Pentesting

Monkey365 is an open-source security assessment tool for Microsoft 365, Azure, and Microsoft Entra ID. It helps security professionals identify misconfigurations, review cloud security posture, and evaluate environments against industry security best practices and compliance standards.

CVE-2026-43499 (GhostLock) exploit for ASUS Zenfone 9 (SM8475, GKI 5.10.205) + KernelSU late-load.

PoC for PUBG's anti-cheat Zakynthos's rootkit navagio.sys

CVE-2026-43682: HFS+ B-tree kernel heap overflow in macOS

Production-grade XXE scanner that combines statistical baselining, differential parser fingerprinting, and OOB confirmation to find what naive scanners miss. 30+ attack techniques, credential extraction with paste-ready exploit snippets, and CI/CD-ready SARIF output.

Red Team C2

CVE-2026-79417 PoC

Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when an admin views the post and drops a self deleting webshell. Full chain PoC with scanner interactive shell Nuclei template and Docker

Day-by-day study plans for eight Hack The Box certs: CJCA, CPTS, CWES, CWEE, CDSA, CAPE, CWPE and COAE. Pick a cert and how many hours a week you have, then check off tasks. Each tracker is one HTML file you can use online or download and run offline. Not affiliated with HTB.

Automated adversary emulation (Caldera) against an AD lab to validate Sigma detection coverage and map results to MITRE ATT&CK.

CVE-2026-12227 (CVSS 9.8): WordPress Visual Composer Website Builder ≤45.16.0 — unauthenticated local file inclusion via vcv-template. Educational PoC only.

Snaffler in Python

an analysis of mirax found in the wild. User claims they received it during a Prolific.com study

Agent-Native multi-platform reverse engineering and CWE-602 client-side authorization audit workbench.

Analysis of cryptographic routines found within "Perenio Smart: Home and Office" Android application, as well as reconstructing Perenio Peifc01 IP camera's RTP over UDP video stream from a Wireshark packet capture

Edge Credential Dumper

Hands-on AI Agent Red-Teaming & Security Engineering Labs