3289 matches found
talos
Chat Β· Discussions Β· Newsletter Β· Docs Β· Try Ory Network Β· Jobs Ory Talos is a scalable and secure API key server optimized for low-latency verification, horizontal scaling, and predictable operations. It follows established security best-practices for API keys and issues, verifies, revokes, and...
CVE-2025-49619
CVE-2025-49619 PoC This script exploits CVE-2025-49619 in Skyvern to execute a reverse shell command. Author Name: Cristian Branet GitHub: cristibtz Usage 1. Start a listener nc -lvnp 2. Run the exploit python3 exploit.py -u "http://:" -k "" -i -p : Skyvern server IP : Skyvern server port : Your...
Pinkerton
π΅οΈ Pinkerton Investigating JavaScript files since 1850 Python project to crawl for JavaScript files and search for secrets like API keys, authorization tokens, hardcoded passwords, or related data. β‘ Getting started A quick guide on how to install and use Pinkerton. 1. Clone the repository with:...
pwned
pwned A command-line tool for querying Troy Hunttroy's Have I been pwned?haveibeenpwned service using the hibphibp Node.js module. !npm Versionnpm-imagenpm-url !Build Statusci-imageci-url Installation Download and install Node.jsnodejs, then install pwned globally using npm: npm install pwned -g...
Zoho ManageEngine OpManager - SQL Injection
Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...
Google-api-key-scanner
Overview A Python tool for testing Google Maps API keys against 21 different Google API endpoints to check which services are exposed and vulnerable. !IMPORTANT π₯ For a complete walkthrough of the tool, watch the demo video here: https://youtu.be/3KMUnLdlOSE. The feature shown below starts at...
wikipedia-c2
Wikipedia-C2 Wikipedia C2 Blog Post This is a demo project to demonstrate Command and Control utilizing Wikipedia. After Josh Abraham's demo of C2 utilizing Slack and ICMP, I thought I'd explore what other options in the internet's top sites could be used for C2. After reviewing Wikipedia's API, ...
Gemini-api-key-hunter
Gemini API Key Toolkit A toolkit for discovering, validating, and testing exposed Google Gemini API keys. It consists of two components: Gemisc.py β A high-speed Python scanner that discovers exposed Google API keys from websites and JavaScript files, verifies them against the Gemini API, and...
Pribado
π Pribado Private API Key Management & Zero-Knowledge Infrastructure Pribado is a self-hostable, zero-knowledge platform for managing API keys, encrypted secrets, and private communications. Built on Oasis Sapphire for hardware-backed confidential computing. β¨ Features π Private API Proxy Store A...
misp-extractor
MISP Extractor This code connects to a given MISP Malware Information Sharing Platform server and parses a given number of events, writing the IP addresses, URLs, and MD5 hashes found in the events to three separate files. Usage To use this script, you will need to provide the URL of your MISP...
CVE-2022-41544
CVE-2022-41544 Exploit Script This repository contains a script to exploit CVE-2022-41544 vulnerability in GetSimple CMS. The script performs several steps to check for vulnerabilities, leak API keys, set cookies, obtain CSRF tokens, upload a shell, and trigger the shell. Changes and Improvements...
wardn
wardn A credential firewall for AI agents. The headline claim is structural, not policy: agents receive placeholder tokens, never real API keys. The real key crosses only one network seam β inside the wardn proxy, on its way to the upstream API β and is stripped from responses before they reach t...
agent-vault-proxy
Keys on the Wire Your AI agent never holds your API keys. It sends a placeholder; the real secret is swapped in on the wire. Stops credential stealers Shai-Hulud and similar and prompt-injected agents from leaking your secrets. A compromised agent has nothing to take. How it works 1. Your agent...
ipa-scope
IPA-SCOPE v.2 IPA-SCOPE is a Static analysis Tool that Targets ios applications and brings important information such as Links, interesting files .json,cer,der,api and is very useful to show good results when you pentesting ios apps What new in this tool β Fast & easy to use β Get binary info like...
CVE-2026-112014
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...
CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...
CVE-2026-112014
The software LobsterAI prior to version 2026.10.16 contains a hardcoded password vulnerability (CWE-321). This flaw allows an attacker who obtains an exported provider file to decrypt third-party AI provider API keys. The vulnerability stems from using the constant 'lobsterai-APP' to encrypt keys...
EUVD-2026-103467
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...
CVE-2026-112014 LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded salt and recover...
vanda-CVE-2025-3102
Vanda CVE-2025-3102 π£ Exploit with graphical interface for vulnerability CVE-2025-3102 in the WordPress plugin SureTriggers = 1.0.78. π FEATURES Vulnerability site identification π΅οΈββοΈ Automatic exploitation with admin user creation π¨βπ» Cyberpunk-style graphical interface π Results saved in .txt...