WP-Shell3r v0.2 — WordPress Shell Uploader

✓ Plugin/Direct/File Manager upload
✓ WAF & verification bypass
✓ Auto admin creation
✓ Async GUI + retry system

Site format: site#user@pass | site|user|pass

Trial version : here

Price : $70 / blackscriptx
📩 @Moonlightcrow
⚠️ Authorized use only

Trial version for WP-Shell3r

⚡️ SMTP Sentinel — High-performance async SMTP tester with real-time WebSocket dashboard. Test thousands of credentials simultaneously, track live progress, visualize results with interactive charts & export to CSV. Built with FastAPI + aiosmtplib. Fast, sleek & powerful.
🔥 Features:
• Async testing (up to 200 concurrent)
• Real-time WebSocket updates
• Beautiful dark-themed UI
• CSV export with timestamps
• Auto SSL/TLS detection
Perfect for security testing & bulk SMTP validation.

install modules: pip install fastapi aiosmtplib uvicorn

Download Link : Here

WP Bruter
——————
Fast WordPress credential scanner.

FEATURES
• Auto-detects XML-RPC & wp-login attack surface
• Enumerates real usernames per site
• Smart password expansion — [user], [domain] tokens
• Built-in combos tried automatically (admin@admin, domain+user, etc.)
• High concurrency — scan hundreds of sites simultaneously
• Early exit on first hit — no wasted attempts
• Clean result files — hits saved instantly

HOW TO USE
1. Prepare site.txt — one URL per line
2. Prepare pass.txt — one password per line
3. Run wp-bruter.exe
4. Enter your files and concurrency when prompted
5. Check result\ folder for hits

RESULT FILES
result\wp-brute.txt — XML-RPC hits
result\wp-login.txt — wp-login hits
result\wordpress.txt — confirmed WP sites

PASSWORD TOKENS
[user] → replaced with the site's real username
[domain] → replaced with domain parts (example, shop, …)
Example: [domain]@[user] → shop@admin

Telegram: https://t.me/Moonlightcrow
Download : WP-BRUTER

Join Our Official Group : https://t.me/+8hAW5FyWh6NmZmRl

WP-Shell3r v0.3

WP-Shell3r v0.3 — WordPress Shell Uploader

✓ Plugin / Direct / File Manager / Plugin Editor upload
✓ WAF & email verification bypass
✓ Auto admin creation
✓ Async GUI + retry system
✓ Multi-format site list support

━━━━━━━━━━━━━━━━━━━━
📋 Site List Formats
━━━━━━━━━━━━━━━━━━━━
site|user|pass
site:user:pass
site;user;pass
site/wp-login.php:user:pass
site/wp-login.php#user@pass

• http:// optional — auto-added
• Duplicates removed automatically
• Encodings: UTF-8 / Latin-1 / CP1252

Trial version : here
━━━━━━━━━━━━━━━━━━━━
💰 Price: DM
🛒 @blackscriptx
📩 Contact: @Moonlightcrow
━━━━━━━━━━━━━━━━━━━━
⚠️ For authorized penetration testing only

● 📬 Mailer Tester — by Who Knows

Mass-test your Leaf PHPMailer panels in seconds.

✅ Paste 100s of mailer URLs — tested concurrently
📊 Live stats: Done / Left / OK / Failed in real time
⚡️ Progress bar updates as each result comes in
⏹️ Stop anytime with one click
🌐 Clean web UI — runs locally on your machine

Built with Python (FastAPI) + Chrome TLS impersonation
so servers can't fingerprint-block the requests.

How to run:
pip install -r requirements.txt
python main.py
→ open http://localhost:8765

Link : here

🔗 https://t.me/Moonlightcrow

🚀 xLeet Shell Uploader v3.0

GUI tool for mass-uploading shells to xLeet

Features:
• 🍪 JSON Cookie Loader — paste exported browser cookies, tokens auto-extracted
• ⚡️ Multi-threaded uploads — configurable worker count (1–20)
• 💰 Price control — set min/max range or randomize per shell
• 🔄 Auto-retry — exponential backoff, skips 4xx auth errors instantly
• ⚙️ Persistent settings — URL, tokens, performance saved between sessions
• 🛑 Clean stop — non-blocking cancel, saves progress
• 📊 Live stats — success / failed / remaining counters
• 🔧 Configurable domain — change target URL without editing code



pip install PySide6 requests brotli

@Moonlightcrow

🔥 CVE-2026-48907 — JCE Joomla Unauthenticated RCE Scanner

Exploit for the JCE (JoomlaContentEditor) plugin remote code execution vulnerability.


⚙️ Features:
• Async engine (aiohttp) — high concurrency, low overhead
• Auto CSRF token extraction
• Multi-payload strategy (direct .php + GIF rename bypass)
• Only saves CONFIRMED shells (PHP code actually executes)
• Results saved to: joom-shell.txt

📌 Usage:
pip install aiohttp aiofiles colorama
python CVE-2026-48907.py
→ Enter targets file & concurrency

=> Who Knows
📢 Channel : https://t.me/Moonlightcrow

For educational and authorized testing only.

Adminer 5.4.2 — MSSQL TraceFile RCE

━━━ VULNERABILITY ━━━
Adminer 5.4.2 MSSQL driver passes auth[server]
directly into the PDO DSN. Semicolon-delimited
options are parsed by ODBC — injecting:
TraceFile=up.php;TraceOn=1
causes ODBC to write a trace file to webroot.
auth[username] lands as UID={<value>} in the
trace — inject PHP webshell there.

pip install aiohttp colorama

━━━ RUN ━━━
python Adminer-0day.py siteList.txt

Download-Link : Here

wp2shell (CVE-2026-63030 ,  CVE-2026-60137)

Usage : python wp2shell.py sites.txt

Download LINK : here