New Web Based Subdomain Discovery Service 🔍
crt.name is a new web based service for discovering subdomains through Certificate Transparency (CT) logs🌐
It searches publicly available certificate records to identify subdomains associated with a target domain🔵
Useful for❓
• Subdomain Enumeration
• Reconnaissance
• Asset Discovery
• Bug Bounty Recon
crt.name🔗
💎 @RootAccessClub
💎 @BugCod3
crt.name is a new web based service for discovering subdomains through Certificate Transparency (CT) logs
It searches publicly available certificate records to identify subdomains associated with a target domain
Useful for
• Subdomain Enumeration
• Reconnaissance
• Asset Discovery
• Bug Bounty Recon
crt.name
Please open Telegram to view this post
VIEW IN TELEGRAM
PDF Exploit Defense Toolkit 🛡
Two clean, pure-Python tools for handling malicious PDFs:
1️⃣ PDF Exploit Scanner
Detects high risk indicators (OpenAction, JS, Launch, XFA, heap sprays…)🤔
➡️ Structural patcher + full image based sanitizer included
GitHub😨
2️⃣ IP Scanner for Exploited PDFs
Pulls hidden IPs/ranges from hijacked PDFs (byte-level)🤔
➡️ Scans common ports + temporary firewall to block them
GitHub😨
🛩 @RootAccessClub
Two clean, pure-Python tools for handling malicious PDFs:
Detects high risk indicators (OpenAction, JS, Launch, XFA, heap sprays…)
GitHub
Pulls hidden IPs/ranges from hijacked PDFs (byte-level)
GitHub
Please open Telegram to view this post
VIEW IN TELEGRAM
numasec – The open source AI security agent 🧠
numasec is an AI security agent that runs in your terminal⚪️
It uses the tools already installed on your machine, follows security runbooks, switches between cyber agents, keeps the operation context alive, tracks findings, stores evidence and helps turn the work into reports🤖
GitHub🐱
💎 @RootAccessClub
numasec is an AI security agent that runs in your terminal
It uses the tools already installed on your machine, follows security runbooks, switches between cyber agents, keeps the operation context alive, tracks findings, stores evidence and helps turn the work into reports
GitHub
Please open Telegram to view this post
VIEW IN TELEGRAM
⚡3
AutoCVE – One Click CVE Discovery: Select Projects, Audit Source Code, Verify Vulnerabilities, Generate Reports, Fully Automated 💥
GitHub😀
📱 @RootAccessClub
GitHub
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥2
PentestCode 💥
AI penetration testing agent in your terminal
Multi-agent architecture Engagement state tracking , 20+ LLM providers ✨
GitHub 🔗
💎 @RootAccessClub
AI penetration testing agent in your terminal
Multi-agent architecture Engagement state tracking , 20+ LLM providers ✨
GitHub 🔗
💎 @RootAccessClub
🔥4
How I Found 7 XSS Using a Custom Nuclei Template 🔬
Read Here 📖
#CyberSecurity #BugBounty #xss
⚡️@RootAccessClub
Read Here 📖
#CyberSecurity #BugBounty #xss
⚡️@RootAccessClub
DarkTortilla RAT – Telegram Exfiltration & Payload Extraction ☢
GitHub 🔗
#Payload #CyberSecurity
@RootAccessClub
GitHub 🔗
#Payload #CyberSecurity
@RootAccessClub
⚡2
BugScanner 🩻
Automated web security reconnaissance & vulnerability assessment tool for bug bounty hunters. Discover attack surfaces, fingerprint technologies, detect common web vulnerabilities, and generate actionable security reports 📋
GitHub
🎖@RootAccessClub
Automated web security reconnaissance & vulnerability assessment tool for bug bounty hunters. Discover attack surfaces, fingerprint technologies, detect common web vulnerabilities, and generate actionable security reports 📋
GitHub
🎖@RootAccessClub
🔥3
🦠 Stuxnet
