bikini

bikini

All I do is spam unpatched vulnerabilities I discover after responsibly disclosing them (sometimes) and update patchwork

755 followers · 0 following

Achievements

Popular repositories Loading

exploitarium exploitariumPublic
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if hand…
Python 4.4k 1.2k
patchwork patchworkPublic
A polymorphic multi-stage python obfuscator that mangles source via AST rewrites, encrypts each function's bytecode into a separate lazily-decrypted blob, and wraps everything in a multi-cipher ant…
Python 143 14
iphone-dos iphone-dosPublic
dos iphones with mass bluetooth connections
C++ 16 3
android-deface android-defacePublic
android exploits use shodan.io
Python 14 6
marebackup-validation-kit marebackup-validation-kitPublic
Non-weaponized validation kit for Windows MareBackup scheduled task permissions and PATH hijack preconditions
PowerShell 12 4
telegram-trolled telegram-trolledPublic
0day for telegram on android // method coming later (old)
10 1

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all \u003cpre\u003e\u003ccode\u003e blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks"); } } catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); } })(); (function(){ try { var __m = "github.com"; var __re = new RegExp('^' + "github\\.com" + '

bikini

bikini

All I do is spam unpatched vulnerabilities I discover after responsibly disclosing them (sometimes) and update patchwork

755 followers · 0 following

Achievements

Popular repositories Loading

exploitarium exploitariumPublic
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if hand…
Python 4.4k 1.2k
patchwork patchworkPublic
A polymorphic multi-stage python obfuscator that mangles source via AST rewrites, encrypts each function's bytecode into a separate lazily-decrypted blob, and wraps everything in a multi-cipher ant…
Python 143 14
iphone-dos iphone-dosPublic
dos iphones with mass bluetooth connections
C++ 16 3
android-deface android-defacePublic
android exploits use shodan.io
Python 14 6
marebackup-validation-kit marebackup-validation-kitPublic
Non-weaponized validation kit for Windows MareBackup scheduled task permissions and PATH hijack preconditions
PowerShell 12 4
telegram-trolled telegram-trolledPublic
0day for telegram on android // method coming later (old)
10 1

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix"); } } catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '

bikini

bikini

All I do is spam unpatched vulnerabilities I discover after responsibly disclosing them (sometimes) and update patchwork

755 followers · 0 following

Achievements

Popular repositories Loading

exploitarium exploitariumPublic
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if hand…
Python 4.4k 1.2k
patchwork patchworkPublic
A polymorphic multi-stage python obfuscator that mangles source via AST rewrites, encrypts each function's bytecode into a separate lazily-decrypted blob, and wraps everything in a multi-cipher ant…
Python 143 14
iphone-dos iphone-dosPublic
dos iphones with mass bluetooth connections
C++ 16 3
android-deface android-defacePublic
android exploits use shodan.io
Python 14 6
marebackup-validation-kit marebackup-validation-kitPublic
Non-weaponized validation kit for Windows MareBackup scheduled task permissions and PATH hijack preconditions
PowerShell 12 4
telegram-trolled telegram-trolledPublic
0day for telegram on android // method coming later (old)
10 1

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length \u003e 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms"); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '

bikini

bikini

All I do is spam unpatched vulnerabilities I discover after responsibly disclosing them (sometimes) and update patchwork

755 followers · 0 following

Achievements

Popular repositories Loading

exploitarium exploitariumPublic
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if hand…
Python 4.4k 1.2k
patchwork patchworkPublic
A polymorphic multi-stage python obfuscator that mangles source via AST rewrites, encrypts each function's bytecode into a separate lazily-decrypted blob, and wraps everything in a multi-cipher ant…
Python 143 14
iphone-dos iphone-dosPublic
dos iphones with mass bluetooth connections
C++ 16 3
android-deface android-defacePublic
android exploits use shodan.io
Python 14 6
marebackup-validation-kit marebackup-validation-kitPublic
Non-weaponized validation kit for Windows MareBackup scheduled task permissions and PATH hijack preconditions
PowerShell 12 4
telegram-trolled telegram-trolledPublic
0day for telegram on android // method coming later (old)
10 1

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links"); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + '

bikini

bikini

All I do is spam unpatched vulnerabilities I discover after responsibly disclosing them (sometimes) and update patchwork

