~/hackyfeed $

Zenith-Basic-RAT is a remote access tool (RAT) that operates through Discord, facilitating a range of post-exploitation actions with over 20 modules including system information retrieval, file management, and user monitoring. It is designed for educational purposes and features customizable executable names and session management to enhance stealth and functionality. Notable capabilities include password extraction, screen blocking, and the ability to execute commands remotely on the victim's machine.

XNU Image Fuzzer is a tool designed for fuzz testing Apple image decoding and re-encoding processes within CoreGraphics and ImageIO. It leverages multiple input modes to generate and parse images through various consumers, providing features such as bitmap-context permutations, ICC profile manipulation, and detailed metrics logging. The framework supports both native execution and deployment within Xcode for comprehensive testing and analysis of image handling on macOS and iOS platforms.

wphunter is a Python CLI tool designed for scanning WordPress plugins, themes, and core files for known CVE vulnerabilities, as well as detecting gambling spam injections (judol) and looking up public exploits. It operates both offline, using exported lists, and remotely via a URL, providing AI-powered analysis through Claude, including intelligent threat assessments and actionable remediation steps. Notable features include support for multiple vulnerability sources, comprehensive judol detection mechanisms, and version-aware matching to report relevant vulnerabilities based on the installed versions.

WPAxFuzz is a comprehensive Wi-Fi fuzzing tool designed to test vulnerabilities in the 802.11 protocol's management, control, and data frames, as well as the SAE exchange for WPA3 networks. It features different operating modes for frame size manipulation, the ability to execute fuzz tests against any access point supporting WPA2 or WPA3, and includes a Denial of Service (DoS) attack module that leverages the results of fuzzing. The tool can be executed via a simple command line and requires pre-installed dependencies like Scapy and aircrack-ng for optimal functionality.

WordPress Malware is a collection of malware samples sourced from compromised WordPress websites, organized by the date they were discovered. The repository includes custom PHP functions commonly used for malicious actions, such as file modification and execution of PHP code. This tool serves as a resource for developing malware detection solutions and is utilized by associated cPanel plugins for scanning and mitigating malware threats.

Vulristics is an extensible framework designed to analyze publicly available information on vulnerabilities, enabling classification and prioritization of CVEs using data sources such as Vulners.com, Microsoft, NVD, and AttackerKB. Initially developed for Microsoft Patch Tuesday reporting, it allows users to generate comprehensive reports for arbitrary CVE lists, custom profiles, and specific Microsoft Patch Tuesday events. Notable features include customizable report generation and integration of multiple vulnerability databases to facilitate a structured analysis process.

VulnParse-Pin is a post-scan intelligence and decision support engine designed to transform vulnerability scan findings into a prioritized and explainable remediation plan, focusing on real-world exploitability rather than just severity scores. It reduces vulnerability noise by up to 94% by incorporating factors such as Known-Exploited Risk (CISA KEV), real-world exploitation probability (EPSS), and exploit availability from public databases, thereby enabling more effective risk management. Notable features include normalization of data, enriched scoring models, and customizable prioritization based on actual threat signals.

TowerOfFlaws is a proof-of-concept tool that demonstrates vulnerabilities in the anti-cheat driver (`GameDriverX64.sys`) of the game Tower of Fantasy, specifically related to arbitrary process protection and termination. The tool allows users to bypass protections and terminate processes like `notepad.exe`, showcasing the vulnerabilities in a controlled environment. It requires a C++20 compiler and CMake for building, and emphasizes responsible usage in authorized contexts.

The Wagon Site is a versatile web application that aggregates a variety of tools, including exploits, bookmarklets, games, and proxies. It serves as a centralized platform for users seeking easy access to these resources, emphasizing functionality through a bookmarklet for streamlined launching. Notable features include a diverse array of tools and a community-driven approach with a dedicated Discord channel for user engagement.

sysnc is a bash wrapper around netcat designed for simplified remote command execution and interactive shell access, particularly on Android devices running Termux. Notably, it can exploit zygote injection (CVE-2024-31317) to establish a system-level shell, allowing for configurable command execution and interaction with a remote server. Key features include an interactive mode with a colored prompt, support for streaming scripts via stdin, and configurable options for host, port, and UID through command-line flags or environment variables.

Sub-Ringan Framework is an automated bug hunting tool tailored for identifying vulnerabilities in web applications, primarily aimed at bug bounty hunters and cybersecurity professionals. Its notable features include comprehensive subdomain discovery, live URL scanning, detection of XSS, SSRF, SQL injection, and LFI vulnerabilities, along with the ability to efficiently organize target files for enhanced workflow.

SQLMap Skynet is an AI-assisted tool that enhances the SQLMap functionality by providing a structured, autonomous workflow for SQL injection testing, complemented by a real-time dashboard and MCP tool server for agent automation. Notable features include operational phases for detecting, bypassing, enumerating, and dumping vulnerabilities, as well as autonomous AI tuning and a memory system that learns from past successes to improve future scans. This tool is optimized for both Windows and Linux servers, operating in a headless mode without a GUI, making it suitable for automated security testing environments.

