katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

paskto

Paskto - Escáner Web Pasivo Paskto escaneará pasivamente la web utilizando el índice de Common Crawl, ya sea descargando los índices a petición o analizando datos de su sistema local. Las URL se procesan luego a través de Nikto y listas de URL conocidas para identificar contenido interesante...

paskto

Paskto - Passive Web Scanner Paskto will passively scan the web using the Common Crawl internet index either by downloading the indexes on request or parsing data from your local system. URLs are then processed through Nikto and known URL lists to identify interesting content. Hash signatures are...

domdig

DOMDig DOMDig es un escáner de DOM XSS que se ejecuta dentro del navegador web Chromium y puede escanear aplicaciones de página única SPA de forma recursiva. A diferencia de otros escáneres, DOMDig puede rastrear cualquier aplicación web incluyendo gmail manteniendo un registro de las...

xurlfind3r

xurlfind3r xurlfind3r is a command-line utility designed to discover URLs for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly...

cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more Coded with 💙 by edoardottt Share on Twitter! Install • Usage • Get Started • Changelog • Contributing • License Installation 📡 Homebrew brew install cariddi Snap sudo snap install caridd...

Crawl4AI < 0.8.0 - Unauthenticated Remote Code Execution via Hooks Parameter

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...

urx

Extracts URLs from OSINT Archives for Security Insights. Urx is a command-line tool designed for collecting URLs from OSINT archives, such as the Wayback Machine and Common Crawl. Built with Rust for efficiency, it leverages asynchronous processing to rapidly query multiple data sources. This too...

gau

getallurls gau getallurls gau 从 AlienVault 的 Open Threat Exchange、Wayback Machine、Common Crawl 和 URLScan 获取给定域名的已知 URL。灵感来源于 Tomnomnom 的 waybackurls。 资源 使用 安装 ohmyzsh 说明 使用： 示例： $ printf example.com | gau $ cat domains.txt | gau --threads 5 $ gau example.com google.com $ gau --o example-urls.txt...

jshole

jshole A simple JavaScript components vulnrability scanner, based on RetireJS. Why use JShole instead of RetireJS? By default, RetireJS only searches one page, but JShole tries to crawl all pages. Get Started Requirements requests Install git clone https://github.com/callforpapers-source/jshole.g...

skipfish

=========================================== skipfish - escáner de seguridad de aplicaciones web http://code.google.com/p/skipfish/ Escrito y mantenido por: Michal Zalewski [email protected] Niels Heinen [email protected] Sebastian Roschke [email protected] Copyright 2009 - 2012...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol. Resources...

warcannon

WARCannon - Catastrophically powerful parallel WARC processing WARCannon was built to simplify and cheapify the process of 'grepping the internet'. With WARCannon, you can: Build and test regex patterns against real Common Crawl data Easily load Common Crawl datasets for parallel processing Scale...

warcannon

WARCannon - Procesamiento paralelo de WARC catastróficamente potente WARCannon fue construido para simplificar y abaratar el proceso de 'grep en internet'. Con WARCannon, puedes: Construir y probar patrones de expresiones regulares contra datos reales de Common Crawl Cargar fácilmente conjuntos d...

CVE-2026-82286-gpt-crawler-Arbitrary-File-Write

CVE-2026-82286 — gpt-crawler Escritura Arbitraria de Archivos sin Autenticación Prueba de concepto para una escritura arbitraria de archivos sin autenticación en BuilderIO/gpt-crawler ≈22k ★ a través del parámetro outputFileName del endpoint de API POST /crawl. | ---|--- CVE| CVE-2026-82286...

Exploit for CVE-2026-61732

CVE-2026-61732 — Decepticon ChatML role-boundary forgery lab...

CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-61732

Versions prior to 1.1.17 of Decepticon , an autonomous hacking agent, are vulnerable to a role-boundary forgery because they fail to neutralize ChatML special-token literals when wrapping web crawl results into LLM messages. When using the BYOK deployment model with common providers (such as vLLM...

EUVD-2026-67817

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...

CVE-2026-82286 gpt-crawler Arbitrary File Write via outputFileName Parameter

gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...