ragflow-audit

ragflow-audit RAGFlow three-vulnerability audit tool CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286 ssti : Detect and exploit SSTI - RCE in the StringTransform / Message components zipslip : Offline detection of path traversal in zip entries Zip Slip apikey : Derive API key from sharing link be...

CVE-2020-13937

CVE-2020-13937 1. Vulnerability Description： Apache Kylin has a RESTful API that exposes configuration information without any authentication. 2. Reproduction Vulnerable comparison Non-vulnerable comparison Writing PoC Verify correct single URL: pocsuite -r CVE-2022-26134.py -u url Verify...

api-security-audit-action

GitHub Action: 42Crunch REST API Static Security Testing The REST API Static Security Testing action locates REST API contracts that follow the OpenAPI Specification OAS, formerly known as Swagger and runs thorough security checks on them. Both OAS v2 and v3.0.x are supported, in both JSON and YA...

DLLHSC

DLLHSC DLL Hijack SCanner - A tool to generate leads and automate the discovery of candidates for DLL Search Order Hijacking Index of this page Contents of this repository Modes of operation Compile and Run Guidance Help menu Example Runs Feedback Contents of this repository This repository hosts...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 Data Extractor Build git clone https://github.com/JohnDoeAnonITA/CVE-2023-23752 cd CVE-2023-23752 go build . Usage CVE-2023-23752.exe -h|--help -u|--url "" -t|--type 1|2 Help / / / | // //// // //.'///'/ // //// / CVE-2023-23752 Data Extractor v0.1 Arguments: -h --he...

wpUsersScan

wpUsersScan About wpUsersScan Enumerate the users list of the wordpress websites through the REST API / CVE-2017-5487,WordPress 4.7.1 - Username Enumeration Usage $ python wpUsersScan.py URL How to install Clone Clone the repository with: $ git clone https://github.com/R3K1NG/wpUsersScan.git $ cd...

dirty_sock

dirtysock: Linux 権限昇格 snapd 経由 2019年1月、当時の Ubuntu Linux の現行バージョンが snapd API のバグによりローカル権限昇格の脆弱性の影響を受けることが判明しました。このリポジトリには、研究および教育用に公開されているオリジナルのエクスプロイト POC が含まれています。脆弱性とエクスプロイトの詳細なウォークスルーについては、 こちらのブログ投稿を参照してください。 Ubuntu には snapd...

NTDLL-Unhook

NTDLL Unhook proper ntdll .text section unhooking via native api. x86/x64/wow64 supported. How It Works The program walks the PEB to locate ntdll.dll base address and manually parses the PE export table to resolve NT API functions without touching the Import Address Table. It then uses NtOpenFile...

keyhacks

KeyHacksは、バグバウンティプログラムやペンテストで見つけたさまざまなAPIキーを検証する方法を示しています。 @Gwen001 が全プロセスをスクリプト化しており、こちらから入手できます。こちら 目次 ABTasty API Key Algolia API key Amplitude API Keys Asana Access token AWS Access Key ID and Secret Azure Application Insights APP ID and API Key Bazaarvoice Passkey Bing Maps API Key Bit.ly...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

SwaggerSpy

SwaggerSpy Overview SwaggerSpy is a tool designed for automated Open Source Intelligence OSINT on SwaggerHub. This project aims to streamline the process of gathering intelligence from APIs documented on SwaggerHub, providing valuable insights for security researchers, developers, and IT...

Cisco-CVE-2025-20281-illdeed

CVE-2025-20281 — Cisco ISE ERS API Unauthenticated RCE Exploit This repository contains a Python 3 proof-of-concept exploit for CVE-2025-20281 , a critical vulnerability in Cisco Identity Services Engine ISE that allows unauthenticated remote code execution RCE as root via the ERS API. 🩻...

WSSAT

WSSAT - Web Service Security Assessment Tool WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it...

akto

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...

notionterm

notionterm Embed reverse shell inNotion pages. Hack while taking notes FOR ➕: Hiding attacker IP in reverse shell No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell Demo/Quick proof insertion within report High available and shareable...

twitter-intelligence

Twitter インテリジェンス Twitter APIを使用せずにTwitterの追跡と分析を行うためにPythonで書かれたプロジェクト。 前提条件 このプロジェクトはPython 3.xアプリケーションです。 パッケージの依存関係はrequirements.txtファイルにあります。以下のコマンドを実行して依存関係をインストールしてください。 pip3 install -r requirements.txt データベース データベースとしてSQLiteが使用されています。...

safety

!NOTE Come and join us at SafetyCLI. We are hiring for various roles. Table of Contents Table of Contents Introduction Key Features Getting Started GitHub Action Command Line Interface 1. Installation 2. Log In or Register 3. Running Your First Scan Basic Commands Service-Level Agreement SLA...

sploit

sploit Sploit is a Go package that aids in binary analysis and exploitation. The motivating factor behind the development of sploit is to be able to have a well designed API with functionality that rivals some of the more common Python exploit development frameworks while taking advantage of the ...

BreakEscape

BreakEscape Rails Engine Cybersecurity training escape room game as a mountable Rails Engine. Features 24+ cybersecurity escape room scenarios Server-side progress tracking with 2-table schema Randomized passwords per game instance via ERB JIT Ink script compilation for NPC dialogue Polymorphic...

CVE-2024-28987

CVE-2024-28987 Proof of Concept Exploit for CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability Overview Extracts up to 25 most recent tickets API limitation Retrieves full details for each ticket Analyzes ticket IDs to estimate total tickets in system Organizes output in ...