dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

Halcyon-IDE

Halcyon IDE Description Halcyon IDE is the first IDE exclusively developed for Nmap Script developers. This project initially started as a free time coffee shop project. The original idea was to provide an easier development interface to information security community working on Nmap script...

CVE-2023-25157

Vulnerability Description Due to the lack of input filtering, remote unauthenticated attackers can craft malformed filter syntax, bypass GeoServer's lexical parsing, leading to SQL injection, obtaining sensitive information from the server, and possibly gaining database server privileges. Affecte...

deepsecrets

OWASP DeepSecrets — a better tool for secrets scanning What is it? Another token-wasting CLI proxy to an AI API? Absolutely not! In our LLM-hype era, DeepSecrets still runs entirely on your machine — giving you great results offline, securely, and for free. So why yet another tool? Most existing...

tko-subs

tko-subs This tool allows: To check whether a subdomain can be taken over because it has: a dangling CNAME pointing to a CMS provider Heroku, Github, Shopify, Amazon S3, Amazon CloudFront, etc. that can be taken over. a dangling CNAME pointing to a non-existent domain name one or more wrong/typoe...

hackersh

======== Hackersh Hackersh "Hacker Shell" is a shell command interpreter written in Python with Pythonect-like syntax, builtin security commands, and out of the box wrappers for various security tools. Hello, world Here is the canonical "Hello, world" example program in Hackersh::...

safetext

safetext This is not an officially supported Google product. Safe-by-construction libraries for producing formats like YAML, to replace syntax-unaware libraries like text/template and sprintf that are at risk of injection vulnerabilities. Example use-case Since text/template is not syntax-aware o...

GAMBA

GAMBA GAMBA is a tool for the simplification of mixed Boolean-arithmetic expressions MBAs. GAMBA is short for General Advanced Mixed Boolean Arithmetic simplifier. It uses the linear algebraic simplifier SiMBA to iteratively simplify linear subexpressions of a potentially nonlinear input MBA...

xwiki__xwiki-rendering_CVE-2023-37908_14-10-3

XWiki Rendering XWiki Rendering is a generic Rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. XWiki Platform, XWiki Commons and XWiki Rendering are part of the XWiki.org software forge. They are released together and share the...

filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

nuclei-burp-plugin

Nuclei Template Generator Burp Plugin A Burp Suite plugin intended to help with nuclei template generation. Features Template matcher generation Word and Binary matcher creation using selected response snippets from Proxy history or Repeater contexts Multi-line selections are split to separate...

Advanced-SQL-Injection-Cheatsheet

MySQL Error based SQL Injection Cheatsheet This is probably the easiest vulnerability along the SQL Injection attack. An attacker can enumerate and dump the MySQL database by using the SQL error messages to his advantage. Detecting the vulnerability http://domain.com/index.php?id=1 Website loads...

SASM

SASM SimpleASM - простая кроссплатформенная среда разработки для языков ассемблера NASM, MASM, GAS, FASM с подсветкой синтаксиса и отладчиком. В SASM Вы можете легко разрабатывать и выполнять программы, написанные на языках ассемблера NASM, MASM, GAS, FASM. Вводите код в форму и запускайте...

apkstudio

APK Studio Open-source, cross platform Qt6 based IDE for reverse-engineering Android application packages. It features a friendly IDE-like layout including code editor with syntax highlighting support for .smali code files. Features Cross platform, run on Linux , Mac OS X & Windows...

nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

rp

rp++: a fast ROP gadget finder for PE/ELF/Mach-O x86/x64/ARM/ARM64 binaries Overview rp++ or rp is a C++ ROP gadget finder for PE/ELF/Mach-O executables and x86/x64/ARM/ARM64 architectures. Finding ROP gadgets To find ROP gadget you need to specify a file with the --file / -f option and use the...

threatcl

threatcl Threat Modeling with HCL What happened to hcltm? hcltm has been renamed to threatcl. Welcome! Overview !TIP Want to read the new documentation? Head over to threatcl.dev There are many different ways in which a threat model can be documented. From a simple text file, to more in-depth wor...

CVE-2024-1874

CVE-2024-1874 Proof Of Concept for CVE-2024-1874 Command Injection via Array-ish $command Parameter of procopen bypass CVE-2024-1874 fix The CVE: In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailin...

bithoven

Bithoven 🎼 A High-Level, Imperative Language for Bitcoin Smart Contracts Bithoven is a type-safe, developer-friendly programming language designed to compile down to native Bitcoin Script. It bridges the gap between complex smart contract logic and the low-level stack machine of the Bitcoin Virtu...

Flerken

Flerken Introduction Command Line Obfuscation CLOB has been proved to be a non-negligible factor in fileless malware or malicious actors that are "living off the land". With dozens of obfuscation tools seen in the wild, by contrast few proper countermeasures can be found. In this talk, we present...