slither

Slither, the smart contract static analyzer Join the Empire Hacking Slack - Discussions and Support Slither is a Solidity & Vyper static analysis framework written in Python3. It runs a suite of vulnerability detectors, prints visual information about contract details, and provides an API to...

JSONPath

（另请参阅 开发依赖的许可证） JSONPath Plus 分析、转换并从 JSON 文档（以及 JavaScript 对象）中选择性地提取数据。 jsonpath-plus 在原始规范的基础上进行了扩展，新增了一些额外的运算符，并明确了原始规范未明确说明的一些行为。 试试浏览器演示或 Runkit Node。 请注意：本项目目前没有积极维护。我们可能会接受有良好文档的 PR 或一些简单的更新，但不打算自行修复问题或添加新功能。 功能 符合 原始 jsonpath 规范 原始规范未提供的便捷添加或补充 ： ^ 用于获取匹配项的父级 用于获取匹配项的属性名 （以数组形式） 类型选择器...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

contrast

Contrast Security 提供的 CodeSec CodeSec 提供： 最快且最准确的 SAST 扫描器。 即时且可操作的扫描结果 — 支持扫描代码和无服务器环境。 通过 GitHub 或 Google 帐户实现无阻碍、无缝的登录流程。几分钟内即可完成从开始到结束的全部过程。 通过对您的 Lambda 函数运行扫描，您可以发现：最小权限身份和访问管理（IAM）漏洞（权限过于宽松的策略）以及修复建议。 安装 NPM： npm install --location=global @contrast/contrast Homebrew： brew tap...

ssh-audit

ssh-audit ssh-audit is a tool for ssh server & client configuration auditing. jtesta/ssh-audit v2.0+ is the updated and maintained version of ssh-audit forked from arthepsy/ssh-audit v1.x due to inactivity. Features Usage Screenshots Server Standard Audit Example Server Policy Audit Example Clien...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

lava

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

Binary Exploits

Exploit Database's Binary Exploits Binary exploits are located in the /bin-sploits/ directory. This is an official repository of The Exploit Database, a project sponsored by Offensive Security. Our repositories are: Exploits & Shellcodes: https://gitlab.com/exploit-database/exploitdb Binary...

snallygaster

snallygaster Finds file leaks and other security problems on HTTP servers. what? snallygaster is a tool that looks for files accessible on web servers that shouldn't be public and can pose a security risk. Typical examples include publicly accessible git repositories, backup files potentially...

TIWAP

完全に安全ではないWebアプリケーションプロジェクト TIWAP TIWAPは、Flaskで作られたWebセキュリティテストラボであり、セキュリティ愛好家がさまざまなWeb脆弱性について学ぶために作られました。DVWAに触発され、コントリビューターはさまざまなWeb脆弱性を再現するために最善を尽くしました。 このアプリケーションは教育目的専用であり、合法的な環境でWebハッキングを学ぶために作られています。 こちらで詳細を読む 免責事項 ラボはライブWebサーバー（内部または外部）ではなく、仮想マシンにインストールすることを強くお勧めします。...

burpcommander

burpcommander Ruby command-line interface to Burp Suite's REST API Usage burpcommander VERSION: 1.0.1 - UPDATED: 08/29/2018 -t, --target IP Address Defaults to 127.0.0.1 -p, --port Port Number Defaults to 1337 -k, --key API Key If you require an API key specify it here -i, --issue-type-id String...

CVE-2001-0932

CVE-2001-0932 Cooolsoft PowerFTP Server 2.0 3/2.10 - 多个拒绝服务漏洞 1 Exploit-db 发布：https://www.exploit-db.com/exploits/21162/ CVE-2001-0932 Cooolsoft PowerFTP Server 2.0 3/2.10 - 多个拒绝服务漏洞 2 Exploit-db 发布：https://www.exploit-db.com/exploits/21163/ 作者 Alex Hernandez 又名 @alt3kx...

crlfmap

CRLFMap CRLFMap is a tool to find HTTP Splitting vulnerabilities Why? I wanted to write a tool in Golang for concurrency I wanted to be able to fuzz both parameters and paths Installation go get github.com/ryandamour/crlfmap Help Available Commands: help Help about any command scan A scanner for...

vuln-bank

Vulnerable Bank Application 🏦 Una aplicación web deliberadamente vulnerable para practicar pruebas de seguridad de aplicaciones en Web, APIs y LLMs, revisión de código seguro e implementación de seguridad en pipelines de CI/CD. ⚠️ ADVERTENCIA: Esta aplicación es intencionalmente vulnerable y solo...

WebGoat.NET

Webgoat.NET 源代码：https://github.com/jerryhoff/WebGoat.NET 下载zip：https://github.com/jerryhoff/WebGoat.NET/zipball/master 该 Web 应用程序是一个学习平台，旨在教授常见的 Web 安全缺陷。它包含适用于大多数 Web 应用程序的通用安全缺陷，还包含专门针对 .NET 框架的课程。本应用中的练习旨在教授 Web 安全攻击以及开发者如何克服这些攻击。 警告：此 Web 应用程序包含大量安全漏洞，运行时将使您的计算机非常不安全！强烈建议在运行时完全断开计算机与所有网络的连接！...

qark

Quick Android Review Kit This tool is designed to look for several security related Android application vulnerabilities, either in source code or packaged APKs. The tool is also capable of creating "Proof-of-Concept" deployable APKs and/or ADB commands, capable of exploiting many of the...

snuffleupagus

Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...

Intel-Linux-Processor-Microcode-Data-Files

Intel Processor Microcode Package for Linux About The Intel Processor Microcode Update MCU Package provides a mechanism to release updates for security advisories and functional issues, including errata. In addition, MCUs are responsible for starting the SGX enclave on processors that support the...

prithvi

Prithvi A Report Generation Tool for Security Assessment Usage This project of ours could be used for report generation and its very easy to use. It includes following features 1. We can add Owasp Types and recommendation with details. 2. We can add Multiple Projects and work on it separately. 3...

kernel-exploits

Exploits del kernel de Linux Fecha| Enlace| Descripción| Vector| Impacto ---|---|---|---|--- 02.2016| CVE-2016-2384| Double-free en el controlador USB MIDI| USB + Local| LPE 03.2016| prefetch-side-channel| Bypass de KASLR mediante prefetch| Local| Fuga de información 12.2016| CVE-2016-9793|...