​📦 GitHub 全球红队渗透资源中转站。
​旨在收录那些“好用却难找”的安全项目。
🔗 定时推送：GitHub Trending (Security)
🛠 必备清单：后渗透、远控、免杀、提权工具集
📅 更新频率：每日精选，绝不灌水。
​⚠️ 本频道仅供安全研究与授权测试使用。
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：Scans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
URL：https://github.com/zach115th/ToolShellFinder

标签：#CVE-2025
GitHub
GitHub - zach115th/ToolShellFinder: Scans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
GitHub - zach115th/ToolShellFinder: Scans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771
Scans Windows IIS logs for signs of CVE-2025-53770 & CVE-2025-53771 - zach115th/ToolShellFinder
CVE
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：Public Disclosure: CVE-2025-54554 – Unauthenticated Access in tiaudit REST API leading to Sensitive Information Disclosure
URL：https://github.com/Aman-Parmar/CVE-2025-54554

标签：#CVE-2025
GitHub
GitHub - Aman-Parmar/CVE-2025-54554: CVE-2025-54554 – Unauthenticated Access in tiaudit REST API leading to Sensitive Information…
GitHub - Aman-Parmar/CVE-2025-54554: CVE-2025-54554 – Unauthenticated Access in tiaudit REST API leading to Sensitive Information…
CVE-2025-54554 – Unauthenticated Access in tiaudit REST API leading to Sensitive Information Disclosure - Aman-Parmar/CVE-2025-54554
CVE
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：Exploit for CVE-2025-32429 – SQLi in XWiki REST API (getdeleteddocuments.vm).
URL：https://github.com/byteReaper77/CVE-2025-32429

标签：#CVE-2025
GitHub
GitHub - byteReaper77/CVE-2025-32429: Exploit for CVE-2025-32429 – SQLi in XWiki REST API (getdeleteddocuments.vm).
GitHub - byteReaper77/CVE-2025-32429: Exploit for CVE-2025-32429 – SQLi in XWiki REST API (getdeleteddocuments.vm).
Exploit for CVE-2025-32429 – SQLi in XWiki REST API (getdeleteddocuments.vm). - byteReaper77/CVE-2025-32429
CVE
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：Honeypot for CVE-2025-53770 aka ToolShell
URL：https://github.com/a-hydrae/ToolShell-Honeypot

标签：#CVE-2025
GitHub
GitHub - a-hydrae/ToolShell-Honeypot: Honeypot for CVE-2025-53770 aka ToolShell
GitHub - a-hydrae/ToolShell-Honeypot: Honeypot for CVE-2025-53770 aka ToolShell
Honeypot for CVE-2025-53770 aka ToolShell. Contribute to a-hydrae/ToolShell-Honeypot development by creating an account on GitHub.
CVE
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：CVE-2025-53652: Jenkins Git Parameter Analysis
URL：https://github.com/pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis

标签：#CVE-2025
GitHub
GitHub - pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis: CVE-2025-53652: Jenkins Git Parameter Analysis
GitHub - pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis: CVE-2025-53652: Jenkins Git Parameter Analysis
CVE-2025-53652: Jenkins Git Parameter Analysis. Contribute to pl4tyz/CVE-2025-53652-Jenkins-Git-Parameter-Analysis development by creating an account on GitHub.
CVE
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：Detection for CVE-2025-52914
URL：https://github.com/rxerium/CVE-2025-52914

标签：#CVE-2025
GitHub
GitHub - rxerium/CVE-2025-52914: Detection for CVE-2025-52914
GitHub - rxerium/CVE-2025-52914: Detection for CVE-2025-52914
Detection for CVE-2025-52914. Contribute to rxerium/CVE-2025-52914 development by creating an account on GitHub.
CVE
GitHub监控消息提醒！！！

更新了：RCE
描述：Malicious Maven pom.xml that uses \"groovy-maven-plugin\" to get RCE
URL：https://github.com/mbadanoiu/mvn_pwn

标签：#RCE
GitHub
GitHub - mbadanoiu/mvn_pwn: Malicious Maven pom.xml that uses
GitHub - mbadanoiu/mvn_pwn: Malicious Maven pom.xml that uses "groovy-maven-plugin" to get RCE
Malicious Maven pom.xml that uses "groovy-maven-plugin" to get RCE - mbadanoiu/mvn_pwn
RCE
GitHub监控消息提醒！！！

更新了：信息收集
描述：Whois_Google_Plugin 是一款为安全研究员、红队人员和渗透测试工程师设计的 Chrome 浏览器插件，能够在访问目标站点时自动提取当前网页的域名，并实时查询其 Whois 信息（包括注册时间、到期时间、注册商、联系方式等）。 该插件可用于信息收集阶段（Reconnaissance），为目标资产分析提供第一手域名情报。
URL：https://github.com/Maikefee/Whois_Google_Plugin

