gaia

Gaia: Evaluador Global de Integridad de API Dependencias Instalar opam para compilar la API de pruebas. Instalar git, python3, pip y .NET para compilar RESTler y Schemathesis. Instalar cargo para compilar Gaia. Instalar docker v26.0.1 y docker compose v2.26.1 para compilar Gaia con ELK Stack...

windows-api-function-cheatsheets

Windows API Function Cheatsheets Contact 🌨️ Snowcrash: [email protected] Table of Contents Windows API Function Cheatsheets File Operations Process Management Memory Management Thread Management Dynamic-Link Library DLL Management Synchronization Interprocess Communication Windows Hooks...

DLLHSC

DLLHSC DLL Hijack SCanner: una herramienta para generar pistas y automatizar el descubrimiento de candidatos para el secuestro del orden de búsqueda de DLL Índice de esta página Contenido de este repositorio Modos de operación Guía de compilación y ejecución Menú de ayuda Ejemplos de ejecución...

CVE-2022-40684

CVE-2022-40684 by 1vere$k For now it's a POC copy for CVE-2022-40684 affecting Fortinet FortiOS, FortiProxy, and FortiSwitchManager appliances. Coppied from https://github.com/horizon3ai/CVE-2022-40684 Analysis The exploit uses the simple payload: PUT /api/v2/cmdb/system/admin/admin HTTP/1.1 Host...

twitter-advanced-search

🔍 Búsqueda avanzada en Twitter Estos operadores funcionan en Web, Móvil, Tweetdeck. Hay cierta superposición, pero en gran medida no funcionarán para las API de Búsqueda v1.1, Búsqueda Premium, o Búsqueda v2. Adaptado de Ayuda de TweetDeck, @lucahammer Guía, @eevee Manual de Twitter, @pushshift y...

CVE-2022-22947

CVE-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier have a SpEL expression injection vulnerability. If an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Vulnerability Environment...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

caronte

caronte$ Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using...

caronte

caronte$ Caronte es una herramienta para analizar el flujo de red durante eventos de capture the flag de tipo ataque/defensa. Reensambla los paquetes TCP capturados en archivos pcap para reconstruir las conexiones TCP y analiza cada conexión en busca de patrones definidos por el usuario. Los...

Agent-Tesla-APC-Injection-Token-Manipulation-Registry-Persistence-Analysis

1. Native API & APC Injection The x64dbg memory dump reveals that Agent Tesla uses Native API NT API calls for low-level operations, including APC Asynchronous Procedure Call injection. Key Functions Observed: NtQueueApcThread – Injects code into a target thread via APC. NtReadVirtualMemory –...

CVE-2026-41179

CVE-2026-41179 — rclone RC API Unauthenticated RCE ⚠️ EDUCATIONAL PURPOSES ONLY This repository is intended strictly for security research, education, and authorized lab environments. PSSec and the contributors of this repository do not condone, support, or take any responsibility for any...

NPM: Payload vulnerable to API key disclosure through ordinary document reads

NPM: Payload vulnerable to API key disclosure through ordinary document reads vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

GHSA-238X-W2J9-GWWR Payload vulnerable to API key disclosure through ordinary document reads

Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables useAPIKey. - Users have read access to other user documents...

Payload vulnerable to API key disclosure through ordinary document reads

Impact Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled. You are affected if: - An authentication collection enables useAPIKey. - Users have read access to other user documents...

stretcher

Stretcher Stretcher es una herramienta para buscar servidores Elasticsearch abiertos. Usage: python stretcher.py --shodan key --action analyze --threads 0..100 --dork python stretcher.py --help / // / / // / \ / / / / / / / / / / / // / / / // // / / / / / //// //// //// Herramienta...

CVE-2026-105806

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

Exchange2domain

Exchange2domain Herramientas todo en uno de privexchange. Solo necesitas abrir el puerto del servidor web, por lo que no se requieren privilegios elevados. ¡Gran artículo! Abusando de Exchange: una sola llamada a la API te separa de Domain Admin. Requisitos Estas herramientas requieren impacket...

reposcanner

Reposcanner Reposcanner is a python script to search through the commit history of Git repositories looking for interesting strings such as API keys, inspired by truffleHog. Installation The python Git module is required python3-git on Debian. Docker docker build -t reposcanner . docker run -it...

CVE-2014-0160-Chrome-Plugin

Heartbleed chrome plugin DEPRECATED Chrome plugin who will look-up if the current site and all subdomains called are vulnerable to CVE-2014-0160. The vulnerability check is done by an API service who's now dead it wasn't in 2014! May the code can be useful to someone anyway, if someone found a ne...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...