Sni5Gect is a comprehensive framework designed for sniffing unencrypted 5G NR messages and injecting custom packets during over-the-air communication between base stations and User Equipment (UE). It is primarily used for security research to conduct various attacks, such as crashing UE modems, downgrading network technologies, and implementing device fingerprinting and authentication bypass tactics. Notable features include the ability to capture MAC-NR messages and send arbitrary messages to target devices during specific communication states, enabling detailed exploitation of 5G networks.

The SNEK Blue War Hammer is a research tool that facilitates the exploration of Windows Defender's update mechanisms and potential vulnerabilities through sophisticated Windows API interactions. It is primarily aimed at security researchers and system administrators for educational purposes, implementing advanced features such as RPC communication, COM interfaces, VSS manipulation, and kernel-level file system operations. Notably, it allows for the extraction and analysis of Defender update packages directly from Microsoft, highlighting attack vectors associated with file access controls during the update process.

scap-rs is a Rust library designed for interacting with the National Vulnerability Database, encompassing various modules such as CVSS, CVE, CPE, and CWE, which facilitate vulnerability scoring, disclosure, platform enumeration, and weakness classification. Its primary use case provides developers with tools to access and manipulate vulnerability data, enabling better security posture management. Notable features include support for multiple vulnerability-related standards and well-documented APIs for ease of integration.

The Samsung S25 Vulnerability Research repository provides tools and scripts for exploiting vulnerabilities in the Samsung Galaxy S25, specifically focusing on a one-click remote code execution (RCE) exploit and a method for arbitrary APK installation. Notable features include the `1click-rce` tool for RCE exploitation and the `local-apk-install` script for generating APK signatures, accompanied by detailed instructions for each. This resource is primarily aimed at cybersecurity researchers and enthusiasts investigating mobile device security.

ropcatalog is a Python tool designed for parsing, classifying, and browsing ROP (Return-Oriented Programming) gadgets from rp++ output files, primarily aiding in Windows exploit development. It features an interactive REPL with extensive search options, ASLR support for dynamic address adjustments, bad character filtering to enhance exploit reliability, and multiple output formats for easy integration into exploit code. The tool is tailored for users engaged in ROP chain construction and binary exploitation tasks.

pwnkit is an exploitation toolkit designed for pwn CTFs and Linux binary exploitation research. It provides a suite of features including exploit templates, I/O helpers, ROP gadget mappers, and various utilities for crafting and executing exploits, making it ideal for both novice and experienced exploit developers. Notable features include customizable templates, integration with gdb helper scripts, and the ability to operate as a CLI tool or Python API.

The `pub` repository contains a collection of proof-of-concept (PoC) exploits and tools designed to demonstrate vulnerabilities disclosed by the author, tintinweb. Its primary use case is to aid security researchers and developers in understanding and testing these vulnerabilities. Notable features include a structured directory of PoCs and integrated GPG public key for secure communications.

Prober is a pentesting framework designed to simplify the management of GitHub repositories by eliminating the complexities of git submodules. Its primary use case is to allow penetration testers to easily download and clone necessary tools with straightforward commands, enhancing usability in security assessments. Notable features include a clean execution script and a focus on user-friendly setup processes.

The postexploitation-toolbox-android is a specialized toolkit for executing post-exploitation techniques on Android devices, particularly designed for Android 14 on the Samsung S21 Ultra. It leverages CVE-2024-34740 to allow code injection into system processes, enabling features such as temporary app debuggability, system-wide permission bypassing, and dynamic resource editing, while providing a user-friendly interface for manipulating system service internals through Java reflection.

This repository provides a proof-of-concept for CVE-2025-55182, a critical pre-authentication remote code execution vulnerability found in specific versions of React Server Components. The vulnerability enables unauthenticated attackers to execute arbitrary JavaScript code on the server by exploiting unsafe deserialization through prototype chain traversal in the Flight protocol. Notably, the tool facilitates demonstration of the exploit process, requiring a vulnerable React setup and tools like Burp Suite for payload delivery and testing.

Pentagram-exploit-tester is a utility designed to assess whether a device running iOS 15.0 to 15.1.1 and 15.2 BETA 1 is vulnerable to CVE-2021-30955, facilitating compatibility with jailbreak exploits. The tool informs users of their device's status regarding this vulnerability, advising against updates if the device is vulnerable. Notably, the tool allows for multiple testing attempts in case of transient errors during execution.

Padoracle is a Node.js tool designed to perform Padding Oracle Attacks, allowing users to crack plaintext from encrypted data using a known initialization vector (IV) and ciphertext. Its notable features include a user-friendly command-line interface (CLI), robust API support, the ability to generate IV and ciphertext with modified plaintext, and an ultra-fast cracking capability with unlimited concurrency. This tool is particularly useful for security researchers and professionals looking to exploit vulnerabilities in web applications utilizing padding oracle patterns.

OnlyShell is a Go-based reverse shell handler designed for penetration testers and security researchers, enabling the management of multiple reverse shell connections concurrently. Key features include automatic shell type detection, background shell management, command broadcasting across active shells, and the option for encrypted communications with TLS support. The tool offers an intuitive command-line interface and allows for real-time interaction and status monitoring of all connected sessions.