755 followers · 0 following

Achievements

Popular repositories Loading

exploitarium exploitariumPublic
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if hand…
Python 4.4k 1.2k
patchwork patchworkPublic
A polymorphic multi-stage python obfuscator that mangles source via AST rewrites, encrypts each function's bytecode into a separate lazily-decrypted blob, and wraps everything in a multi-cipher ant…
Python 143 14
iphone-dos iphone-dosPublic
dos iphones with mass bluetooth connections
C++ 16 3
android-deface android-defacePublic
android exploits use shodan.io
Python 14 6
marebackup-validation-kit marebackup-validation-kitPublic
Non-weaponized validation kit for Windows MareBackup scheduled task permissions and PATH hijack preconditions
PowerShell 12 4
telegram-trolled telegram-trolledPublic
0day for telegram on android // method coming later (old)
10 1

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default"); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '

bikini

bikini

All I do is spam unpatched vulnerabilities I discover after responsibly disclosing them (sometimes) and update patchwork

755 followers · 0 following

Achievements

Popular repositories Loading

exploitarium exploitariumPublic
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if hand…
Python 4.4k 1.2k
patchwork patchworkPublic
A polymorphic multi-stage python obfuscator that mangles source via AST rewrites, encrypts each function's bytecode into a separate lazily-decrypted blob, and wraps everything in a multi-cipher ant…
Python 143 14
iphone-dos iphone-dosPublic
dos iphones with mass bluetooth connections
C++ 16 3
android-deface android-defacePublic
android exploits use shodan.io
Python 14 6
marebackup-validation-kit marebackup-validation-kitPublic
Non-weaponized validation kit for Windows MareBackup scheduled task permissions and PATH hijack preconditions
PowerShell 12 4
telegram-trolled telegram-trolledPublic
0day for telegram on android // method coming later (old)
10 1

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers"); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + '

bikini

bikini

All I do is spam unpatched vulnerabilities I discover after responsibly disclosing them (sometimes) and update patchwork

755 followers · 0 following

Achievements

Popular repositories Loading

exploitarium exploitariumPublic
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if hand…
Python 4.4k 1.2k
patchwork patchworkPublic
A polymorphic multi-stage python obfuscator that mangles source via AST rewrites, encrypts each function's bytecode into a separate lazily-decrypted blob, and wraps everything in a multi-cipher ant…
Python 143 14
iphone-dos iphone-dosPublic
dos iphones with mass bluetooth connections
C++ 16 3
android-deface android-defacePublic
android exploits use shodan.io
Python 14 6
marebackup-validation-kit marebackup-validation-kitPublic
Non-weaponized validation kit for Windows MareBackup scheduled task permissions and PATH hijack preconditions
PowerShell 12 4
telegram-trolled telegram-trolledPublic
0day for telegram on android // method coming later (old)
10 1

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode"); } } catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); } })(); })();

bikini

bikini

All I do is spam unpatched vulnerabilities I discover after responsibly disclosing them (sometimes) and update patchwork

755 followers · 0 following

Achievements

Popular repositories Loading

exploitarium exploitariumPublic
A single archive of public exploit PoCs and vulnerability research writeups. At the time I post these, none have been reported. Feel free to report them yourself and take credit for the CVE if hand…
Python 4.4k 1.2k
patchwork patchworkPublic
A polymorphic multi-stage python obfuscator that mangles source via AST rewrites, encrypts each function's bytecode into a separate lazily-decrypted blob, and wraps everything in a multi-cipher ant…
Python 143 14
iphone-dos iphone-dosPublic
dos iphones with mass bluetooth connections
C++ 16 3
android-deface android-defacePublic
android exploits use shodan.io
Python 14 6
marebackup-validation-kit marebackup-validation-kitPublic
Non-weaponized validation kit for Windows MareBackup scheduled task permissions and PATH hijack preconditions
PowerShell 12 4
telegram-trolled telegram-trolledPublic
0day for telegram on android // method coming later (old)
10 1

bikini

Popular repositories Loading

Uh oh!

bikini

Popular repositories Loading

Uh oh!

bikini

Popular repositories Loading

Uh oh!

bikini

Popular repositories Loading

Uh oh!

bikini

Popular repositories Loading

Uh oh!

bikini

Popular repositories Loading

Uh oh!

bikini

Popular repositories Loading

Uh oh!

bikini

Popular repositories Loading

Uh oh!