mohsen khashei

CVE-2025-32463. Local Privilege Escalation to Root via Sudo chroot in Linux

ICS-Pentesting-Tools. A curated list of tools related to Industrial Control System (ICS) security and Penetration Testing

Ransomware-Samples. Small collection of Ransomware organized by family.

Malware-Analysis. A curated list of awesome malware analysis tools and resources

smartrecon. smartrecon is a powerful shell script to automate the recon and finding common vulnerabilities for bug hunter

cloud-penetration-testing. A curated list of cloud pentesting resource, contains AWS, Azure, Google Cloud

exchange-penetration-testing. The great Microsoft exchange hack: A penetration tester’s guide (exchange penetration testing)

bug-bounty-writeups. A curated list of available Bug Bounty & Disclosure Programs and Write-ups.

Apache-Tomcat-Pentesting. Apache Tomcat exploit and Pentesting guide for penetration tester

Penetration-Testing-Interview-Questions. Penetration Testing Interview Questions

WAF-Bypass. 🔥 Web application firewalls (WAF) bypass

security-mindmap. This repository stores various roadmap(Mindmaps) for bug bounty Hunter, pentester, offensive(red team), defensive(blue team) and security Professional people

ProxyShell. CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability

Shodan-Dorks. a curated list of shodan dorks for finding sensitive data in shodan.io

Ransomware. Ransomware Simulator for Blue team ,Ransomware Simulator for Red team ,Ransomware infographic, open source Anti Ransomware, Ransomware As A Service and Ransomware protection technologies

wifi-password-stealer. steal saved wifi passwords in a computer & ip of target then report them through email.

Application-Security-Interview-Questions. Here are some common interview questions for an application security position you can review for your own interview, along with example answers

ElasticSearch-Pentesting. ElasticSearch exploit and Pentesting guide for penetration tester

MQTT-Pentesting. MQTT exploit and Pentesting guide for penetration tester

xmlrpc-exploit. Exploiting the xmlrpc.php on all WordPress versions

RabbitMQ-Pentesting. RabbitMQ exploit and Pentesting guide for penetration tester

DevSecOps. Collection and Roadmap for everyone who wants DevSecOps, contains list of tools and methodologies

Cloud-Flaws-CTF. flAWS.cloud and flAWS2.cloud Interactive tutorial/CTFs to learn common AWS security mistakes.

CVE-2022-23131. Zabbix - SAML SSO Authentication Bypass

Spring-CVE. This includes CVE-2022-22963, a Spring SpEL / Expression Resource Access Vulnerability, as well as CVE-2022-22965, the spring-webmvc/spring-webflux RCE termed "SpringShell".

FFUF-Tricks. Describe how to use ffuf different options with examples

Grafana-CVE. a Curated list of Grafana Security Vulnerabilities, CVE & exploit

bruteforce-http-authentication. Bruteforce HTTP Authentication. Supports: Basic HTTP authentication ,Digest HTTP authentication

Bug-Hunting-Handbook. Bug Hunting Handbook

Nextcloud-Pentesting. Nextcloud exploit and Pentesting guide for penetration tester

Smishing-Botnets. Smishing Botnets Going Viral in Iran

ProxyLogon. ProxyLogon (CVE-2021-26855+CVE-2021-27065) Exchange Server RCE (SSRF->GetWebShell)

Cyber-Threat-Hunting. A curated list of threat detection and hunting resources

CVE-2023-38646. Metabase Pre-auth RCE (CVE-2023-38646)

Webmin-CVE. a Curated list of Webmin vulnerability for penetration tester

Fresh-Resolvers. List of fresh DNS resolvers updated daily

Cybersecurity-Awareness-Training. 🛡️ Cybersecurity Awareness Training for Employees

Active-Directory-Attacks. A curated list of awesome Active Directory Penetration Testing and attack resources

DDoS-Attack. DDoS Attack and type of ddos attack and ddos mitigation approach

Splunk. a useful tutorial about splunk and security splunk app

CVE-2023-22515. CVE-2023-22515 - Broken Access Control Vulnerability in Confluence Data Center and Server

open-DNS-resolver. DNS Open resolvers or Open DNS resolver vulnerability are type of DNS amplification attack.

Favicon-Hash. Calculate Favicon Hash for Shodan

CVE-2022-26134. [PoC] Atlassian Confluence (CVE-2022-26134) - Unauthenticated OGNL injection vulnerability (RCE)

PHP-Interview-Questions. a curated list of php interview questions and answers

nuclei-templates. Community curated list of templates for the nuclei engine to find security vulnerabilities.

GitLab-SSRF-CVE-2021-22214. POC for CVE-2021-22214: Gitlab SSRF

Threat-Modeling. Threat Modeling and tools

cyber-attacks-in-iran. A curated list of awesome cyber attacks in iran, we want to review and explain some advanced attack that happened in iran, in order to learned some security tips.

FortiWeb. FortiWeb is a web application firewall (WAF)

CVE-2025-34152. Shenzhen Aitemi M300 Wi-Fi Repeater Unauthenticated RCE (CVE-2025-34152)

CVE-2021-30573. Google Chrome Vulnerabilities CVE-2021-30573 allowed a remote attacker to potentially exploit heap corruption

Offline-Pentest-Toolkit. Offline Penetration Testing Toolkit & Methodologies

Amsi-Bypass. This repo contains some Amsi Bypass methods i found on different Blog Posts.

Awesome-Code-Review. Awesome list of code review resources and tools

Redis-Pentesting. Redis exploit and Pentesting guide for penetration tester