CVE-2022-1442

CVE-2022-1442 WordPress Plugin Metform = 2.1.3 - Improper Access Control Allowing Unauthenticated Sensitive Information Disclosure Description The is vulnerable to sensitive information disclosure due to improper access control in the /core/forms/action.php file which can be exploited by an...

Gemini-api-key-hunter

Gemini API Key Toolkit A toolkit for discovering, validating, and testing exposed Google Gemini API keys. It consists of two components: Gemisc.py – A high-speed Python scanner that discovers exposed Google API keys from websites and JavaScript files, verifies them against the Gemini API, and...

inquisitor

Inquisitor Notice This project is only partially complete and I have yet to implement many of the features described in the following blog post I made: https://penafieljlm.com/2017/07/14/inquisitor/. Inquisitor is a simple tool for gathering information on companies and organizations through the...

twebit

Bitcoin analysis with machine learning How it works? 1- Get tweets from twitter 2- Filter tweets 3- Tweet classification with naive bayes algorithm Positive,negative and neut Installation git clone https://github.com/omergunal/twebit cd twebit pip3 install -r requirements.txt Update your api keys...

cariddi

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more Coded with 💙 by edoardottt Share on Twitter! Install • Usage • Get Started • Changelog • Contributing • License Installation 📡 Homebrew brew install cariddi Snap sudo snap install caridd...

uncover

Quickly discover exposed hosts on the internet using multiple search engines. Features • Installation • Usage • Configuration • Running Uncover • Join Discord uncover is a go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet. It is built with...

envy

Quick Start • Configuration • Commands • Keybindings • FAQ • Documentation A secure encrypted vault for managing API keys, secrets, and environment variables. Built for developers who live in the terminal. What is Envy? I built Envy because I was tired of juggling .env files and keeping secrets...

GitSecure

GitSecure About GitSecure GitSecure is a GitHub action that can be used to alert security teams of any exposed API keys for push and pull requests. When files are added or modified on a GitHub repo, this action will be initiated and will start looking for exposed credentials in the system. After...

CVE-2026-105129

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

git-hound

🐾 GitHound A pattern-matching, patch-attacking, batch-catching secret snatcher. Overview GitHound hunts down exposed API keys, secrets, and credentials across GitHub by pairing GitHub dorks with pattern matching, contextual detection, and commit-history analysis. Input a GitHub dork into GitHound...

CVE-2026-105129

LaraDashboard versions prior to 1.4.8 are vulnerable to an incorrect authorization flaw (CWE-863) in the settings API. Authenticated users possessing only the settings.view permission can perform GET requests to /api/settings or /api/settings/{option_name} to access sensitive data. This vulnerabi...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

fileintel

fileintel This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added. Files are identified by file hash MD5, SHA1, SHA256. The output is in CSV format and sent to STDOUT so the data can be...

should-i-trust

should-i-trust Summary should-i-trust is a tool to evaluate OSINT signals for a domain. Requirements should-i-trust requires API keys from the following sources: Censys.io - Free for for first 250/quries/month VirusTotal - Free GrayHatWarFare - Free with limited results Use Case You're part of a...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

bug-bounty-tools

Bug Bounty Script A BASH Script to automate the installation of the most popular bug bounty tools, the main purpose of this script is to run it on temporary/disposable virtual machines in the cloud. Tools Used Nuclei httpx Naabu Subfinder DNSx Nmap Katana Recox Wfuzz Amass SQLMap Setup 1. Copy or...

SecretFinder

about SecretFinder SecretFinder is a python script based on LinkFinder, written to discover sensitive data like apikeys, accesstoken, authorizations, jwt,..etc in JavaScript files. It does so by using jsbeautifier for python in combination with a fairly large regular expression. The regular...

slicer

Slicer A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note : The APK has to be extracted via jadx or...

CVE-2018-20555

CVE-2018-20555 The Wordpress Plugin called Social Network Tabs, made by the company Design Chemical, is leaking twice the Twitter accesstoken, accesstokensecret, consumerkey and consumersecret of their user which is leading to a takeover of their Twitter account. This is caused by the following...