web-brutator

Web Brutator Fast Modular Web Interfaces Bruteforcer 📥 Install python3 -m pip install -r requirements.txt ⏩ Usage $ python3 web-brutator.py -h . / \ / \ \ | \ \ / | / | \ // // | \ | | /\ \ | \ \ \ \ / \ \ \ /\ /| \ \ // | | \ | | / | /| | / | | | / /\ / \ / | / || |/ || /| /|| / / / /...

jsmon

JSMon JSMon - JavaScript Change Monitor for BugBounty Using this script, you can configure a number of JavaScript files on websites that you want to monitor. Everytime you run this script, these files will be fetched and compared to the previously fetched version. If they have changed, you will b...

CVE-2026-102830

A flaw was found in JupyterLab. Incomplete validation of language pack headers allows arbitrary JavaScript code to be injected and executed during string translation. An attacker could exploit this flaw by enticing a user to load a malicious third-party language pack, resulting in code execution...

CVE-2026-102830

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append...

subjs

subjs subjs fetches javascript files from a list of URLS or subdomains. Analyzing javascript files can help you find undocumented endpoints, secrets, and more. It's recommended to pair this with gau and then https://github.com/GerbenJavado/LinkFinder Resources Usage Installation Usage: Examples: ...

cve-2022-42889-intercept

cve-2022-42889-intercept 低于 Java11版本的需要注意，更高的版本已经取消了Javascript解释器 本次方案针对 Java8 通过 jvm 启动参数 以及 jps pid进行拦截非法参数 quick start -----------------------load...... cve-2022-42889 check start cve-2022-42889 isdeepmatch org.apache.commons.text.StringSubstitutor md.getReturnType.getActualName java.lang.Stri...

AMSIext

AMSIext AMSIext 是一款 Firefox 和 Chrome 插件，允许你从浏览器向 AMSI 发送任意数据流。AMSI 是用于将 RAM 中的内容与 Windows Defender（或任何其他端点安全系统）通信的方式。这意味着在浏览网页时，AMSIext 会在恶意 JavaScript、PowerShell 等内容甚至可能被执行或下载到你的系统之前，提前向你发出警报！ AMSI 是 Windows 10 中将内存中的数据发送到首选防病毒解决方案的原生方式。它在 PowerShell 中默认处于活动状态，并且（很快）将在 Office...

Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

Summary When enablejsonp=True, oauthlib's RevocationEndpoint reflects the user-supplied callback parameter directly into JavaScript response bodies on both success and error paths without validating that it is a legal JSONP callback name. This allows arbitrary JavaScript response generation inste...

SecretFinder

about SecretFinder SecretFinder is a python script based on LinkFinder, written to discover sensitive data like apikeys, accesstoken, authorizations, jwt,..etc in JavaScript files. It does so by using jsbeautifier for python in combination with a fairly large regular expression. The regular...

CVE-2025-54100

CVE-2025-54100 El curl de Powershell utiliza Invoke-WebRequest internamente. PS C:\Users\melih curl cmdlet Invoke-WebRequest at command pipeline position 1 Supply values for the following parameters: Uri:...

cwe-sdk-javascript

cwe-sdk Un SDK de Node.js para Common Weakness Enumeration CWE compatible con MITRE / CAPEC Instalación yarn add cwe-sdk Uso Requiere la clase CweManager y usa sus métodos const CweManager = require'cwe-sdk' Ejemplo const CweManager = require'cwe-sdk' const cweManager = new CweManager const resul...

jshole

jshole 一个基于 RetireJS 的简单 JavaScript 组件漏洞扫描器。 为什么使用 JShole 而不是 RetireJS？ 默认情况下，RetireJS 只搜索一个页面，但 JShole 尝试爬取所有页面。 开始使用 依赖 requests 安装 git clone https://github.com/callforpapers-source/jshole.git cd jshole pip3 install -r requirements python3 jshole.py usage: jshole -h -u URL -d -l LIMIT -t THREAT...

jshole

jshole A simple JavaScript components vulnrability scanner, based on RetireJS. Why use JShole instead of RetireJS? By default, RetireJS only searches one page, but JShole tries to crawl all pages. Get Started Requirements requests Install git clone https://github.com/callforpapers-source/jshole.g...

CVE-2017-1000486

CVE-2017-1000486 Explotación de prueba de concepto para la inyección EL de PrimeFaces 5.x CVE-2017-1000486, una vulnerabilidad RCE que puede usarse para obtener ejecución remota de código en un objetivo. Descripción de la vulnerabilidad Puede encontrar una excelente descripción de la vulnerabilid...

JSAnalyzer

JS Analyzer - Extensión de Burp Suite por Jensec https://x.com/jensec Una potente extensión de Burp Suite para análisis estático de JavaScript. Extrae endpoints de API, URLs, secretos y direcciones de correo electrónico de archivos JavaScript con un filtrado inteligente de ruido. El objetivo es...

CVE-2026-97711

A flaw was found in serialize-javascript. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying crafted function code containing unescaped script-closing tags. When the serialized function is embedded within an HTML script element, the unescaped tag...

injectify

Injectify Perform advanced MiTM attacks on websites with ease. ✨ Support development on Patreon or one-time via Paypal Test it out | Installation | Docs | Trello | Discord View what's on the victims screen Ability to interact and click buttons Scrolling is synced two-way Data recording Database a...

jsunpack-n

jsunpack-n jsunpack-n emulates browser functionality when visiting a URL. It's purpose is to detect exploits that target browser and browser plug-in vulnerabilities. It accepts many different types of input: PDF files - samples/sample-pdf.file Packet Captures - samples/sample-http-exploit.pcap HT...

browser-backdoor

BrowserBackdoor BrowserBackdoor es una aplicación Electron que utiliza un backdoor WebSocket en JavaScript para conectarse al listener. BrowserBackdoorServer es un servidor WebSocket que escucha conexiones WebSocket entrantes y crea una interfaz de línea de comandos para enviar comandos al sistem...

awesome-ctf

Awesome CTF A curated list of Capture The Flag CTF frameworks, libraries, resources, softwares and tutorials. This list aims to help starters as well as seasoned CTF players to find everything related to CTFs at one place. Contributing Please take a quick look at the contribution guidelines first...