writehat

WriteHat is a reporting tool which removes Microsoft Word and many hours of suffering from the reporting process. Markdown -- HTML -- PDF. Created by penetration testers, for penetration testers - but can be used to generate any kind of report. Written in Django Python 3. Features: Effortlessly...

httprobe

httprobe Take a list of domains and probe for working http and https servers. Install ▶ go install github.com/tomnomnom/httprobe@latest Basic Usage httprobe accepts line-delimited domains on stdin: ▶ cat recon/example/domains.txt example.com example.edu example.net ▶ cat recon/example/domains.txt...

MrHandler

MR.HANDLER MR.Handler is a specialized tool designed for responding to security incidents on Linux systems. It connects to target systems via SSH to execute a range of diagnostic commands, gathering crucial information such as network configurations, system logs, user accounts, and running...

CVE-2023-45540

HTML-Injection...

HtmlSmuggling

HtmlSmuggling HTML smuggling is a malicious technique used by hackers to hide malware payloads in an encoded script in a specially crafted HTML attachment or web page. The malicious script decodes and deploys the payload on the targeted device when the victim opens/clicks the HTML attachment/link...

maigret

Maigret English · 简体中文 · Français 📖 Documentation Maigret collects a dossier on a person by username only , checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling demo. Sponsors Noimosiny is a comprehensive...

reverie

reverie Automated Pentest Tools Designed For Parrot Linux this tool will make your basic pentesting task like Information Gathering, Security Auditing, And Reporting so this tool will do every task fully automatic. Usage Guide Download / Clone git clone https://github.com/baguswiratmaadi/reverie ...

huntr-com-bug-bounties-collector

huntr.com bugs collector New bug bountyvulnerabilities collector Requirements Chrome with GUI If you encounter trouble with script execution, check the status of VMs GPU features, if available. Chrome WebDriver Preview python3 main.py 2024-02-20 16:14:47.836189 1. Arbitrary File Reading due to La...

CVE-2023-33733

CODE INJECTION VULNERABILITY IN REPORTLAB PYTHON LIBRARY tl;dr This write-up details how an RCE in Reportlab - was found and exploited. Due to the prevalence of Reportlab in HTML to PDF processing, this vulnerability may be reachable in many applications that process PDF files, making this an...

CVE-2021-40444

CVE-2021-40444 Usage Ensure to run setup.sh first as you will need few directories. Once you have run the script, you should be able to run gen.py with the example given:- Usage python3 gen.py -d document/Sample.docx -p payload/payload.dll -i "http://10.10.10.10" -t html/template.html -c...

ParsingPeas

ParsingPeas 🥒 Automated PEASS collection + a clean, portable HTML report for CTF & lab privilege-escalation work. Run one command on the target. ParsingPeas pulls LinPEAS/WinPEAS from your Kali host, runs the scan, ships the output back, and turns it into a single self-contained HTML report you c...

CVE-2025-66849

CVE-2025-66849 Ghost CMS Privilege Escalation PoC Summary In Ghost Foundation Ghost CMS up to 6.4.0, the HTML block within the post draft editor fails to properly sanitize or encode user-supplied content, resulting in a stored cross-site scripting XSS vulnerability. A user with Contributor...

dalfox

Dalfox is a powerful open-source tool that focuses on automation, making it ideal for quickly scanning for XSS flaws and analyzing parameters. Its advanced testing engine and niche features are designed to streamline the process of detecting and verifying vulnerabilities. Key features Subcommands...

lazyrecon

/ \ / / \ /// / // Y / \ /| | | | / | / / \ / | /|| \ | / | / || |\ || | |/| |-||/ / / / | /| / | | /|| | || // |/// /\\|// | Usage ./lazyrecon.sh -d domain.com To exclude particular subdomains: ./lazyrecon.sh -d domain.com -e excluded.domain.com,other.domain.com About...

SnafflerParser

Snaffler Output File Parser Especially in large environments, the Snaffler output gets very large and time-consuming to analyze. This script parses the Snaffler output file TSV format required and: Beautifies results into readable tables and exports to TXT, CSV, HTML, JSON or PS Gridview. Generat...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

Clickjacking-Exploit-Detector

Clickjacking-Exploit-Detector The Clickjacking Exploit Detector uses webpage scanning techniques to identify potential vulnerabilities and provide analysis of those elements. Features HTML Scanning: Checks HTML elements and iframe elements that can be exploited for clickjacking. Warning of...

CVE-2006-3392

CVE-2021-42913 Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from...

cve-collector

CVE-Collector Simple Latest CVE Collector Written in Python There are various methods for collecting the latest CVE Common Vulnerabilities and Exposures information. This code was created to provide guidance on how to collect, what information to include, and how to code when creating a CVE...

CSRF-via-stored-XSS-for-PrivEsc

Chamilo LMS addLabelgetlang'Thread', $threadEntity-getTitle; 2. /public/main/forum/viewforum.php - Line 369 .$thread-getTitle.''; 3. There are more! Root Cause: Forum thread titles are stored without proper sanitization Thread titles are displayed without HTML escaping in multiple locations No...