galer

galer root@kitploit: /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol...

galer

galer root@kitploit: /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 Una herramienta rápida para obtener URLs de atributos HTML mediante rastreo. Inspirada en el tweet de @omespino, que permite extraer valores src, href, url y action evaluando JavaScript a través del Protocolo Chrome...

awesome-web-security

Awesome Web Security 🐶 Lista curada de materiales y recursos de Seguridad Web. No hace falta decir que la mayoría de los sitios web sufren de varios tipos de errores que eventualmente pueden llevar a vulnerabilidades. ¿Por qué ocurre esto con tanta frecuencia? Pueden intervenir muchos factores,...

CVE-2026-89240 WWBN AVideo Reflected XSS via confirmLivePassword.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

CVE-2026-89240

WWBN AVideo (through commit c3edcc27) contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The unauthenticated GET parameter u, not covered by $securityFilter, is interpolated directly into an attribute without URL- or HTML-encoding. A remote attacker c...

EUVD-2026-76052

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/confirmLivePassword.php. The script interpolates the unauthenticated GET parameter u which is not covered by $securityFilter directly into an attribute withou...

EUVD-2026-76051

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing / to close t...

CVE-2025-58434-59528-htb-ctf

CVE-2025-58434-59528-htb-ctf Silentium Exploit Chain This repository contains the complete exploitation chain for the Silentium machine on Hack The Box. The exploit leverages a two-stage vulnerability involving user enumeration and JavaScript injection to achieve Remote Code Execution RCE. 📝...

Jbin-website-secret-scraper

🎖️ Jbin recopilará todas las URL del sitio web y luego intentará exponer los datos secretos de ellas. Recoge tanto URL como enlaces JS para extraer secretos de ellos. Además, si estás buscando una cadena específica en una página o quieres ejecutar una expresión regular personalizada, ahora también...

CVE-2023-43358-CMSmadesimple-Stored-XSS---News

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Title in the Content - News Menu. Attack Vectors: Scripting A vulnerability in the sanitization o...

jsdeob-workbench

jsdeob-workbench A visual workbench for deobfuscating JavaScript. Build transform chains, step through them, write your own plugins. YouTube Demo https://www.youtube.com/watch?v=7zuqKoJT2BM https://www.youtube.com/watch?v=bOVnPIfjoco What is this? This application reveals the Abstract Syntax Tree...

xssless

xssless An automated XSS payload generator written in python. Usage 1. Record requests with Burp proxy 2. Select requests you want to generate, then right click and select "Save items" 3. Use xssless to generate your payload: ./xssless.py burpexportfile 4. Pwn! A more detailed tutorial can be fou...

CVE-2025-50866

CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting XSS vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading t...

JShunter

JSHunter Professional JavaScript Security Analysis Tool Complete endpoint discovery, sensitive data detection, and advanced code analysis for security professionals About JSHunter is a comprehensive command-line tool for JavaScript security analysis and endpoint discovery. Built for security...

datadome-vm

DataDome VM Analysis Summary This repository documents the first public version of DataDome's in-browser JavaScript virtual machine VM used in their CAPTCHA/interstitial flow. This analysis covers: Bytecode loading and decoding mechanisms VM memory layout and architecture A proof-of-concept...

cumulus

Application Weakness Monitoring Software What's Cumulus Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It's very simple and powerful...

zap-hud

ZAP Heads Up Display El HUD ya no está en desarrollo activo Desafortunadamente, el HUD ya no está en desarrollo activo debido a que nadie se está centrando en él. El HUD es una interfaz única e innovadora que sabemos que a algunas personas les encanta. Pero también requiere una cantidad nada...

CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension

CMSmadesimple Stored XSS v2.2.18 Author: Sergio Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Profiles in the Extensions - MicroTiny WYSIWYG editor. Attack Vectors: Scripting A vulnerability ...

scripthunter

scripthunter Scripthunter es una herramienta que encuentra archivos JavaScript para un sitio web determinado. Para escanear Google, simplemente ejecuta ./scripthunter.sh https://google.com. Ten en cuenta que puede llevar un tiempo, por lo que scripthunter también implementa un mecanismo de...

kibana-prototype-pollusion

CVE-2019-7609 Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing...