csv-plus_vulnerability

csv-plusvulnerability 👻 2-Click Arbitrary Code Execution Vulnerability. CVE-2022-21241 ⚠ This PoC was created to alert users and investigate vulnerabilities in their own CSV+, and is prohibited to be used for attacks. Vulnerability The following versions are vulnerable. CSV+ click me 👻...

otseca

Open source security auditing tool to search and dump system configuration. Introduction | Description | Requirements | Output | Parameters | Reports | How it works | Other Introduction The main goal The main assumption of creating this tool was easier and faster delivery of commands sets to be...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

HTMLSmuggler

HTMLSmuggler ✉️ HTMLSmuggler - JS payload generator for IDS bypass and payload delivery via HTML smuggling. Description The full explanation what is HTML Smuggling may be found here. The primary objective of HTML smuggling is to bypass network security controls, such as firewalls and intrusion...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol. Resources...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 HTML属性からURLをクロールインで高速に取得するツール。@omespino Tweetに触発され、Chrome DevTools Protocolを通じてJavaScriptを評価することでsrc、href、url、actionの値を抽出可能です。 リソース インストール バイナリから ソースから GitHubから 使い方 基本使用 フラグ 例 単一URL リストからURL 標準入力から ライブラリ TODO ヘルプとバグ ライセンス バージョン 謝辞...

gitcolombo

Gitcolombo GitリポジトリやGitHubから名前、メールアドレス、一見無関係なアカウント間のリンクといったアイデンティティを抽出するOSINTツールです。 Python CLI gitcolombo.py — リポジトリをクローンし、git log を辿り、よりリッチなシグナルを得るためにGitHub APIを呼び出すことも可能。 Web版 gitcolombo.html — 単一の静的HTMLファイル。ブラウザで開き、GitHub APIに直接問い合わせます。インストール不要。...

thedorkbox

thedorkbox TheDorkbox Comprehensive collection of Google Dorks & OSINT techniques to find Confidential Data Welcome to thedorkbox 👋 This is an OSINT tool which consists of various Google dorks embedded into HTML template so that non-technical users get the importance of OSINT techniques and how...

CVE-2023-33733

CVE-2023-33733 on Reportlab v3.6.12 This lab was set up to test CVE-2023-33733. Analyzing process You can see our analyzing process about this CVE in PDF file on main repo. Setup and Run Server Setup pip3 install -r requirements.txt Run python3 app.py Attacker Connect to server Connect to server ...

reverie

reverie Automated Pentest Tools Designed For Parrot Linux this tool will make your basic pentesting task like Information Gathering, Security Auditing, And Reporting so this tool will do every task fully automatic. Usage Guide Download / Clone git clone https://github.com/baguswiratmaadi/reverie ...

CVE-2023-45540

HTML-Injection...

maigret

Maigret English · 简体中文 · Français 📖 Documentation Maigret collects a dossier on a person by username only , checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling demo. Sponsors Noimosiny is a comprehensive...

BFuzz

BFuzz BFuzz is currently in beta. BFuzz is an input based fuzzer tool which take .html as an input, open's up your browser with a new instance and pass multiple testcases generated by domato which is present in recurve folder of BFuzz, more over BFuzz is an automation which performs same task...

prometheus

Installing Prometheus Prometheus is a Ruby application and will run on any system running a recent version 1.8.7 or higher of Ruby. To install Prometheus use the following steps: 1. Create a directory called prometheus. 2. Extract the prometheus files into the directory. 3. CD into the prometheus...

CVE-2021-29267

CVE-2021-29267 SherlockIM ChatBot XSS Suggested description: SherlockIM is vulnerable to Persistent XSS. Additional Information: SherlockIM - Platform for manage all kind of conversations with customers. Vulnerability Type: Cross Site Scripting XSS A letter was sent to the vendor about the...

httprobe

httprobe Take a list of domains and probe for working http and https servers. Install ▶ go install github.com/tomnomnom/httprobe@latest Basic Usage httprobe accepts line-delimited domains on stdin: ▶ cat recon/example/domains.txt example.com example.edu example.net ▶ cat recon/example/domains.txt...

CVE-2020-6418

CVE-2020-6418 The CVE 2020-6418 is about the the type confusion in V8 in Google chrome.The affected versions were prior to 80.0.3987.122. The vulnerability is achived by remote attacker accessing the shell of a target device via a crafted HTML page. Environment Requirements 1. Google Chrome with...

CVE-2006-3392

CVE-2006-3392 説明 Webmin 1.290未満およびUsermin 1.220未満では、HTMLをデコードする前にsimplifypath関数を呼び出します。これにより、リモート攻撃者が任意のファイルを読み取ることが可能になります。これは、「..%01」シーケンスを使用して実証されています。このシーケンスは、ファイル名から「%01」などのバイトが削除される前に「../」シーケンスの削除をバイパスします。注: これはCVE-2006-3274とは異なる問題です。 実行 $ python3 CVE-2006-3392.py -u http://127.0.0.1:10000 ...

custom-bytecode-analyzer

custom-bytecode-analyzer JSONルールでカスタマイズ可能なJavaバイトコードアナライザ。これはコマンドラインツールで、1つ以上のJarまたはWarファイルを含むパスを受け取り、提供されたルールを使用して解析し、結果のHTMLレポートを生成します。 使用方法 usage: java -jar cba-cli.jar OPTIONS -a DIRECTORYTOANALYZE -a,--analyze 解析を実行するディレクトリのパス。 -c,--checks 解析で実行されるカスタムチェックのスペース区切りリスト。 -f,--custom-file...

custom-bytecode-analyzer

custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...