lightbulb-framework

LightBulb LightBulb is an open source python framework for auditing web application firewalls and filters. Synopsis The framework consists of two main algorithms: GOFA : An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query mode...

promptmap

root@kitploit: O O o.-. Humans, Do Not Resist! |/ ,-'-. / /, / /|.-.| / --O-- .--""" /\ /\ | o.o / Utku Sen's /|\ -'--' / /| | - | / | | | \ /| | | ' \ '/ \ ' | ' \ | ' / | ' \ | / | | | ./| /||| ./|||,| .// / / |-----| || || || ||...

bfac

BFAC Webアプリケーション向け高度なバックアップファイルアーティファクトテスト BFAC（Backup File Artifacts Checker）は、Webアプリケーションのソースコードを露呈する可能性のあるバックアップアーティファクトをチェックする自動化ツールです。これらのアーティファクトは、パスワードやディレクトリ構造などの機密情報の漏洩につながる可能性もあります。 BFACの目標は、バックアップファイルアーティファクトのブラックボックステストのための オールインワンツール となることです。 Features マルチスレッドスキャン。 リクエストレート制限機能を含む。...

bfac

BFAC Advanced Backup-File Artifacts Testing for Web-Applications BFAC Backup File Artifacts Checker is an automated tool that checks for backup artifacts that may disclose the web-application's source code. The artifacts can also lead to leakage of sensitive information, such as passwords,...

pulsar

PULSAR プロトコル学習、シミュレーション、ステートフルファザー Pulsarは、自動プロトコル学習とシミュレーション機能を備えたネットワークファザーです。このツールは、クラスタリングやマルコフモデルなどの機械学習技術を用いてプロトコルをモデル化します。これらのモデルは、意味的に正しいメッセージによりPulsarと実際のクライアントまたはサーバー間の通信をシミュレートするために使用できます。一連のファジングプリミティブと組み合わせることで、未知のプロトコルの実装をそのプロトコル状態機械のより深い状態でエラーについてテストできます。...

dnsmasq-cve-2026

dnsmasq CVE-2026 QA 验证工具 自动化黑盒工具，用于验证 6 个 dnsmasq 漏洞（2026 年 5 月）。向在线 DUT 发送攻击数据包并报告 PASS/FAIL —— 无需访问源代码。 快速开始 root@kitploit: Set DUT DNS to your laptop's WAN IP via GUI first, then: sudo python3 dnsmasqcveverify.py --laptop --dut --dut-pass Example: sudo python3 dnsmasqcveverify.py --laptop...

megaquagga-pentest-report

megaquagga-pentest-report 黑盒渗透测试 — WordPress漏洞利用，通过CVE-2022-0847进行权限提升...

WuppieFuzz v1.7.1

WuppieFuzz v1.7.1 TNO developed WuppieFuzz, a coverage-guided REST API fuzzer developed on top of LibAFL, targeting a wide audience of end-users, with a strong focus on ease-of-use, explainability of the discovered flaws and modularity. WuppieFuzz supports all three settings of testing black box,...

VibeHacking

👾 Welcome to Vibe Hacking By BlackPC, Vine & Foxxino Inc...

Black_Box-Penetration-Testing

BlackBox-Penetration-Testing Black-box penetration test again...

AutoPentest: Enhancing Vulnerability Management with Autonomous LLM Agents

A recent area of increasing research is the use of Large Language Models LLMs in penetration testing, which promises to reduce costs and thus allow for higher frequency. We conduct a review of related work, identifying best practices and common evaluation issues. We then present AutoPentest, an...

OET: Optimization-Based Prompt Injection Evaluation Toolkit

Large Language Models LLMs have demonstrated remarkable capabilities in natural language understanding and generation, enabling their widespread adoption across various domains. However, their susceptibility to prompt injection attacks poses significant security risks, as adversarial inputs can...

GHSA-86H2-2G4G-29QX avo possible unsafe reflection / partial DoS vulnerability

Summary The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. Details After reviewing th...

What is an External Penetration Test?

A penetration test also known as a pentest is a security assessment that simulates the activities of real-world attackers to identify security holes in your IT systems or applications. The aim of the test is to understand what vulnerabilities you have, how they could be exploited, and what the...

Dynamic analysis of firmware components in IoT devices

Among the various offensive security techniques, vulnerability assessment takes priority when it comes to analyzing the security of IoT/IIoT devices. In most cases, such devices are analyzed using the black box testing approach, in which the researcher has virtually no knowledge about the object ...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228Apache Log4j Remote Code Execution） all log...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228Apache Log4j Remote Code Execution） all log...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Join Community Telegram CVE-2021-4...

FormatFuzzer - A Framework For High-Efficiency, High-Quality Generation And Parsing Of Binary Inputs

FormatFuzzer is a framework for high-efficiency, high-quality generation and parsing of binary inputs. It takes a binary template that describes the format of a binary input and generates an executable that produces and parses the given binary format. From a binary template for GIF, for instance,...

The cloud is beige - The demise of black box testing

Black-box penetration testing is dead. Id question why it is even a consideration. Its of limited and dubious value in almost any context. Wait, wait… I didnt mean that. Put down the pitchforks and torches, development and QA teams, Im only talking about black-box penetration testing. Yes,...