AuthMatrix

AuthMatrix v0.8.2 AuthMatrix is an extension to Burp Suite that provides a simple way to test authorization in web applications and web services. With AuthMatrix, testers focus on thoroughly defining tables of users, roles, and requests for their specific target application upfront. These tables...

Autorize

Autorize Autorize is an open-source automatic authorization and authentication enforcement detection extension for Burp Suite. It is designed to assist application security engineers and penetration testers in identifying authorization bypasses and authentication weaknesses in web applications—at...

fwknop

fwknop - Single Packet Authorization Introduction fwknop implements an authorization scheme known as Single Packet Authorization SPA for strong service concealment. SPA requires only a single packet which is encrypted, non-replayable, and authenticated via an HMAC in order to communicate desired...

rbuster

Rbuster yet another dirbuster Common Command line options -a - specify a user agent string to send in the request -c - use this to specify any cookies that you might need simulating auth. header. -f - force processing of a domain with wildcard results. -l - show the length of the response. -r...

EUVD-2026-76915

SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can create a second OTP access capability. SEP sesam and Active Directory handle username capitalization differently, which may allow multiple SEP sesam user...

WebSecProbe

.png WebSecProbe is a security testing utility designed for web security researchers, penetration testers, and system administrators to analyze HTTP 403 Forbidden responses and access control behavior in web applications. The tool assists in identifying misconfigurations, inconsistent authorizati...

declarative-policy

DeclarativePolicy: A Declarative Authorization Library This library provides a DSL for writing authorization policies. It can be used to separate logic from permissions, and has been used at scale in production at GitLab.com. The original author of this library is Jeanine Adkisson, and copyright ...

auth_analyzer

Auth Analyzer Table of Contents What is it? Why should I use Auth Analyzer? GUI Overview Parameter Extraction Auto Extract From To String Static Value Prompt for Input Parameter Replacement Replacement Location Parameter removement Sample Usage Auto extract session Cookie Session Header and CSRF...

talisman

Talisman A tool to detect and prevent secrets from getting checked in Table of Contents What is Talisman? Installation Install onto path recommended approach Installation as a global hook template Configuring a project...

CVE-2026-79300

SEP sesam before 5.2.0.24 mishandles user authorization when combined with Active Directory (AD) authentication and enforced multi-factor authentication (MFA) . The root cause is a case-sensitivity mismatch : Active Directory treats usernames as case-insensitive, while SEP sesam distinguishes let...

the-bastion

🔒 The Bastion Overview Bastions are a cluster of machines used as the unique entry point by operational teams such as sysadmins, developers, database admins, ... to securely connect to devices servers, virtual machines, cloud instances, network equipment, ..., usually using ssh. The Bastion...

EasyTokens

EasyTokens A device-code phishing server for adversary emulation. Captures Microsoft 365 OAuth tokens via the Device Authorization Grant flow. Inspired by GraphSpy. Warning — Authorized Use Only. This tool is intended for penetration testers and red teamers operating under explicit written...

openapi_security_scanner

OpenAPI Security Scanner About The Project Authorization security issues in modern web applications could not be easily picked up by security scanners. A few examples from Shopify, LINE, NordVPN. One of the reasons is that the security scanners mainly looking for SQLi, XSS, RCE instead of looking...

maldev-for-dummies

Malware Development for Dummies In the age of EDR, red team operators cannot get away with using pre-compiled payloads anymore. As such, malware development is becoming a vital skill for any operator. Getting started with maldev may seem daunting, but is actually very easy. This workshop will sho...

CVE-2023-32117

CVE-2023-32117 Integrate Google Drive ","username":"admin","name":"admin","email":"[email protected]","role":"Administrator","folders":,"id":2,"avatar":"img alt='' src="http:///%5C/%5C/2.gravatar.com%5C/avatar%5C/b58996c504c5638798eb6b511e6f49af?s=32&d=mm&r=g"...

Nextjs-middleware-vulnerable-appdemo-CVE-2025-29927

Уязвимое приложение Next.js для практики пентеста Это приложение Next.js, намеренно созданное уязвимым к CVE-2025-29927: Уязвимость обхода авторизации промежуточного ПО Next.js. ⚠️ Отказ от ответственности Это приложение предназначено только для образовательных целей и этичного взлома. Не...

keycloak

오픈소스 ID 및 액세스 관리 최소한의 노력으로 애플리케이션에 인증을 추가하고 서비스를 보호하세요. 사용자 저장 또는 사용자 인증을 처리할 필요가 없습니다. Keycloak은 사용자 페더레이션, 강력한 인증, 사용자 관리, 세밀한 권한 부여 등을 제공합니다. 도움말 및 문서 문서 사용자 메일링 리스트 - Keycloak에 대한 도움말과 일반적인 질문을 위한 메일링 리스트 keycloak에 참여하여 일반적인 질문을 하거나, 설계 및 개발 논의를 위해 Slack의 keycloak-dev에 참여하세요. 계정은...

CVE-2025-29927

CVE-2025-29927 Обход авторизации в промежуточном ПО Next.js Шаблон обнаружения для CVE-2025-29927 теперь официально является частью репозитория Nuclei Templates. https://github.com/projectdiscovery/nuclei-templates/blob/main/headless/cves/2025/CVE-2025-29927-HEADLESS.yaml Критическая уязвимость в...

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware 15.2.2 - 認証バイパス ⚠️ NextJS Middleware における重大な認証バイパス 🛠️ @zs1n による PoC 実装 💡 概要...

route-detect

route-detect Находите уязвимости безопасности аутентификации authn и авторизации authz в маршрутах веб-приложений: Маршруты из потокового сервераkoel Уязвимости аутентификации и авторизации HTTP-маршрутов веб-приложений являются одними из самых распространенных проблем безопасности сегодня. Эти...