honggfuzz

Honggfuzz A security-oriented, feedback-driven, evolutionary fuzzer. Honggfuzz is a general-purpose fuzzer that uses code coverage software and hardware-based to find bugs. It is multi-process, multi-threaded, and supports persistent fuzzing for extreme speed. Key Features Fast : Multi-process an...

heartbleed-masstest

This tool allows you to scan multiple hosts for Heartbleed, in an efficient multi-threaded manner. This tests for OpenSSL versions vulnerable to Heartbleed without exploiting the server, so the heartbeat request does not cause the server to leak any data from memory or expose any data in an...

urlgrab

Welcome to urlgrab 👋 A golang utility to spider through a website searching for additional links with support for JavaScript rendering. Install go get -u github.com/iamstoxe/urlgrab Features Customizable Parallelism Ability to Render JavaScript including Single Page Applications such as Angular a...

apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...

IPGeoLocation

IPGeoLocation ==== A tool to retrieve IP Geolocation information Powered by ip-api Requirements Python 3.x termcolor colorama Download/Installation git clone https://github.com/maldevel/IPGeoLocation pip3 install -r requirements.txt --user if pip3 is missing: apt-get install python3-setuptools...

keepassxc

KeePassXC /statusIcon KeePassXC is a modern, secure, and open-source password manager that stores and manages your most sensitive information. You can run KeePassXC on Windows, macOS, and Linux systems. KeePassXC is for people with extremely high demands of secure personal data management. It sav...

CVE-2026-113869 Use-after-free in S/MIME decryption during a security device password prompt

When Thunderbird asked for a security device password for example a smartcard PIN or the Primary Password while decrypting an S/MIME message, the message load could finish or be cancelled while the prompt was open. This freed the message decoder while it was still in use, causing a use-after-free...

CVE-2026-113867 Stanza injection in XMPP chat

Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which th...

CVE-2026-113868 Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication

When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include uninitialized heap memory in its NTLM response, disclosing that memory to the server. A...

CVE-2026-113867

The Thunderbird chat feature with XMPP accounts is vulnerable to a stanza injection flaw. The root cause is the failure to escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests are echoed in automatic replies, a remote XMPP user can send a crafted r...

CVE-2026-113868

Thunderbird is vulnerable to an uninitialized memory disclosure and out-of-bounds read during NTLM authentication for POP3 and SMTP servers. The issue stems from a lack of validation on the server's challenge string; a malicious server can provide an invalid base64 challenge to cause Thunderbird ...

CVE-2026-113869

A use-after-free vulnerability exists in Thunderbird during S/MIME decryption . When a user is prompted for a security device password (such as a smartcard PIN or Primary Password), the message load process could finish or be cancelled while the prompt remains open. This action prematurely frees ...

CVE-2026-113866 Account password sent unencrypted during Exchange account setup

When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the user had entered, allowing a network attacker to obtain the user's password. This vulnerabilit...

CVE-2026-113866

Thunderbird is vulnerable to an issue where account passwords are sent unencrypted during the Exchange account setup . The Exchange AutoDiscover lookup process erroneously queries the domain's AutoDiscover service over plain HTTP , including the user's entered credentials in the unencrypted reque...

CVE-2024-34102

Cosmic Sting: CVE-2024-34102 Exploiter Cosmic Sting is a Go-based tool designed to exploit CVE-2024-34102, Remote Code Execution vulnerability. CVE-2024-34102 Detail Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External...

CVE-2023-6538

CVE-2023-6538 CVE-2023-6538 is an Insecure Direct Object Reference IDOR in vulnerability found in Hitachi NAS' HNAS' System Management Unit SMU Configuration Backup & Restore functionality. This vulnerability affects SMU versions prior to 14.8.7825.01. Exploitation This exploit requires the...

EagleEye

$$$$$$$$\ $$\ $$$$$$$$\ $$ | $$ | $$ | $$ | $$$$$$\ $$$$$$\ $$ | $$$$$$\ $$ | $$\ $$\ $$$$$$\ $$$$$\ $$\ $$ $$\ $$ |$$ $$\ $$$$$\ $$ | $$ |$$ $$\ $$ | $$$$$$$ |$$ / $$ |$$ |$$$$$$$$ | $$ | $$ | $$ |$$$$$$$$ | $$ | $$ $$ |$$ | $$ |$$ |$$ | $$ | $$ | $$ |$$ | $$$$$$$$\$$$$$$$ |$$$$$$$ |$$...

gixy

GIXY Overview Gixy is a tool to analyze Nginx configuration. The main goal of Gixy is to prevent security misconfiguration and automate flaw detection. Currently supported Python versions are 2.7, 3.5, 3.6 and 3.7. Disclaimer: Gixy is well tested only on GNU/Linux, other OSs may have some issues...

Penetration_Testing_POC

PenetrationTestingPOC A collection of POCs, scripts, tools, articles, and other tips and techniques used in penetration testing, shared as notes. Contributions are welcome. Please be aware that all tools may contain backdoors or other abnormal behavior; it is recommended to operate in a virtual...

IronFox

IronFox F-Droid QR Code: IronFox is a fork of Divested Computing Group's Mull Browsermull, based on Mozilla Firefox. Our goal is to continue the legacy of Mull by providing a free and open source, privacy and security-oriented web browser for daily use. !TIP Find a bug? Encounter an annoying...