zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

graphicator

Graphicator Graphicator is a GraphQL "scraper" / extractor. The tool iterates over the introspection document returned by the targeted GraphQL endpoint, and then re-structures the schema in an internal form so it can re-create the supported queries. When such queries are created is using them to...

rustbuster

rustbuster A Comprehensive Web Fuzzer and Content Discovery Tool Introduction Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool Download You can download prebuilt binaries from here. Installation root@kitploit: installrustbuster echo "Installing...

byp4xx

root@kitploit: / / / // / / / / / / / // /| |// |// / // / // / // / / Some cURL options you may use as example: -L follow redirections 30X responses -x : to set a proxy -m to set a timeout -H for new headers. Escape double quotes. -d for data in the POST requests body -... Built-in options:...

crawpy

Crawpy Yet another content discovery tool written in python. What makes this tool different than others: Sends asynchronous HTTP requests, fast Calibration mode, applies filters on its own Recursive scan mode with additional flags Report generation, you can later go and check your results Multipl...

femida

Femida-xss WIP An automated blind-xss search plugin for Burp Suite. Installation Git clone https://github.com/wish-i-was/femida.git Burp - Extender - Add - find and select blind-xss.py How to use Settings First of all you need to setup your callback URL in field called "Your url" and press Enter ...

traefik-CVE-2024-45410-poc

Shadow Corp CTF 챌린지 Shadow Corp Capture the Flag CTF 챌린지에 오신 것을 환영합니다! 이 챌린지는 보안 헤더 및 HTTP 프록시 동작과 관련된 취약점을 식별하고 악용하는 능력을 테스트합니다. 여러분의 임무는 보호를 우회하고 Shadow Corp 웹 애플리케이션에 숨겨진 비밀을 찾아내는 것입니다. 스토리 당신은 악명 높은 은밀한 사이버 스파이 조직인 Shadow Corp의 공개 웹 인터페이스를 발견했습니다. 소문에 따르면, 신뢰할 수 있는 내부자만 접근할 수 있는 보호된 엔드포인트를...

avcleaner

avcleaner C/C++ source obfuscator for antivirus bypass Blog posts The implementation is rather complex and this domain in software development is rarely documented in layman's terms. This is why there are blog posts which detail every design choice and go over the quirks of working with the LLVM...

slowloris

slowloris.py - Simple slowloris in Python What is Slowloris? Slowloris is basically an HTTP Denial of Service attack that affects threaded servers. It works like this: 1. We start making lots of HTTP requests. 2. We send headers periodically every 15 seconds to keep the connections open. 3. We...

go-dork

go-dork The fastest dork scanner written in Go. There are also various search engines supported by go-dork, including Google, Shodan, Bing, Duck, Yahoo and Ask. Install Usage Basic Usage Flags Querying Defining engine Pagination Adding custom headers Using proxy Chained with other tools Supportin...

SqliSniper

Features • Installation • Usage • Running SqliSniper • Contributing • SqliSniper is a robust Python tool designed to detect time-based blind SQL injections in HTTP request headers. It enhances the security assessment process by rapidly scanning and identifying potential vulnerabilities using...

htrace.sh

Description htrace.sh is a shell script for http/https troubleshooting and profiling. It's also a simple wrapper around several open source security tools. For a more detailed understanding of htrace.sh, its parameters, functions and how it all works, run htrace.sh --examples or see the Wiki...

CVE-2025-65681

CVE-2025-65681 An issue was discoverd in Overhang.IO tutor-open-edx overhangio/tutor 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks. Discovered by - Rivek Raj Tamang RivuDo...

Blisqy

1. Blisqy Blisqy is a tool to aid Web Security researchers to find Time-based Blind SQL injection on HTTP Headers and also exploitation of the same vulnerability. The exploitation enables slow data siphon from a database currently supports MySQL/MariaDB only using bitwise operation on printable...

Tomcat-CVE-2025-31650

CVE-2025-31650 🚨 Proof of Concept PoC for Apache Tomcat HTTP/2 DoS vulnerability CVE-2025-31650 This script triggers a memory exhaustion condition in Apache Tomcat by sending malformed priority headers over HTTP/2. 🎯 Affected Versions Apache Tomcat 9.0.76 – 9.0.102 Apache Tomcat 10.1.10 – 10.1.39...

sniffly

Sniffly2 Sniffly2 は、HTTP Strict Transport Security ヘッダーと Performance Timing API を悪用して Chromium ベースのブラウザで閲覧履歴をスニッフィングする Sniffly の亜種です。 デモ Chrome/Chromium/Brave などで HTTPS Everywhere を無効にして http://diracdeltas.github.io/sniffly にアクセスしてください。 注意点: モバイルや Firefox では動作しません HTTPS 経由では、混合コンテンツブロックのため動作しません...

CVE-2020-17518

Apache Flink directory traversal vulnerability, allows remote file read/write via REST API Vulnerability ID: CVE-2020-17518 Vulnerability Description: CVE-2020-17518: Write remote files via REST API Affected Versions: Flink 1.5.1-1.11.2 Safe Versions: Flink 1.11.3 or Flink 1.12.0 Flink 1.5.1...

CVE-2026-48204

CVE-2026-48204 — camel-mongodb-gridfs gridfs. Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

VulnScan

VulnScan Scanner di vulnerabilita' web. Fa il crawling di un sito, trova form e parametri, e li prova contro SQL injection, XSS riflesso, path traversal e header di sicurezza mancanti. Produce un report a terminale, un PDF e ha una dashboard Flask. Progetto di apprendimento. L'ho scritto per capi...

-CVE-2024-6095

Miglioramenti chiave: 1. Obfuscazione tramite stringhe casuali : Introduzione della generazione di stringhe casuali per offuscare i percorsi, rendendo più difficile il rilevamento. 2. Payload avanzati : Aggiunta di payload più sofisticati con diverse tecniche di offuscamento per eludere i...