably, it emphasizes the ability to interact with Node.js global contexts to validate vulnerability exploitation scenarios.

The CVE-2025-66516-Writeup-POC repository provides a detailed analysis and proof of concept for a critical XML External Entity (XXE) injection vulnerability in Apache Tika, with a CVSS score of 10.0. This vulnerability enables remote attackers to exploit specially crafted PDF documents to read arbitrary files and exfiltrate sensitive information. Notable features include specific details on affected versions, the technical breakdown of the vulnerability, and instructions for testing in a controlled environment.

CVE-2025-59287 refers to a critical unauthenticated remote code execution vulnerability in Windows Server Update Services (WSUS) that can be exploited through unsafe deserialization of attacker-controlled data. The tool illustrates how attackers can leverage this vulnerability via crafted `AuthorizationCookie` payloads to gain SYSTEM-level access on the server, enabling them to deploy malicious updates and pivot within corporate networks. Immediate patching is emphasized, along with recommendations for temporary isolation and detection measures against exploitation attempts.

The CVE-2025-59287-PoC tool serves as a proof-of-concept for exploiting vulnerabilities in Windows Server Update Services (WSUS), specifically targeting CVE-2025-59287 and CVE-2023-35317. Its primary use case is academic research and defense technique development, allowing users to initiate Remote Code Execution (RCE) by sending crafted SOAP requests to vulnerable WSUS servers. Notable features include customizable payloads, the ability to generate random client DNS names, and verbose debug logging for detailed operation insights.

The CVE-2025-59287 tool is an automated exploit designed to target a critical unauthenticated remote code execution vulnerability in Windows Server Update Services (WSUS). Its primary use case is to facilitate the exploitation of this vulnerability with minimal user intervention, offering features such as payload generation, built-in reverse shell capabilities, cross-platform compatibility, and AES encryption. The tool also includes dependencies auto-management and can be run across multiple operating systems, ensuring ease of use for penetration testers and security researchers.

The CVE-2025-55182 Scanner & Exploiter tool is designed to detect and exploit a critical remote code execution vulnerability in specific versions of React Server Components. It features detection capabilities for scanning single or multiple targets, as well as an exploitation mode that provides an interactive shell and options for reverse shell execution. The tool supports proxy usage and allows for multi-threaded scanning to enhance performance.

CVE-2025-54253 is a critical vulnerability affecting Adobe Experience Manager (AEM) Forms on JEE versions ≤ 6.5.23.0, enabling unauthenticated remote code execution through misconfigured Struts/OGNL endpoints. This tool primarily assists penetration testers and defenders in identifying and mitigating risks associated with this vulnerability, emphasizing proactive patching, threat hunting, and implementing hardened configurations. Notable features include a structured testing checklist for AEM environments, methods for validating configurations, and logging techniques for identifying exploitation attempts.

The CVE-2025-40634 tool serves to exploit a stack-based buffer overflow vulnerability in the TP-Link Archer AX50 router, specifically in its firmware version 1.0.14 Build 20240108 rel.42655(4555). The primary use case is to enable remote code execution capabilities both from the local network (LAN) and the wider internet (WAN) by manipulating DNS response packets. Notably, the tool revisits a vulnerability with a similar root cause to CVE-2020-10881, requiring a custom exploit due to differing exploitation processes.

The CVE-2025-32463_chwoot repository provides a proof-of-concept implementation to demonstrate the privilege-escalation vulnerability in the chroot feature of vulnerable versions of `sudo`. It includes a Docker environment to build and run an exploit that showcases how to gain root access in affected systems. Notable features include a Dockerfile for setting up the environment and a script that facilitates the execution of the exploit inside a container.

CVE-2025-32463 is a privilege escalation exploit targeting vulnerable versions of sudo (1.9.14 to 1.9.17) that allows attackers to gain root access without requiring gcc to be installed on the target system. The tool includes pre-compiled payloads for various architectures, directly executing an exploit via scripts, making it notably convenient for users who may lack compilation tools. This exploit is intended solely for educational and authorized testing purposes.

The CVE-2025-31702 repository provides a collection of tools, exploits, and research artifacts aimed at analyzing and addressing vulnerabilities associated with CVE-2025-31702, particularly in relation to P2P/Easy4IP exposure and auto-update inconsistencies. Its primary use case is to equip defenders with auditable utilities for validating deployments, while also offering detection strategies and mitigation guidance for SOC and IR teams. Notable features include lab scripts, parsers, and comprehensive documentation of research and proof-of-concept efforts for enhanced operational transparency.

The tool showcases a proof-of-concept (PoC) for exploiting the NTLM hash leak vulnerability identified as CVE-2025-24054 through malicious `.library-ms` files. Its primary use case is for educational and research purposes, allowing security professionals to demonstrate how NTLMv2 hashes can be extracted by triggering SMB authentication requests on unpatched Windows systems. Notable features include a script for generating the malicious file, instructions for setting up a fake SMB server using Responder, and a sample file configured to facilitate the attack.