标签：#信息收集
GitHub
GitHub - Maikefee/Whois_Google_Plugin: Whois_Google_Plugin 是一款为安全研究员、红队人员和渗透测试工程师设计的 Chrome 浏览器插件，能够在访问目标站点时自动提取当前网页的域名，并实时查询其…
Whois_Google_Plugin 是一款为安全研究员、红队人员和渗透测试工程师设计的 Chrome 浏览器插件，能够在访问目标站点时自动提取当前网页的域名，并实时查询其 Whois 信息（包括注册时间、到期时间、注册商、联系方式等）。 该插件可用于信息收集阶段（Reconnaissance），为目标资产分析提供第一手域名情报。 - Maikefee/Whois_Google_Plugin
信息收集
GitHub监控消息提醒！！！

更新了：RCE
描述：In this write up, we will go over reverse engineering and exploiting a vulnerable MIPS OpenWRT router in order to get RCE and a reverse shell.
URL：https://github.com/Archan6el/OpenWRT-Router-Exploit-RCE-Writeup

标签：#RCE
GitHub
GitHub - Archan6el/OpenWRT-Router-Exploit-RCE-Writeup: In this write up, we will go over reverse engineering and exploiting a vulnerable…
GitHub - Archan6el/OpenWRT-Router-Exploit-RCE-Writeup: In this write up, we will go over reverse engineering and exploiting a vulnerable…
In this write up, we will go over reverse engineering and exploiting a vulnerable MIPS OpenWRT router in order to get RCE and a reverse shell. - Archan6el/OpenWRT-Router-Exploit-RCE-Writeup
RCE
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：CVE-2025-6018 Poc and Exploit
URL：https://github.com/ibrahmsql/CVE-2025-6018

标签：#CVE-2025
GitHub
GitHub - ibrahmsql/CVE-2025-6018: CVE-2025-6018 Poc and Exploit
GitHub - ibrahmsql/CVE-2025-6018: CVE-2025-6018 Poc and Exploit
CVE-2025-6018 Poc and Exploit . Contribute to ibrahmsql/CVE-2025-6018 development by creating an account on GitHub.
CVE
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：CVE-2025-6018 Poc and Exploit
URL：https://github.com/ibrahmsql/CVE-2025-6018-

标签：#CVE-2025
CVE
GitHub监控消息提醒！！！

更新了：RCE
描述：PoC exploit and vulnerable server demo for CVE-2025-1302 in jsonpath-plus.
URL：https://github.com/DAVIDAROCA27/CVE-2024-23346-exploit

标签：#RCE
GitHub
GitHub - DAVIDAROCA27/CVE-2024-23346-exploit: This is a exploit for the known Remote Code Execution (RCE) vulnerability in the…
GitHub - DAVIDAROCA27/CVE-2024-23346-exploit: This is a exploit for the known Remote Code Execution (RCE) vulnerability in the…
This is a exploit for the known Remote Code Execution (RCE) vulnerability in the `pymatgen` (CVE-2024-23346) Python library by uploading a malicious `CIF` file to the hosted `CIF Analyzer` website ...
RCE
GitHub监控消息提醒！！！

更新了：RCE
描述：PoC exploit and vulnerable server demo for CVE-2025-1302 in jsonpath-plus.
URL：https://github.com/abrewer251/CVE-2025-1302_jsonpath-plus_RCE

标签：#RCE
GitHub
GitHub - abrewer251/CVE-2025-1302_jsonpath-plus_RCE: PoC exploit and vulnerable server demo for CVE-2025-1302 in jsonpath-plus.
GitHub - abrewer251/CVE-2025-1302_jsonpath-plus_RCE: PoC exploit and vulnerable server demo for CVE-2025-1302 in jsonpath-plus.
PoC exploit and vulnerable server demo for CVE-2025-1302 in jsonpath-plus. - abrewer251/CVE-2025-1302_jsonpath-plus_RCE
RCE
GitHub监控消息提醒！！！

更新了：代码审计
描述：URLFinder是一款使用 Go 语言编写的高性能网络爬虫和安全侦察工具，专为渗透测试人员、安全研究员和代码审计人员设计。它能深度爬取目标网站，智能发现隐藏的URL、API接口，并能从前端代码（特别是JavaScript文件）中精准地提取各类高价值的敏感信息。
URL：https://github.com/LFenX/-

标签：#代码审计
GitHub
GitHub - LFenX/-: 我每天写 Markdown 式 To-Do 日记，结果月底想盘点时间分配、计划完成度时，被一堆文字整崩：没法统计、没法对比。于是我写了这个脚本：自动读 Yesterday / Plan / Actual 三段清单，解…
我每天写 Markdown 式 To-Do 日记，结果月底想盘点时间分配、计划完成度时，被一堆文字整崩：没法统计、没法对比。于是我写了这个脚本：自动读 Yesterday / Plan / Actual 三段清单，解析时间段、标签和完成标记，直接写进 MySQL。点一下就能生成报表——今天写代码几小时？运动坚持了没？计划执行率多少？全部一目了然，还能按标签做多维度分析。如果你也想保留随手记笔...
代码审计
GitHub监控消息提醒！！！