A new GitHub project provides an educational reconstruction of the infamous Stuxnet worm, based on years of reverse engineering research into the original 2010 samples 🔬
The project explores components such as rootkits, privilege escalation, Step7/S7 hooks, propagation mechanisms, and PLC-related functionality ⚙️💻
🧪 Intended for malware analysis, security research, and academic study
GitHub 🔗
💎 @RootAccessClub
A new GitHub project provides an educational reconstruction of the infamous Stuxnet worm, based on years of reverse engineering research into the original 2010 samples 🔬
The project explores components such as rootkits, privilege escalation, Step7/S7 hooks, propagation mechanisms, and PLC-related functionality ⚙️💻
🧪 Intended for malware analysis, security research, and academic study
GitHub 🔗
💎 @RootAccessClub
🔥3❤🔥1
PSAITO – New PS5 WebKit Research ToolExperimental toolkit for PS5
firmware 9.00 – 13.60 ✅
Browser only exploit that gives memory read/write + syscall primitives inside the WebKit process ✨
Research only ⚠️
GitHub 🔗
🥇@RootAccessClub
firmware 9.00 – 13.60 ✅
Browser only exploit that gives memory read/write + syscall primitives inside the WebKit process ✨
Research only ⚠️
GitHub 🔗
🥇@RootAccessClub
knife – A reverse engineer's toolkit in Rust 🔪
Parse, triage, disassemble, and audit PE, ELF, and Mach-O from one small binary. Static only: it reads the bytes on disk and never runs the target 🎯
GitHub 🌐
© @RootAccessClub
Parse, triage, disassemble, and audit PE, ELF, and Mach-O from one small binary. Static only: it reads the bytes on disk and never runs the target 🎯
GitHub 🌐
© @RootAccessClub
❤🔥2⚡1
Claude Red 🌪
Offensive security skills for Claude a collection of "SKILL.md" files designed to turn Claude into a more context aware red team assistant
Covers areas like web security, AD, cloud, recon, exploit development, EDR evasion, and more ⭐️
GitHub 🔗
🛡️@RootAccessClub
Offensive security skills for Claude a collection of "SKILL.md" files designed to turn Claude into a more context aware red team assistant
Covers areas like web security, AD, cloud, recon, exploit development, EDR evasion, and more ⭐️
GitHub 🔗
🛡️@RootAccessClub
🔥3
XSS Labs🔬
An intentionally vulnerable lab environment for practicing XSS across different contexts, including Reflected, Stored, DOM-based, and JavaScript based XSS
A practical resource for learning how XSS works and how to mitigate it 🕷️
Github 🧪
⚡️ @RootAccessClub
An intentionally vulnerable lab environment for practicing XSS across different contexts, including Reflected, Stored, DOM-based, and JavaScript based XSS
A practical resource for learning how XSS works and how to mitigate it 🕷️
Github 🧪
⚡️ @RootAccessClub
❤🔥4
CVE-2026-12793 – JetFormBuilder WordPress Plugin 🆘
Critical vulnerability (CVSS 9.8) ⚠️
Affects versions ≤ 3.6.2
Unauthenticated privilege escalation
Fixed in version 3.6.2.1 and later ✅
Attack Flow :
1⃣ Detect JetFormBuilder + version ≤ 3.6.2 (readme.txt)
2⃣ Discover form ID from public pages (data-form-id, /register/, etc.)
4⃣ POST to referer page with ?jet_form_builder_submit=submit&method=ajax
4⃣ Register User action runs → new WP user created
If you're using this plugin, update immediately ‼️
GitHub ⛓💥
@RootAccessClub
Critical vulnerability (CVSS 9.8) ⚠️
Affects versions ≤ 3.6.2
Unauthenticated privilege escalation
Fixed in version 3.6.2.1 and later ✅
Attack Flow :
1⃣ Detect JetFormBuilder + version ≤ 3.6.2 (readme.txt)
2⃣ Discover form ID from public pages (data-form-id, /register/, etc.)
