log-add-http-post-bodies

Add POST body excerpt to the HTTP log This script gives analysts the ability to peek into what is being sent in HTTP POST bodies. It provides this by simply extending the HTTP log. Installation :: zkg refresh zkg install corelight/log-add-http-post-bodies Usage The HTTP log will have a new field...

apache_normalize_path

CVE-2021-41773|CVE-2021-42013: Path Traversal Zero-Day in Apache HTTP Server Exploited On October 5, the Apache HTTP Server Project patched CVE-2021-41773, a path traversal and file disclosure vulnerability in Apache HTTP Server, an open-source web server for Unix and Windows that is among the mo...

ASP.NET Core Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network...

haptyc

Haptyc Test Generation Framework What's Haptyc? Haptyc is a python library which was built to add payload position support and Sniper/Clusterbomb/Batteringram/Pitchfork attack types into Turbo Intruder. While Haptyc accomplishes these goals fairly well it also introduces a simpler way to express...

tomcat-line-check

tomcat-line-check CVE-2026-24880 · GHSA-563x-q5rq-57qp —— Apache 那句 upgrade to version 11.0.20, 10.1.52 or 9.0.116 对你成不成立? 对多数人不成立,而且有四种不同的不成立方式。这个工具扫你的构件,告诉你是哪一种。 java -jar tomcat-line-check.jar /path/to/tomcat 解压部署的 Tomcat java -jar tomcat-line-check.jar app.war war java -jar...

CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 POC with Docker Configuration To customize the httpd.conf file, change line 251 in the section from Require all denied to Require all granted. AllowOverride none Require all granted Create a Dockerfile in your project FROM httpd:2.4.49 COPY ./httpd.conf...

cc-ddos

Please Star this repo if you find it useful, because it's free : Donation information in the release The script still works normally, tested in 2025. cc-ddos A Python script to DDOS a website using multiple HTTP Flood methods, a normal website only needs 5 seconds to completely crash! How to Use:...

bothan

bothan Confirm an ip:port is hosting Empire. Eventual support for other C2s. Usage Direct single query ❯❯ bothan -v localhost:8080 DEBU2020-01-19T20:25:02-05:00 Requesting... host="localhost:8080" INFO2020-01-19T20:25:02-05:00 SUCCESS host="http://localhost:8080" tool=empire Take a pre-existing...

h2t

h2t - HTTP Hardening Tool Description h2t is a simple tool to help sysadmins to hardening their websites. Until now h2t checks the website headers and recommends how to make it better. Dependences Python 3 colorama requests Install $ git clone https://github.com/gildasio/h2t $ cd h2t $ pip instal...

CVE-2026-24733

CVE-2026-24733 What is CVE-2026-24733? Apache Tomcat incorrectly handled an HTTP/0.9-style HEAD request under certain security-constraint configurations. CVE-2026-24733 Defensive Verifier A lightweight, dependency-free Python security verifier for CVE-2026-24733 , an Apache Tomcat HTTP/0.9 HEAD...

CVE-2025-29927

CVE-2025-29927 Next.js Middleware Bypass Scanner CVE-2025-29927 CVE-2025-29927 is a specialized security tool for detecting the Next.js middleware bypass vulnerability CVE-2025-29927 affecting Next.js versions 11.1.4 through 15.2.2. This critical vulnerability allows attackers to bypass security...

ParamFinder

ParamFinder Discover hidden parameters straight from Caido! Installation Via Community Store Recommended 1. In your Caido, go to the Plugins page 2. Navigate to the Community Store 3. Search for ParamFinder 4. Click Install 5. Done! 🎉 Manual Installation 1. Navigate to the Releases page 2. Downlo...

Arkhota

Arkhota, a web brute forcer for Android What? Arkhota is a web HTTP/S brute forcer for Android OS. Why? A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather...

apatchy

apatchy An in-process fuzzing framework for Apache HTTPD apatchy lets you fuzz Apache's full HTTP request processing pipeline - parsing, hooks, filters, handlers - without any network I/O. It replaces Apache's socket layer with custom I/O filters, feeding raw bytes directly into the same code pat...

httpgrep

Description A fast, asynchronous Python tool that scans HTTPS servers and greps for strings or regex patterns in HTTP response bodies and headers. It takes single hosts, URLs, CIDR ranges, IP ranges or files; scans multiple ports per target single, comma-lists or ranges, auto-detecting TLS vs pla...

PutScanner

🔍 PUT Directory Scanner A penetration testing tool that identifies writable web directories via HTTP PUT method, specifically designed to detect CVE-2025-24813 Arbitrary File Upload in Apache Tomcat. 📌 Features Smart Protocol Handling : Auto-detects HTTPS/HTTP with fallback Comprehensive Checks :...

CVE-2016-10140-Zoneminder-Poc

ZoneMinder Unauthorized Access CVE-2016-10140 Poc -- Batch Verification Script Vulnerability Description ZoneMinder is an open-source video surveillance system. When abnormal events occur, you can receive email or SMS notifications. There is an information disclosure and authentication bypass...

http-breakout-proxy

HTTP Breakout Proxy A lightweight HTTP/HTTPS intercepting proxy and traffic analysis tool written in Go, with a web-based UI for inspecting, filtering, coloring, and annotating captured traffic in real time. Overview HTTP Breakout Proxy functions as both an HTTP and HTTPS MITM proxy and a live...

cve-2023-20198

cve-2023-20198 Description. 1vere$k POC on the CVE-2023-20198 based on the Blog. Also including a check on hexademical response according to the original Cisco article. The script works in the two modes: check mode which is just makes a connection for the particular URL and checks a response code...

CVE-2026-25089

🚨 CVE-2026-25089 - Critical OS Command Injection in FortiSandbox 📖 Overview CVE-2026-25089 is a critical OS Command Injection CWE-78 vulnerability affecting multiple Fortinet FortiSandbox deployments. An unauthenticated remote attacker can exploit this flaw by sending specially crafted HTTP...