The idea of the LOTP project is to inventory how development tools (typically CLIs), commonly used in CI/CD pipelines, have lesser-known RCE-By-Design features ("foot guns"), or more generally, can be used to achieve arbitrary code execution by running on untrusted code changes or following a workflow injection.

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

TaskHound hunts for Windows scheduled tasks that run with privileged accounts and stored credentials. It enumerates tasks over SMB, parses XMLs, and identifies high-value attack opportunities through BloodHound integration.

For backstory/lore and detailed explanations: see the associated Blog Posts - Part 1 and Part 2.

The KiotViet Sync plugin for WordPress (versions up to and including 1.8.5) is vulnerable to arbitrary file uploads, due to missing file type validation in the create_media() function.
This vulnerability allows unauthenticated attackers to upload arbitrary files to the server, which may lead to remote code execution.

This tool extracts Credit card numbers, NTLM(DCE-RPC, HTTP, SQL, LDAP, etc), Kerberos (AS-REQ Pre-Auth etype 23), HTTP Basic, SNMP, POP, SMTP, FTP, IMAP, etc from a pcap file or from a live interface.

Recently, cheap IP KVMs have become popular. But their deployment needs to be secured...

Connect Cursor, Copilot & Claude directly to Cheat Engine via MCP. Automate reverse engineering, pointer scanning, and memory analysis using natural language.

A Beacon Object File (BOF) for Havoc/CS to Bypass PPL and Dump Lsass

By default this BOF, writes WerFaultSecure.exe to the temp directory of the user's context with a random filename and saves the dump in the same directory as .dll. This is a POC Bof, It could be extended and modified the way you like and add many improvements like remote dump. All temporary files gets cleaned up after the dump.

n8n Ni8mare - Unauthenticated Arbitrary File Read to RCE Chain (CVSS 10.0)
www.cyera.com/research-labs/ni8mare-unauthenticated-remote-code-execution-in-n8n-cve-2026-21858

A critical remote code execution vulnerability (CVE-2025-54068) exists in Livewire versions before 3.6.4. The vulnerability is caused by improper control of code generation during component property update hydration. When a Livewire component processes user input from the snapshot, the framework fails to properly sanitize object types, allowing attackers to inject malicious payloads that get executed on the server. If an attacker knows the APP_KEY of the Laravel application, the exploitation becomes even more straightforward.

A deep technical dive into how MITM attacks actually work in Ethernet, IPv4, and IPv6 networks from ARP and DHCP to IPv6 RA, DNS, and FHRP spoofing.