should-i-trust

should-i-trust Summary should-i-trust is a tool to evaluate OSINT signals for a domain. Requirements should-i-trust requires API keys from the following sources: Censys.io - Free for for first 250/quries/month VirusTotal - Free GrayHatWarFare - Free with limited results Use Case You're part of a...

AutoNessus

AutoNessus This script communicates with the Nessus API in an attempt to help with automating scans. Depending on the flag issued with the script, you can list all scans, list all policies, start, stop, pause, and resume a scan. It may be helpful to create a cron job/scheduled task for automating...

CVE-2019-14537

YOURLS: CVE-2019-14537 PoC When you get a valid timestamp you will be able to make requests to the api. http://domain.com/yourls-api.php?signature=0e1&action=db-stats&timestamp=VALIDTIMESTAMP Usage usage: main.py -h --vhost VHOST --threads THREADS --path PATH --port PORT ip CVE-2019-14537 PoC...

WebKit-NavigationAPI-SOP-Bypass

WebKit-NavigationAPI-SOP-Bypass WebKit Navigation API — Omisión de la Política de Mismo Origen mediante interceptación entre puertos CVE-2026-20643 | ---|--- CVE| CVE-2026-20643 Descubierto por| Thomas Espach WebKit Bugzilla 306050 Componente| WebKit —...

py3webfuzz

Py3webFuzz ';-- Python Web Fuzzing 模块库 Python3 模块兼容 作者 Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz 贡献者 Nathan Hamiel @nathanhamiel 描述 基于 pywebfuzz，Py3webfuzz 是一个 Python3 模块，用于通过暴力破解、模糊测试和分析来辅助识别 Web 应用程序和 Web 服务中的漏洞。该模块通过提供常见的测试值、生成器和其他实用程序，在模糊测试 Web 应用程序、API 端点以及开发 W...

CVE-2023-32117

CVE-2023-32117 Integrate Google Drive ","username":"admin","name":"admin","email":"[email protected]","role":"Administrator","folders":,"id":2,"avatar":"img alt='' src="http:///%5C/%5C/2.gravatar.com%5C/avatar%5C/b58996c504c5638798eb6b511e6f49af?s=32&d=mm&r=g"...

CVE-2026-101269

The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but...

reportly

Reportly 是一款 EntraID 用户活动报告工具。 关于本工具 本工具旨在帮助蓝队在云安全事件调查中快速获取信息。 运行时，研究者输入可疑用户和时间范围，即可生成一份详细报告，内容包括： 1. 用户信息 2. 用户执行的操作 3. 针对用户执行的操作 4. 用户登录及失败日志 使用方法 运行工具时，会显示身份验证链接和设备代码，请访问链接并输入代码完成验证。 输入可疑用户的用户主体名称（User Principal Name）。 按以下格式输入开始和结束时间：2022-11-16 建议时间跨度不超过一周。 报告生成完毕后，工具会输出“Your report is...

ReconDog

ReconDog 侦察瑞士军刀 主要特性 向导 + 命令行参数接口 可从标准输入（管道输入）提取目标并对其执行操作 所有信息通过 API 提取，不与目标直接接触 工具集 Censys：利用 censys.io 收集关于 IP 地址的大量信息。 NS 查找：执行名称服务器查询 端口扫描：扫描最常见的 TCP 端口 检测 CMS：可检测 400 多种内容管理系统 Whois 查询：执行 whois 查询 检测蜜罐：利用 shodan.io 检查目标是否为蜜罐 查找子域名：使用 findsubdomains.com 查找子域名 反向 IP 查询：执行反向 IP 查询以查找与 IP 地址关联的域...

HunterScrape

This is a python script using the hunter.io API to pull data on a target domain, then generate a target email list. This is primarily for password spraying using a tool like Go365 or TREVORspray. Usage: HunterScrape-Dev.py -h -d DOMAIN -k KEY -l LIMIT -f -o OUTFILE options: -h, --help show this...

CVE-2021-26814

CVE-2021-26814 A simple python PoC to exploit CVE-2021-26814 and gain RCE on Wazuh Manager v.4.0.0-4.0.3 through the API service. To run it, simply make the .py script executable and launch it with the required parameters. PoC.py -h -user USERNAME -pwd PASSWORD -lip SRCIP -lport SRCPORT -tip DEST...

apicheck

APICheck - The DevSecOps toolset for REST APIs .. image:: https://img.shields.io/badge/License-Apache%202.0-blue.svg :target: https://github.com/BBVA/apicheck/blob/master/LICENSE :alt: License .. image:: https://readthedocs.org/projects/apicheck/badge/?version=latest :target:...

RAT-via-Telegram

基于Telegram的RAT Dviros的说明： Windows 远程后渗透利用工具，通过 Telegram 控制（Python 2.7）， 最初由 Ritiek 创建，经 mvrozanti 分叉并修改，随后由本人再次修改。 此工具的全部目的是演示（作为“PoC”）通过 Telegram 控制已被攻陷的机器。 与我已编写的其他工具一样，我不鼓励任何非法活动。 此修改版本使用 Telegram Bot API v2，而非传统的 v1。主要变化是使用键盘按钮代替文本输入。 我将尝试添加新功能、修复漏洞，并在完成“mvrozanti”所需的修改后兼容 API v3。...

NetRipper

Description NetRipper is a post exploitation tool targeting Windows systems which uses API hooking in order to intercept network traffic and encryption related functions from a low privileged user, being able to capture both plain-text traffic and encrypted traffic before encryption/after...

twebit

Bitcoin analysis with machine learning How it works? 1- Get tweets from twitter 2- Filter tweets 3- Tweet classification with naive bayes algorithm Positive,negative and neut Installation git clone https://github.com/omergunal/twebit cd twebit pip3 install -r requirements.txt Update your api keys...

weevely3

Weevely - Weaponized web shell Description Weevely is a web shell designed for post-exploitation purposes that can be extended over the network at runtime. Upload weevely PHP agent to a target web server to get remote shell access to it. It has more than 30 modules to assist administrative tasks,...

Detours

Paquete Detours de Microsoft Research Detours es un paquete de software para supervisar e instrumentar llamadas a la API en Windows. Detours ha sido utilizado por muchos vendedores de software independientes ISV y también es utilizado por equipos de producto de Microsoft. Detours ahora está...

wordpress-batch-rce-lab

wp2shell: RCE por lotes en WordPress Un análisis técnico de CVE-2026-63030, un fallo lógico en el endpoint de lotes de la API REST de WordPress que permite que una solicitud anónima se envíe bajo la ruta y verificación de permisos de otra solicitud, encadenándose con CVE-2026-60137 inyección SQL...

GitDorker

GitDorker GitDorker is a tool that utilizes the GitHub Search API and an extensive list of GitHub dorks that I've compiled from various sources to provide an overview of sensitive information stored on github given a search query. The Primary purpose of GitDorker is to provide the user with a cle...

OSINT-Search

OSINT-Search Description Script in Python that applies OSINT techniques by searching public data using email addresses, phone numbers, domains, IP addresses or URLs. Create an account at https://pipl.com/api and get the API key. Create an account at https://www.opencnam.com/ and get the Account S...