trevorc2

trevorc2 TrevorC2 - Command and Control via Legitimate Behavior over HTTP Written by: Dave Kennedy @HackingDave Website: https://www.trustedsec.com Note that this is a very early release - heavy randomization and encryption to be added soon. TrevorC2 is a client/server model for masking command a...

TomcatKiller-CVE-2025-31650

TomcatKiller-CVE-2025-31650 A tool designed to detect the vulnerability CVE-2025-31650 in Apache Tomcat versions 10.1.10 to 10.1.39 This vulnerability allows an attacker to trigger a memory leak by sending specially crafted HTTP/2 requests with invalid priority headers, leading to a...

cansina

Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...

rapidscan

🟥 RapidScan v1.2 - The Multi-Tool Web Vulnerability Scanner RapidScan has been ported to Python3 i.e. v1.2. The Python2.7 codebase is available on v1.1 releases section. Download and use it if you still haven't upgraded to Python 3. Kindly note that the v1.1 Python2.7 will not be enhanced further...

cve-2021-44228

CVE-2021-44228 A Zeek package which raises notices, tags HTTP connections and optionally generates a log for Log4J CVE-2021-44228 attempts. Detects payload contained in HTTP headers: See Simplifying Detection of Log4Shell for details. Uses Zeek signatures to generate notices when a Java file is...

raider

Raider logo Quick links Website. OWASP page. Documentation. Installation. FAQ. Getting started. Architecture. Discussions. Issues. Twitter. Fediverse. What is Raider OWASP Raider was developed with the goal to improve web authentication testing. By now it has evolved and can be used for all kinds...

burner-net

BurnerNet Zero-trust, anti-forensic HTTP client. Wipes secrets. Severs traces. CPR in a Stealth Tank. 👻 BurnerNet is a C++20 anti-forensic HTTP client. It provides a fluent, CPR-like API for apps that cannot fully trust the local machine—physically wiping secrets from RAM and severing execution...

SharpWebServer

SharpWebServer A Red Team oriented simple HTTP & WebDAV server written in C with functionality to capture Net-NTLM hashes. To be used for serving payloads on compromised machines for lateral movement purposes. Requires .NET Framework 4.5 and System.Net and System.Net.Sockets references. Usage ::...

CVE-2021-41773_CVE-2021-42013

Apache HTTP Server 2.4.49, 2.4.50 - Path Traversal & RCE Exploit Author: Lucas Souza https://ls4ss.github.io/ Vendor Homepage: https://apache.org/ Version: 2.4.49, 2.4.50 Tested on: 2.4.49, 2.4.50 CVE : CVE-2021-41773, CVE-2021-42013 Credits: Ash Daulton and the cPanel Security Team Usage ./PoC.s...

Oracle-WebLogic-CVE-2022-21371

Oracle-WebLogic-CVE-2022-21371 Oracle WebLogic Server Local File Inclusion : CVE-2022-21371 Affected Version: Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 Description: The Oracle Fusion Middleware's Oracle WebLogic Server product Web Container component is vulnerable to local file...

HTTP3ONSTEROIDS

Table of contents Vulnerability Description Source Code Review Lab Setup Identifying the issue References Vulnerability Description HAProxy's HTTP/3 implementation fails to block a malformed HTTP header field name , and when deployed in front of a server that incorrectly process this malformed...

Pummel

██████╗ ██╗ ██╗███╗ ███╗███╗ ███╗███████╗██╗ ██╔══██╗██║ ██║████╗ ████║████╗ ████║██╔════╝██║ ██████╔╝██║ ██║██╔████╔██║██╔████╔██║█████╗ ██║ ██╔═══╝ ██║ ██║██║╚██╔╝██║██║╚██╔╝██║██╔══╝ ██║ ██║ ╚██████╔╝██║ ╚═╝ ██║██║ ╚═╝ ██║███████╗███████╗ ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚══════╝ Disclaimer:...

wonitor

web monitor fast, zero config web endpoint change monitor. for comparing responses, a selected list of http headers and the full response body is stored on a local key/value store file. no configuration needed. to increase network throughput, a --worker flag allows to set the concurrency when...

openentropy

openentropy Measure and operationalize hardware entropy for research and security. Collect entropy from on-device hardware sources, analyze source quality with statistical tests, and deliver raw or conditioned output through CLI, Rust, Python, and HTTP interfaces. One workflow for entropy researc...

CVE-2025-0108-PoC

CVE-2025-0108 Proof of Concept PoC This repository contains a Proof of Concept PoC for the CVE-2025-0108 vulnerability, which is an authentication bypass issue in Palo Alto Networks' PAN-OS software. The scripts provided here test for the vulnerability by sending a crafted HTTP request to the...

CVE-2026-109760

A mitigation bypass exists in the Networking: HTTP component of the Firefox web browser. This vulnerability was addressed in Firefox 158 and Firefox ESR 153.5 . Specific details regarding the underlying root cause or practical consequences are not provided in the available documents. No informati...

CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

ruler

Introduction Ruler is a tool that allows you to interact with Exchange servers remotely, through either the MAPI/HTTP or RPC/HTTP protocol. The main aim is abuse the client-side Outlook features and gain a shell remotely. The full low-down on how Ruler was implemented and some background regardin...

py3webfuzz

Py3webFuzz ';-- Python Web Fuzzing module Library Python3 Module Compatible Author Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Contributors Nathan Hamiel @nathanhamiel DESCRIPTION Based on pywebfuzz, Py3webfuzz is a Python3 module to assist in the identification of...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...