Pentester

Offensive AI Agents Landscape: Projects, Models, Skills, MCP Servers, Papers, Benchmarks & Commercial Solutions https://github.com/Yeti-791/Awesome-Offensive-AI-Agentic-Landscape

A labeled reverse-engineering dataset over 4,598 crackmes from crackmes.one, built for benchmarking automated RE (AI agents + decompilers) https://github.com/crackmesone/crackmes-re-dataset

How to use Claude Code for Bug Bounty: find fast, validate manually https://www.yeswehack.com/learn-bug-bounty/llm-series-claude

T3MP3ST A multi-agent offensive-security framework, built to turn the AI coding agent you already run into a zero-day hunter. Point it at an authorized target and the kill chain runs itself: recon → exploit → report, from a browser War Room or the CLI, driven by the agent you're already signed into — Claude Code, Codex, Hermes — or a model you run fully offline (Ollama, LM Studio, vLLM). No new API keys, no cloud tenant, no second bill. Your agent is the brain; T3MP3ST is the war machine bolted around it. Self-hosted storm. Keyless warfare.

Dirty Frag: Universal Linux LPE Obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Writevulnerability. Dirty Frag is a case that extends the bug class to which Dirty Pipe and Copy Fail belong. Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high. Tested on the following distribution versions: • Ubuntu 24.04.4: 6.17.0-23-generic • RHEL 10.1: 6.12.0-124.49.1.el10_1.x86_64 • openSUSE Tumbleweed: 7.0.2-1-default • CentOS Stream 10: 6.12.0-224.el10.x86_64 • A...

Release v3.8.0 · projectdiscovery/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0

CVE-2026-24291: Windows LPE (RegPwn) Exploit: https://github.com/mdsecactivebreach/RegPwn Blog: https://www.mdsec.co.uk/2026/03/rip-regpwn/ BOF: https://github.com/Flangvik/RegPwnBOF Tested versions: Windows 11 25h2 Windows 11 24h2 Windows 10 21h2 Windows Servers 2016/2019/2022 Patched: Mar 10, 2026

CVE-2025-71257 and CVE-2025-71260 BMC FootPrints Pre-Authenticated Remote Code Execution Chain • Bypass authentication with CVE-2025-71257. • If it is successful, it tries to verify the CVE-2025-71260 RCE by writing a ranomized .jsp file to the tomcat servers webroot. This .jsp file just enumerates system information. Blog: https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/ BMC FootPrints is an IT Service Management (ITSM) solution designed to help IT teams manage service requests, incidents, assets, and changes through configurable workflows and an intuitive web interface.

VMkatz Without VMkatz, the traditional workflow looks like this: exfiltrate the entire VM disk or memory snapshot, mount it locally, install a full Windows analysis stack, load the snapshot into a debugger or use mimikatz on a booted copy, and manually piece together credentials from each VM - one at a time. Multiply that by a dozen VMs on the cluster and you are looking at days of bandwidth, tooling, and post-processing. VMkatz exists because you shouldn't have to exfiltrate what you can read in place. It extracts Windows secrets - NTLM hashes, DPAPI master keys, Kerberos tickets, cached domain credentials, LSA secrets, NTDS.dit - directly from VM memory snapshots and virtual disks, on th...

Gaining Initial Access and Outsmarting SmartScreen .zip email attachment that includes a VHDX (Hard Disk Image File) + Mark of the Web and SmartScreen bypass using Trusted Executable Reputation and DLL Sideloading. Tools: https://github.com/g3tsyst3m/CodefromBlog/tree/main/2026-2-21-Initial%20Access%20and%20Outsmarting%20SmartScreen