Browse by Category
Pick a category to see every exploit for sale in it.
Web Apps
3 exploits available
Mobile (iOS/Android)
2 exploits available
Kernel / LPE
2 exploits available
Scripts & Tools
2 exploits available
Buy Exploits from the Marketplace
Every listing is a vetted, working proof-of-concept. Purchase to unlock the full write-up, screenshots, and exploit files.
UNION-based SQL injection: dumping the user table from a product filter
A category filter concatenates the `category` query parameter straight into a SQL query. This write-up takes it from a single quote to the full credentials table with a UNION SELECT.
Stored XSS in a comment field escalating to one-click admin takeover
Comments are stored and re-rendered without encoding. A planted payload runs in every reader's browser — including the moderator's — and is chained to create a new admin account.
CSRF account-email takeover by exploiting broken token validation
The change-email form has an anti-CSRF token, but the server ignores the parameter if you delete it. That turns a protected form into a one-click account takeover.
Android exported-activity hijack: bypassing login via an unprotected deep link
An internal "account settings" screen is marked exported for a deep-link feature, but never verifies it was actually reached through the login flow. Any app — or a single adb command — can jump straight to it.
Insecure Android WebView JavaScript bridge leaking the session token to any loaded page
The app adds a JS bridge exposing the session token to any page its WebView loads, and a deep link lets an attacker point that WebView at a page they control.
Linux LPE via a TOCTOU race in a setuid helper's config-file check
A privileged helper checks that the invoking user can read a config file, then opens a *different* reference to that same path moments later. Racing a symlink swap between the two turns a read check into a root-owned write primitive.
Local privilege escalation via a NOPASSWD sudo rule that trusts an unqualified PATH search
sudoers grants NOPASSWD execution of a backup script as root. The script calls `tar` and `gzip` by bare name instead of an absolute path — planting a malicious `tar` earlier in $PATH turns a routine job into a root shell.
Subdomain takeover scanner: detecting dangling CNAME records pointing to abandoned cloud services
A recon tool that resolves a subdomain list, fingerprints their CNAME targets against known "unclaimed service" signatures (GitHub Pages, S3, Heroku, etc.), and flags the ones ripe for takeover.
Password-spray throttling bypass tool exploiting a spoofable per-IP rate limiter
The app throttles failed logins per source IP, but reads that IP straight from an X-Forwarded-For header the client fully controls. Rotating a fresh fake value per request turns a 5-attempt lockout into unlimited attempts.