prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

gh-dork

gh-dork Supply a list of dorks and, optionally, one of the following: a user -u a file with a list of users -uf an organization -org a file with a list of organizations -of a repo -r You can also pass: an output directory to store results -o a filename to store valid items, if your users or org...

unicorn

Unicorn Engine LOOKING FOR CONTRIBUTORS! See this. Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU. Unicorn offers some unparalleled features: Multi-architecture: ARM, ARM64 ARMv8, M68K, MIPS, PowerPC, RISCV, SPARC, S390X, TriCore and X86 16, 32,...

MagicMirror <= 2.35.0 - Server-Side Request Forgery

An unauthenticated Server-Side Request Forgery SSRF vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

OwnCloud - Phpinfo Configuration

An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL is accessed, it reveals the configuration details of the PHP environment phpinfo. This information...

r2frida

r2frida Radare2 and Frida better together Description Self-contained plugin for radare2 that ships frida and allows to instrument local or remote processes using r2 commands instead but not limited to Frida scripts. The radare project provides a complete toolchain for reverse engineering, it's...

CVE-2014-6271

CVE-2014-6271 Beschreibung Dieses Projekt ermöglicht die Reproduktion der Sicherheitslücke CVE-2014-6271 , auch bekannt als Shellshock. Shellshock ist eine Sicherheitslücke in Bash, die die Ausführung von bösartigem Code über Umgebungsvariablen ermöglicht. Ziel dieses Projekts ist es, die...

AWS-Loot

AWSLoot Cerca segreti in un ambiente AWS enumerando le variabili d'ambiente e il codice sorgente. Questo strumento consente un'enumerazione rapida su grandi insiemi di istanze e servizi AWS. Installazione root@kitploit: pip install -r requirements.txt È necessario un file di credenziali AWS...

klar

Klar Integration of Clair and Docker Registry supports both Clair API v1 and v3 Klar is a simple tool to analyze images stored in a private or public Docker registry for security vulnerabilities using Clair https://github.com/coreos/clair. Klar is designed to be used as an integration tool so it...

flan

Flan Scan is a lightweight network vulnerability scanner. With Flan Scan you can easily find open ports on your network, identify services and their version, and get a list of relevant CVEs affecting your network...

CVE-2014-6271

Sfruttamento di Shellshock CVE-2014-6271 Shellshock è di fatto una vulnerabilità di Remote Command Execution in BASH. Questo script sfrutta la vulnerabilità nell'ambiente web su Apache o simili con modcgi abilitato. La vulnerabilità risiede nella manipolazione delle variabili d'ambiente, che sono...

Joomla-3.10.12-languagehelper-hotfix

THIS REPO È OBSOLETO, DOVRESTI USARE QUESTO INVECE: https://github.com/TLWebdesign/Joomla-3-EOL-Security-Fixes Joomla-3.10.12 LanguageHelper.php Hotfix Questo piccolo plugin ti aiuterà ad aggiornare il file LanguageHelper con la correzione di sicurezza che ho backportato da Joomla 4.4.1. Maggiori...

CVE-2026-35585-poc

CVE-2026-35585: File Browser OS-Befehlseinschleusung PoC English version Zusammenfassung Dieses Repository enthält einen Proof of Concept PoC für die kritische OS-Befehlseinschleusungs-Schwachstelle CVE-2026-35585 , die in File Browser Version 2.0.0 bis 2.33.1 entdeckt wurde. Die Schwachstelle...

Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access

Summary Langflow includes features for secret protection, environment access, and runtime configuration of workflow components. Weaknesses in cryptographic key handling, exposure of process environment values, and insufficient restriction of sensitive runtime configuration fields could allow...

miteru

This repository does not have a README...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

vercel-april2026-incident-response

Vercel April 2026 Incident Response Guide Zuletzt aktualisiert: 20. April 2026 @ 12:07 Uhr AEST/Brisbane – v2 – enthält Update des Vercel-CEOs vom 20. April WICHTIG: Dies ist keine rechtliche oder offizielle Beratung. Wenn Sie glauben, dass Sie kompromittiert wurden, wenden Sie sich bitte an eine...

envy

Avvio Rapido • Configurazione • Comandi • Tasti rapida • FAQ • Documentazione Un vault sicuro e crittografato per gestire chiavi API, segreti e variabili d'ambiente. Realizzato per sviluppatori che vivono nel terminale. Cos'è Envy? Ho creato Envy perché ero stanco di destreggiarmi tra file .env e...

lazyrecon

root@kitploit: | | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and...