scripthunter

scripthunter Scripthunter is a tool that finds javascript files for a given website. To scan Google, simply run ./scripthunter.sh https://google.com. Note that it may take a while, which is why scripthunter also implements a notification mechanism to inform you when a scan is finished via Telegra...

cumulus

Application Weakness Monitoring Software What's Cumulus Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It's very simple and powerful. Key features Just install SDK to web front, can be found security weakness on...

malware-jail

malware-jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript Windows Scripting Host context env/wscript.js, at least the part frequently used by malware...

jsmon

JSMon JSMon - JavaScript Change Monitor for BugBounty Using this script, you can configure a number of JavaScript files on websites that you want to monitor. Everytime you run this script, these files will be fetched and compared to the previously fetched version. If they have changed, you will b...

GetDataReport

ABOUT Script in PHP+JS for get information of target through a web application, use $SERVER functions and JS functions for get information of our client. Plugin WEBApps in some web applications need to collect information from the client to perform tasks with this plugin will be easier to work wi...

mhf

Mobile Helper Framework is a tool that automates the process of identifying the framework/technology used to create a mobile application. Additionally, it assists in finding sensitive information or provides suggestions for working with the identified platform. How work? The tool searches for fil...

wonitor

web monitor fast, zero config web endpoint change monitor. for comparing responses, a selected list of http headers and the full response body is stored on a local key/value store file. no configuration needed. to increase network throughput, a --worker flag allows to set the concurrency when...

jsleak

Description I was developing jsleak during most of my free time for my own need.It is easy-to-use command-line tool designed to uncover secrets and links in JavaScript files or source code. The jsleak was inspired by Linkfinder and regexes are collected from multiple sources. Features: Discover...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol. Resources...

Nosql-Exploitation-Framework

Nosql-Exploitation-Framework A FrameWork For NoSQL Scanning and Exploitation Framework NoSQL Exploitation Framework 2.02b Released Author NoSQL Exploitation Framework Authored By Francis Alexander Wiki NoSQL Exploitation Framework Wiki on Installation & Usage -...

CVE-2024-53255

CVE-2024-53255 boid CMS 2.1.1 - reflected Cross-Site Scripting XSS Description: A reflected XSS vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code Steps to exploit: 1- Login to the CMS and Navigate to the delete...

LinkFinder

About LinkFinder LinkFinder is a python script written to discover endpoints and their parameters in JavaScript files. This way penetration testers and bug hunters are able to gather new, hidden endpoints on the websites they are testing. Resulting in new testing ground, possibility containing ne...

subjs

subjs subjs fetches javascript files from a list of URLS or subdomains. Analyzing javascript files can help you find undocumented endpoints, secrets, and more. It's recommended to pair this with gau and then https://github.com/GerbenJavado/LinkFinder Resources Usage Installation Usage: Examples: ...

injectify

Injectify Perform advanced MiTM attacks on websites with ease. ✨ Support development on Patreon or one-time via Paypal Test it out | Installation | Docs | Trello | Discord View what's on the victims screen Ability to interact and click buttons Scrolling is synced two-way Data recording Database a...

CVE-2019-16172

CVE-2019-16172 The CVE-2019-16172 Scanner is designed to check LimeSurvey instances for the stored XSS vulnerability. CVE Descriptions CVE-2019-16172 Description: CVE-2019-16172 is a stored XSS vulnerability found in LimeSurvey versions prior to 3.17. The vulnerability arises due to improper...

Nmap-scripts

Nmap Scripts raikia-screenshot.nse This nmap script will take a screenshot of https://ip:port, as well as https://hostname:port AND https://sslcertname:port. This differs from other screenshot nmap utilities because it will allow javascript execution, and it will have a timeout on the screenshot...

JShell

JShell JShell - Get a JavaScript shell with XSS. Usages Run shell.py and JShell will automatically try to detect your IP address, default LPORT is 33. As you can see the payload has been generated and now all you have to do is to deliver this payload to the victim. As soon as you do that, you wil...

Gotanda

Gotanda Gotanda is OSINTOpen Source Intelligence Web Extension for Firefox/Chrome. This Web Extension could search OSINT information from some IOC in web page.IP,Domain,URL,SNS...etc This Repository partly the studying and JavaScript practice. Download link below. FireFox Chrome Usage Right click...

CVE-2024-4367-POC

CVE-2024-4367 POC Usage python poc.py malicious.pdf "alert'S4vvy'" References CVE-2024-4367: Arbitrary JS Execution in PDF.js PDF.js...

CVE-2021-26832

CVE-2021-26832 Suggested description Cross Site Scripting XSS at the "Reset Password" page form of Priority Enterprise Management System v8.00 allows attackers to execute javascript on behalf of the victim by sending a malicious URL or directing the victim to a malicious site. Vulnerability Type...