Pentester

Offensive AI Agents Landscape: Projects, Models, Skills, MCP Servers, Papers, Benchmarks & Commercial Solutions https://github.com/Yeti-791/Awesome-Offensive-AI-Agentic-Landscape

A labeled reverse-engineering dataset over 4,598 crackmes from crackmes.one, built for benchmarking automated RE (AI agents + decompilers) https://github.com/crackmesone/crackmes-re-dataset

How to use Claude Code for Bug Bounty: find fast, validate manually https://www.yeswehack.com/learn-bug-bounty/llm-series-claude

T3MP3ST A multi-agent offensive-security framework, built to turn the AI coding agent you already run into a zero-day hunter. Point it at an authorized target and the kill chain runs itself: recon → exploit → report, from a browser War Room or the CLI, driven by the agent you're already signed into — Claude Code, Codex, Hermes — or a model you run fully offline (Ollama, LM Studio, vLLM). No new API keys, no cloud tenant, no second bill. Your agent is the brain; T3MP3ST is the war machine bolted around it. Self-hosted storm. Keyless warfare.

Dirty Frag: Universal Linux LPE Obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Writevulnerability. Dirty Frag is a case that extends the bug class to which Dirty Pipe and Copy Fail belong. Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high. Tested on the following distribution versions: • Ubuntu 24.04.4: 6.17.0-23-generic • RHEL 10.1: 6.12.0-124.49.1.el10_1.x86_64 • openSUSE Tumbleweed: 7.0.2-1-default • CentOS Stream 10: 6.12.0-224.el10.x86_64 • AlmaLinux 10: 6.12.0-124.52.3.el10_1.x86_64 • Fedora 44: 6.19.14-300.fc44.x86_64 @news4hack

Release v3.8.0 · projectdiscovery/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0

CVE-2026-24291: Windows LPE (RegPwn) Exploit: https://github.com/mdsecactivebreach/RegPwn Blog: https://www.mdsec.co.uk/2026/03/rip-regpwn/ BOF: https://github.com/Flangvik/RegPwnBOF Tested versions: Windows 11 25h2 Windows 11 24h2 Windows 10 21h2 Windows Servers 2016/2019/2022 Patched: Mar 10, 2026

CVE-2025-71257 and CVE-2025-71260 BMC FootPrints Pre-Authenticated Remote Code Execution Chain • Bypass authentication with CVE-2025-71257. • If it is successful, it tries to verify the CVE-2025-71260 RCE by writing a ranomized .jsp file to the tomcat servers webroot. This .jsp file just enumerates system information. Blog: https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/ BMC FootPrints is an IT Service Management (ITSM) solution designed to help IT teams manage service requests, incidents, assets, and changes through configurable workflows and an intuitive web interface.

VMkatz Without VMkatz, the traditional workflow looks like this: exfiltrate the entire VM disk or memory snapshot, mount it locally, install a full Windows analysis stack, load the snapshot into a debugger or use mimikatz on a booted copy, and manually piece together credentials from each VM - one at a time. Multiply that by a dozen VMs on the cluster and you are looking at days of bandwidth, tooling, and post-processing. VMkatz exists because you shouldn't have to exfiltrate what you can read in place. It extracts Windows secrets - NTLM hashes, DPAPI master keys, Kerberos tickets, cached domain credentials, LSA secrets, NTDS.dit - directly from VM memory snapshots and virtual disks, on the NAS, the hypervisor, wherever the VM files are.

Gaining Initial Access and Outsmarting SmartScreen .zip email attachment that includes a VHDX (Hard Disk Image File) + Mark of the Web and SmartScreen bypass using Trusted Executable Reputation and DLL Sideloading. Tools: https://github.com/g3tsyst3m/CodefromBlog/tree/main/2026-2-21-Initial%20Access%20and%20Outsmarting%20SmartScreen

The Mimikatz Missing Manual My goal was to create the "Missing Manual" — the documentation that explains not just the commands, but the why and the how of the Windows protocols being manipulated. Parts: • Foundations: Setting up your environment and the basic syntax. • System Internals: How Windows handles tokens, processes, and services. • LSASS & Credentials: The heart of Mimikatz—extracting secrets from memory. • Kerberos Deep Dive: Tickets, forgery, and delegation. • PKI & Certificates: Hardware and software-based identities. • Domain Persistence: Owning the directory through replication. •DPAPI: Unlocking the secrets at rest.

2026-24061: Telnetd RCE as Root This flaw allows an attacker to establish a Telnet session without providing valid credentials, granting unauthorized access to the target system. The vulnerability exists all the way up to version 2.7-2 of the GNU telnetd service. Exploit: https://github.com/SafeBreach-Labs/CVE-2026-24061 Query: ZoomEye: app="GNU Inetutils telnetd" Shodan: product:"telnetd" @news4hack

ConfigManBearPig PowerShell collector for adding SCCM attack paths to BloodHound with OpenGraph. Blog: https://specterops.io/blog/2026/01/13/introducing-configmanbearpig-a-bloodhound-opengraph-collector-for-sccm @news4hack

Strix Strix are autonomous AI agents that act just like real hackers - they run your code dynamically, find vulnerabilities, and validate them through actual proof-of-concepts. Built for developers and security teams who need fast, accurate security testing without the overhead of manual pentesting or the false positives of static analysis tools. Key Capabilities: 🔧 Full hacker toolkit out of the box 🤝 Teams of agents that collaborate and scale ✅ Real validation with PoCs, not false positives 💻 Developer‑first CLI with actionable reports 🔄 Auto‑fix & reporting to accelerate remediation 🎯 Use Cases Application Security Testing - Detect and validate critical vulnerabilities in your applications Rapid Penetration Testing - Get penetration tests done in hours, not weeks, with compliance reports Bug Bounty Automation - Automate bug bounty research and generate PoCs for faster reporting CI/CD Integration - Run tests in CI/CD to block vulnerabilities before reaching production @news4hack

DumpBrowserSecrets Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from modern Chromium-based and Gecko-based browsers (Chrome, Microsoft Edge, Firefox, Opera, Opera GX, and Vivaldi). @news4hack

CVE-2026-21858 + CVE-2025-68613: n8n Ni8mare - Full Chain Exploit (CVSS 10.0) Unauthenticated to Root RCE: - LFI via Content-Type confusion - Read /proc/self/environ to find HOME - Steal encryption key + database - Forge admin JWT token - Expression injection sandbox bypass - RCE as root Query: FOFA: app="n8n" HUNTER : product.name="N8n" ZoomEye: app="n8n"

Chronomaly — Android / Linux Kernel LPE exploit (CVE-2025-38352) The exploit was written specifically for Linux kernel v5.10.157, but should work against all vulnerable v5.10.x kernels, as it does not require any specific kernel text offsets to work. Blog: • Part 1 - In-the-wild Android Kernel Vulnerability Analysis + PoC • Part 2 - Extending The Race Window Without a Kernel Patch • Part 3 - Uncovering Chronomaly

CVE-2025-61922: Zero-Click Account Takeover on Prestashop https://dhakal-ananda.com.np/blogs/cve-2025-61922-analysis/

MongoBleed: CVE-2025-14847 Memory Corruption in MongoDB. Your Database Talks Back https://phoenix.security/mongobleed-vulnerability-cve-2025-14847/

Release v3.6.2 · projectdiscovery/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.6.2