Sharepoint-cve-2023-29375-incident-response

SOC Incident Analysis: Microsoft SharePoint Server Elevation of Privilege CVE-2023-29375 An in-depth security investigation of a critical exploit and enumeration attempt targeting a Microsoft SharePoint server. Incident Overview Alert Name: SOC227 - Microsoft SharePoint Server Elevation of...

CVE-2020-16846-Saltstack-Salt-API

CVE-2020-16846-Saltstack-Salt-API Vulnerability Explained: An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. The details about this vulnerability can be found here:...

phpstress

phpstress Night Lion Security proof of concept denial of service / stress tester for PHP websites running with Apache and NGINX systems PHP-FPM and PHP-CGI Using a standard cable/DSL connection, this attack can flood a Linux web server’s CPU and RAM using standard HTTP requests. This attack effec...

jsfinder

Features | Installation | Usage | Demo | TODOs| Contact jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the UR...

xcat

XCat XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities. For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/ It supports an large number of features: Auto-selects injections run xcat injections for a list Detects t...

dirsearch

DirSearch Este software es una implementación en Go del dirsearch tool original escrito por Mauro Soria. DirSearch es la primera herramienta que escribo en Go, principalmente para jugar y experimentar con el modelo de concurrencia de Go, canales, etc. : Propósito DirSearch toma una URL de entrada...

filebuster

Filebuster Un fuzzer web extremadamente rápido y flexible ¿Qué es? Filebuster es un script de fuzzing HTTP / descubrimiento de contenido con muchas características, diseñado para ser fácil de usar y rápido. Utiliza una de las clases HTTP más rápidas del mundo de PERL - Furl::HTTP. Además, el...

burp-dom-scanner

Burp DOM Scanner It's a Burp Suite's extension to allow for recursive crawling and scanning of Single Page Applications. It runs a Chromium browser to scan the webpage for DOM-based XSS. It can also collect all the requests XHR, fetch, websockets, etc issued during the crawling allowing them to b...

badBANANA-threat-observatory

badBANANA // THREAT OBSERVATORY An evidence-first threat-observation system that keeps current source state, material-change events, and operational fetch telemetry semantically separate. Missing, stale, disabled, or unavailable data remains visibly missing. The interface never substitutes demo...

inforfinder

Inforfinder =========== Inforfinder is a tool made to collect information of any domain pointing at a server ip,domain,range,file. Requires python libs: pyRequests, lxml and py3DNS You can do the installation, with pip or you can install the inforfinder app as a package using python setup.py...

Re2Pcap

Re2Pcap: Crea archivos PCAP a partir de peticiones o respuestas HTTP sin procesar en segundos Re2Pcap es la abreviatura de Request2Pcap y Response2Pcap. Los usuarios de la comunidad pueden crear rápidamente un archivo PCAP usando Re2Pcap y probarlos contra las reglas de Snort. Re2Pcap te permite...

CVE-2026-82579

Loop with Unreachable Exit Condition Infinite Loop vulnerability in ash-project ashai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests. AshAi.ToolLoop classifies a model response of :toolcalls, then filters the calls through...

gitGRAB

gitGRAB Instalar Requests root@kitploit: pip install requests Ejecutar el programa root@kitploit: python3 gitgrab.py...

dnsteal

dnsteal v 2.0 This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below are a couple of different images showing examples of multiple file transfer and single verbose file transfer: Support for multiple files Gzip compression supported...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

kit-oauth

kit-oauth Biblioteca cliente OAuth 2.0 para aplicaciones Kit TOC Archivos Archivo| Descripción ---|--- .editorconfig| Configuración de formato del editor .gitignore| Reglas de ignorado de Git para artefactos de compilación y dependencias .tool-versions| Versiones de herramientas asdf Zig, Kit...

CVE-2026-50522

CVE-2026-50522 Microsoft SharePoint CVE-2026-50522 payloads and analysis. HTTP requests...

CVE-2022-46364-Poc

CVE-2022-46364 Exploit Apache CXF SSRF via MTOM XOP:Include | CVSS 9.8 CRITICAL Vulnerability Apache CXF -s -d -t, --target - Vulnerable CXF SOAP endpoint required -s, --ssrf-url - Internal URL to exfiltrate required -d, --domain - Target domain default: localhost --plain-soap - Use plain SOAP...

EUVD-2026-68307

Loop with Unreachable Exit Condition Infinite Loop vulnerability in ash-project ashai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests. AshAi.ToolLoop classifies a model response of :toolcalls, then filters the calls through...

CVE-2026-82579

CVE-2026-82579 is an infinite loop vulnerability in the ash_ai Elixir/Erlang library (versions 0.6.0 through before 1.0.0 ), affecting the AshAi.ToolLoop component. When all tool calls are filtered out—either due to a missing valid name or a reused tool_call_id—the loop recurses with a byte-ident...