covert-tube

covert-tube A program to control systems remotely by uploading videos to Youtube using Python to create the videos and the listener, emulating some malware I was reading about. It allows to create videos with frames formed of simple text, QR codes with cleartext or QR codes using AES encryption...

ragflow-audit

ragflow-audit Инструмент аудита трёх уязвимостей RAGFlow CVE-2026-28797 / CVE-2026-24770 / CVE-2025-69286 ssti ：обнаруживает и эксплуатирует SSTI - RCE в компонентах StringTransform / Message zipslip ：офлайн-проверка записей zip на обход пути Zip Slip apikey ：вывод API key из beta-токена ссылки д...

notionterm

notionterm Embed reverse shell inNotion pages. Hack while taking notes FOR ➕: Hiding attacker IP in reverse shell No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell Demo/Quick proof insertion within report High available and shareable...

secdim-assurance-drift-challenge

SecDim Challenge Builder Repro — Assurance Drift Рабочее воспроизведение предложенной задачи по безопасности, вдохновлённой CVE-2026-88861 , опубликованной 10 сентября 2026 года. Концепция безопасности Приложение корректно проверяет подписанную сессию и корректно проверяет роль admin, но оно...

reposcanner

Reposcanner Reposcanner — это скрипт на Python для поиска по истории коммитов Git-репозиториев интересных строк, таких как ключи API, вдохновлён truffleHog. Установка Требуется модуль Git для Python python3-git в Debian. Docker docker build -t reposcanner . docker run -it --rm reposcanner -h dock...

Arisu

Arisu — AI Key 自动化采矿系统 Arisu 是一款自动扫描公开代码仓库（GitHub、GitLab、Gitee、Docker Hub、PyPI、npm 等）和代码片段（Gist、Issues、CommonCrawl），提取 AI 服务 API 密钥（DeepSeek、OpenAI、Anthropic、Kimi 等）并验证其有效性及余额的工具。提供 TUI 仪表板和多种输出格式（JSON、CSV、Markdown）。 功能特性 🔍 多源扫描 ：GitHub 代码搜索、Sourcegraph、Gist、Issues、GitLab、Gitee、Docker...

Leaked-Credentials

Чтобы найти утёкшие учётные данные с помощью инструментов разработчика Google Chrome и регулярных выражений, выполните следующие краткие шаги: 1. Откройте DevTools: В Chrome перейдите на сайт, который вы проверяете, затем откройте инструменты разработчика с помощью Ctrl+Shift+I Windows/Linux или...

CVE-2026-67598

CVE-2026-67598 Emlog Pro — отключённая проверка TLS-сертификатов в ИИ-ассистенте MITM из соседней сети → кража API-ключа LLM-провайдера & внедрение ИИ-ответов Сводка · Схема атаки · Затронутый код · Подтверждение · Устранение · Хронология · Ссылки 📋 Краткий обзор | ---|--- CVE ID| CVE-2026-67598...

kamerka

NOT SUPPORTED OR DEVELOPED ANYMORE PLEASE USE GUI VERSION https://github.com/woj-ciech/Kamerka-GUI ꓘamerka 2.0 aka FIST Flickr, Instagram, Shodan, Twitter Build interactive map of cameras, printers, tweets and photos. The script creates a map of cameras, printers, tweets and photos based on your...

Git-Secret

Git-Secret Scripts Go pour trouver une clé API / certains mots-clés dans un dépôt Mise à jour V1.0.2 🚀 Suppression de certains vérificateurs Ajout d'un exemple de fichier contenant des dorks GitHub Ajout du support pour la commande go install issue 5 Capture d'écran 📷 Comment installer Pour...

SimpleHelp <= 5.5.7 - Privilege Escalation

SimpleHelp remote support software v5.5.7 and before contains a privilege escalation caused by insufficient access controls in API key creation, letting low-privileges technicians escalate privileges to server admin, exploit requires low-privileges technician access. id: CVE-2024-57726 info: name...

CVE-2026-103097

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103097 GV-Eye Relay Payment API Key Vulnerability

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

EUVD-2026-91147

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103097

The GV-Eye Relay Payment API is vulnerable to an information disclosure flaw where an API key is hardcoded and retrievable from the application package. Because Android applications can be reverse-engineered, an unauthorized user can extract these sensitive credentials from the client application...

CVE-2026-103096 GV-Eye Hardcoded API Key Vulnerability

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096

The GV-Eye application is vulnerable to a hardcoded API key issue. Because Android applications can be reverse engineered , an attacker can extract sensitive API credentials directly from the application package. This allows unauthorized users to misuse the key for unintended purposes. No specifi...

EUVD-2026-91146

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

PT-2026-104062

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...