4⃣ POST to referer page with ?jet_form_builder_submit=submit&method=ajax
4⃣ Register User action runs → new WP user created
If you're using this plugin, update immediately ‼️
GitHub ⛓💥
@RootAccessClub
OWASP Amass 🔎
An open source framework for network mapping and attack surface discovery
• Subdomain & DNS enumeration
• OSINT-based asset discovery
• Infrastructure mapping
• External attack surface analysis
Built by OWASP, Amass is a solid reconnaissance tool for security researchers and bug bounty hunters ⭐️
GitHub 🔗
💎 @RootAccessClub
An open source framework for network mapping and attack surface discovery
• Subdomain & DNS enumeration
• OSINT-based asset discovery
• Infrastructure mapping
• External attack surface analysis
Built by OWASP, Amass is a solid reconnaissance tool for security researchers and bug bounty hunters ⭐️
GitHub 🔗
💎 @RootAccessClub
🔥2
Legion — Automated Network Pentesting 🛡️
Legion is a GUI based network penetration testing framework built to automate reconnaissance, scanning, service enumeration, and vulnerability discovery
🔸 Nmap, Nikto, WhatWeb, Hydra, SMBenum
🔹 CVE & vulnerability mapping
🔸 Automated scanning & enumeration
Github 🔗
📡 @RootAccessClub
Legion is a GUI based network penetration testing framework built to automate reconnaissance, scanning, service enumeration, and vulnerability discovery
🔸 Nmap, Nikto, WhatWeb, Hydra, SMBenum
🔹 CVE & vulnerability mapping
🔸 Automated scanning & enumeration
Github 🔗
📡 @RootAccessClub
❤🔥2
CVE-2026-21858 + CVE-2025-68613 - n8n Full Chain 💥
Unauthenticated Arbitrary File Read → Admin Token Forge → Sandbox Bypass → RCE 🌪
CVSS : 10.0 + 9.9 (Critical) ⚠️
Fixed : 1.121.0 (AFR) / 1.120.4+ (RCE) ✅
Github 🌐
@RootAccessClub
Unauthenticated Arbitrary File Read → Admin Token Forge → Sandbox Bypass → RCE 🌪
CVSS : 10.0 + 9.9 (Critical) ⚠️
Fixed : 1.121.0 (AFR) / 1.120.4+ (RCE) ✅
Github 🌐
@RootAccessClub
❤🔥1
Osintgram 👥
An open source OSINT framework for Instagram reconnaissance and information gathering 🔎
Key Features:
• Profile & content analysis
• Followers / Following analysis
• Hashtag & location searches
• Media and metadata analysis
• Account comparison
• Interactive Web UI
• AI assisted mode with local Ollama support
• JSON & HTML report generation
GitHub 🔗
⚠️ Use responsibly and only with data you are authorized to investigate
💎 @RootAccessClub
An open source OSINT framework for Instagram reconnaissance and information gathering 🔎
Key Features:
• Profile & content analysis
• Followers / Following analysis
• Hashtag & location searches
• Media and metadata analysis
• Account comparison
• Interactive Web UI
• AI assisted mode with local Ollama support
• JSON & HTML report generation
GitHub 🔗
⚠️ Use responsibly and only with data you are authorized to investigate
💎 @RootAccessClub
❤🔥4
WordPress Critical RCE 🚨
CVE-2026-87902 | CVSS 9.2
A critical unauthenticated path traversal vulnerability in WordPress Core can, under specific conditions, lead to Remote Code Execution (RCE) through page template resolution 💣
Affected versions span 4.7 → 7.1.1 🦠
🛡️ Fix: Update to the latest patched WordPress release for your branch
GitHub 🔗
@RootAccessClub
CVE-2026-87902 | CVSS 9.2
A critical unauthenticated path traversal vulnerability in WordPress Core can, under specific conditions, lead to Remote Code Execution (RCE) through page template resolution 💣
Affected versions span 4.7 → 7.1.1 🦠
🛡️ Fix: Update to the latest patched WordPress release for your branch
GitHub 🔗
@RootAccessClub
🔥2
Root Access Club
WordPress Critical RCE 🚨 CVE-2026-87902 | CVSS 9.2 A critical unauthenticated path traversal vulnerability in WordPress Core can, under specific conditions, lead to Remote Code Execution (RCE) through page template resolution 💣 Affected versions span…
CVE-2026-87902 🧪
WordPress unauthenticated LFI → conditional RCE 💉
Github 📎
⚠️ Authorized security testing, education, and defensive research only
💠 @RootAccessClub
WordPress unauthenticated LFI → conditional RCE 💉
Github 📎
⚠️ Authorized security testing, education, and defensive research only
💠 @RootAccessClub
🔥2