更新了：渗透测试
描述：由山东大学“fl4g”团队开发的一站式网络安全实训平台。平台集成渗透测试靶场、文件加解密、漏洞复现三大模块，采用 Vue + SpringBoot 前后端分离架构，支持在线攻防演练、实时 WebSocket 互动、Redis 高速缓存与 ECharts 可视化分析。只需一键启动，即可在本地快速拉起完整的红蓝对抗环境，为课程教学、CTF 培训与企业安全演练提供高效、直观、可扩展的解决方案。
URL：https://github.com/2023cghacker/Cyber-Security-Range-Platform

标签：#渗透测试
GitHub
GitHub - 2023cghacker/Cyber-Security-Range-Platform: 由山东大学“fl4g”团队开发的一站式网络安全实训平台。平台集成渗透测试靶场、文件加解密、漏洞复现三大模块，采用 Vue + SpringBoot…
GitHub - 2023cghacker/Cyber-Security-Range-Platform: 由山东大学“fl4g”团队开发的一站式网络安全实训平台。平台集成渗透测试靶场、文件加解密、漏洞复现三大模块，采用 Vue + SpringBoot…
由山东大学“fl4g”团队开发的一站式网络安全实训平台。平台集成渗透测试靶场、文件加解密、漏洞复现三大模块，采用 Vue + SpringBoot 前后端分离架构，支持在线攻防演练、实时 WebSocket 互动、Redis 高速缓存与 ECharts 可视化分析。只需一键启动，即可在本地快速拉起完整的红蓝对抗环境，为课程教学、CTF 培训与企业安全演练提供高效、直观、可扩展的解决方案。 -...
渗透测试
GitHub监控消息提醒！！！

更新了：内网渗透
描述：内网、域渗透、内网案例、内网靶场
URL：https://github.com/maybeyjb/in-web

标签：#内网渗透
GitHub
GitHub - maybeyjb/in-web: 内网、域渗透、免杀、内网靶场、权限维持
GitHub - maybeyjb/in-web: 内网、域渗透、免杀、内网靶场、权限维持
内网、域渗透、免杀、内网靶场、权限维持. Contribute to maybeyjb/in-web development by creating an account on GitHub.
内网渗透
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：Detection rules for CVE-2025-53770
URL：https://github.com/nisargsuthar/suricata-rule-CVE-2025-53770

标签：#CVE-2025
GitHub
GitHub - nisargsuthar/suricata-rule-CVE-2025-53770: Detection rules for CVE-2025-53770
GitHub - nisargsuthar/suricata-rule-CVE-2025-53770: Detection rules for CVE-2025-53770
Detection rules for CVE-2025-53770. Contribute to nisargsuthar/suricata-rule-CVE-2025-53770 development by creating an account on GitHub.
CVE
GitHub监控消息提醒！！！

更新了：Cobalt Strike
描述：A WebGui Management tool for CS-EXTC2-* (Cobalt Strike External C2) Protocols. Simplifies the compilation & running of controllers, and payloads.
URL：https://github.com/ryanq47/CS-EXTC2-HUB

标签：#Cobalt Strike
GitHub
GitHub - ryanq47/CS-EXTC2-HUB: A WebGui Management tool for CS-EXTC2-* (Cobalt Strike External C2) Protocols. Simplifies the compilation…
GitHub - ryanq47/CS-EXTC2-HUB: A WebGui Management tool for CS-EXTC2-* (Cobalt Strike External C2) Protocols. Simplifies the compilation…
A WebGui Management tool for CS-EXTC2-* (Cobalt Strike External C2) Protocols. Simplifies the compilation & running of controllers, and payloads. - ryanq47/CS-EXTC2-HUB
Cobalt
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：Mezzanine CMS 6.1.0 XSS (CVE-2025-50481)
URL：https://github.com/exfil0/CVE-2025-53770

标签：#CVE-2025
GitHub
GitHub - exfil0/CVE-2025-53770: A sophisticated, wizard-driven Python exploit tool targeting CVE-2025-53770, a critical (CVSS 9.8)…
GitHub - exfil0/CVE-2025-53770: A sophisticated, wizard-driven Python exploit tool targeting CVE-2025-53770, a critical (CVSS 9.8)…
A sophisticated, wizard-driven Python exploit tool targeting CVE-2025-53770, a critical (CVSS 9.8) unauthenticated remote code execution (RCE) vulnerability in on-premises Microsoft SharePoint Serv...
CVE
GitHub监控消息提醒！！！

更新了：CVE-2025
描述：PoC exploit for CVE-2025-7766 – XXE vulnerability leading to potential RCE.
URL：https://github.com/byteReaper77/CVE-2025-7766

标签：#CVE-2025
GitHub
GitHub - byteReaper77/CVE-2025-7766: PoC exploit for CVE-2025-7766 – XXE vulnerability leading to potential RCE.
GitHub - byteReaper77/CVE-2025-7766: PoC exploit for CVE-2025-7766 – XXE vulnerability leading to potential RCE.
PoC exploit for CVE-2025-7766 – XXE vulnerability leading to potential RCE. - byteReaper77/CVE-2025-7766
CVE
Before
After
Back to Top