SkillSpector v2.11.1
https://kitploit.com/en/posts/github-nvidia-skillspector-v2111

Security scanner for AI agent skills. Detect vulnerabilities, malicious patterns, security risks, prompt injection, data exfiltration, and supply-chain risks in Claude Code, Codex, and MCP skills before you install them.

0xM0nCrush
https://kitploit.com/en/tools/github/deathshotxd/0xm0ncrush

Kernel-mode process terminator using a signed BYOVD driver. Works on all Windows 10/11. No offsets, no PDB. Rust.

mxc
https://kitploit.com/en/tools/github/microsoft/mxc

Policy-driven, layered isolation and containment

When Pre-Account Takeover Actually Means Pre-Account Takeover
https://medium.com/@mostvvfv/when-pre-account-takeover-actually-means-pre-account-takeover-84ee9dd2263c?source=rss------bug_bounty-5

بِسْمِ اللَّهِ رَبِّ الْعَالَمِينَ، وَالصَّلَاةُ وَالسَّلَامُ عَلَى رَسُولِنَا الْأَمِينِ.Continue reading on Medium » (https://medium.com/@mostvvfv/when-pre-account-takeover-actually-means-pre-account-takeover-84ee9dd2263c?source=rss------bug_bounty-5)

I Found a Tiny Filename Bypass That Broke a “Safe” Loader — and Earned $$$
https://medium.com/@xoemekk1/i-found-a-tiny-filename-bypass-that-broke-a-safe-loader-and-earned-7fc1afb70af3?source=rss------bug_bounty-5

Continue reading on Medium » (https://medium.com/@xoemekk1/i-found-a-tiny-filename-bypass-that-broke-a-safe-loader-and-earned-7fc1afb70af3?source=rss------bug_bounty-5)

I Used My Own Identity Provider to Take Over Another Tenant
https://yaseenzubair.medium.com/i-used-my-own-identity-provider-to-take-over-another-tenant-5f356ef77d3b?source=rss------bug_bounty-5

How a missing tenant-to-SSO binding turned a valid authentication response into cross-organization account takeoverContinue reading on Medium » (https://yaseenzubair.medium.com/i-used-my-own-identity-provider-to-take-over-another-tenant-5f356ef77d3b?source=rss------bug_bounty-5)

Ethical Hacker: Hire The Best Certified Ethical Hackers > Smatchoicehackers.com

Certificate Ethical HackerContinue reading on Medium »
Read more...

How a Default Password Let Me Log Into Almost Anyone’s Account

A story about how one shared default password, combined with a simple user-enumeration flaw, turned into a critical account takeover…Continue reading on Medium »
Read more...

Video tutorial: How to run Password Spraying attacks directly from Sliver C2 framework?
https://www.reddit.com/r/redteamsec/comments/1w8qsx9/video_tutorial_how_to_run_password_spraying/

submitted by /u/lsecqt (https://www.reddit.com/user/lsecqt)
[link] (https://youtu.be/MgotYfujDio) [comments] (https://www.reddit.com/r/redteamsec/comments/1w8qsx9/video_tutorial_how_to_run_password_spraying/)

CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/

submitted by /u/socradario (https://www.reddit.com/user/socradario)
[link] (https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/) [comments] (https://www.reddit.com/r/redteamsec/comments/1wal658/cve202525249_exploitation_delivers_pivotc2_a/)

🔴 Breakdown of a real Redis rogue-replication cryptomining toolkit recovered from an open directory
https://www.reddit.com/r/redteamsec/comments/1wavxeq/breakdown_of_a_real_redis_roguereplication/

<!-- SC_OFF -->Recovered an operator's full working toolkit from an open directory, so this is real tradecraft rather than a PoC. The R&D trail is the interesting part, you can see what they tried and dropped. Core primitive is rogue replication: CONFIG SET dir/dbfilename, SLAVEOF to a rogue master, crafted RDB served on +FULLRESYNC with an embedded newline that lands a cron entry, then SLAVEOF NO ONE and restore config to stay quiet. Not novel, but clean, and it works from Redis 2.8.17 to 7.2.0 because it abuses replication, not a bug. Four production fallback write paths, plus a separate deploy_all.py that hits cron.d, an APT hook (/etc/apt/apt.conf.d/), and profile.d in one pass for redundancy against cleanup. Pull cron and the other two respawn on the next apt update or login shell. Abandoned R&D still in the folder: a BGSAVE-based first draft (noisier, dropped for replication), a webshell-via-Redis probe against web roots (never weaponized), and path recon into /etc/init.d, the full rc0-rc6 SysV set, and /etc/modprobe.d. None of those shipped. modprobe.d is the one they tested but held back, writable modprobe config runs commands on module load, stealthier than cron. Two verify payload bugs they hit and documented in comments: a test cron written to a dotfile that run-parts silently skips, and a /dev/tcp callback that dies under dash. Both burned real campaign runs before they fixed them. Opsec choices worth noting: XMRig pulled from the official GitHub release (blends into github.com egress, no attacker-hosted binary), renamed to /tmp/.xmrig, --tls on 443 to look like HTTPS, and the newest variant pins the pool cert with --tls-fingerprint so it fails closed against inspection. Two techniques that went nowhere: SSH-via-AOF (0 of 2,342, every host bounced at CONFIG SET with AUTH_REQUIRED) and a Lua EVAL sandbox probe. Fresh no-auth targets are the constraint, a run against a pre-qualified list hit 72.6% vs 22 to 26% full-fleet. Full write-up with IOCs and code: https://hunt.io/blog/redis-cryptomining-botnet-3562-servers <!-- SC_ON --> submitted by /u/Straight-Practice-99 (https://www.reddit.com/user/Straight-Practice-99)
[link] (https://hunt.io/blog/redis-cryptomining-botnet-3562-servers) [comments] (https://www.reddit.com/r/redteamsec/comments/1wavxeq/breakdown_of_a_real_redis_roguereplication/)

firmware-reverse-engineering
https://kitploit.com/en/tools/github/orbitcurve/firmware-reverse-engineering

A full claude and codex skillsets for firmware reverse engineering.

sshelf
https://kitploit.com/en/tools/github/max-rh/sshelf

Fast terminal UI for your SSH hosts: fuzzy-search and connect in two keystrokes, dual-pane SFTP file transfer, and background port forwarding. Keeps its own host database and generates the ssh command — never edits ~/.ssh/config.

skulto
https://kitploit.com/en/tools/github/asteroid-belt/skulto

Offline and security-first tool for syncing and managing agent skills

strongswan v6.1.0

Open-source IPsec-based VPN solution with IKEv2 support, certificate-based authentication, and flexible site-to-site, host-to-host, and roadwarrior configurations.
Read more...