subdomain3

Subdomain3 README.md inChinese 中文 Description Subdomain3 is a new generation of tool , It helps penetration testers to discover more information in a shorter time than other tools.The information includes subdomains, IP, CDN, and so on. Please enjoy it. Screenshot medium pattern for speed Feature...

CVE-2026-102983

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

CVE-2026-102983

The @astrojs/netlify adapter for the Astro web framework (versions 5.2.0 through 8.2.4) is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is that generated regular expressions for Netlify Image CDN remote-image allowlists lack anchoring to the beginning of the URL. This allows ...

CVE-2026-102983 Astro: Netlify Image CDN allowlist bypass enables SSRF

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

EUVD-2026-89969

Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluates these expressions with RegExp.test, ...

CloudFlair

CloudFlair Important note: As of late 2024, Censys does not provide API access to free accounts anymore. This means CloudFlair does not work with free Censys accounts anymore. CloudFlair is a tool to find origin servers of websites protected by CloudFlare or CloudFront which are publicly exposed...

FUCK-CDN

FUCK-CDN Exhaust every possible means, strip the CDN down to its underwear, and find the real IP. An automated CDN origin server tracing skill built for Claude Code. Input a target domain, and it automatically executes 40+ OSINT methods in priority order, builds an evidence chain, and outputs a...

CVE-2025-27415-PoC

CVE-2025-27415 PoC Nuxt3 cache poisoning A repository for setting up the cache poisoning vulnerability environment that occurs in nuxt3 =3.0.0 3.16.0 Vulnerability Summary When a CDN is placed in front of a Nuxt server, and the CDN only stores the path excluding URL queries as the cache key, a...

temcrypt

The Next-gen Encryption Try temcrypt on the Web → temcrypt SDK Focused on protecting highly sensitive data, temcrypt is an advanced multi-layer data evolutionary encryption mechanism that offers scalable complexity over time, and is resistant to common brute force attacks. You can create your own...

tf-mythic-azure

Terraforming Mythic This project allows operators to set up multiple Mythic C2 servers in Azure. Optionally, Azure CDN redirectors can be created as well. The idea is that you are able to create multiple "projects" that you can manage from this Terraform code. This way, operators can manage the...

Malicious code in imgbundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e14218599b46d143fa8e150156864d14d58c327bd8a8816221ac4e8c5cc99350 The package advertises itself as an image bundler, but index.js performs no image bundling. On require, a top-level IIFE reads an AES-256-CBC-encrypt...

Malicious code in cdn-img-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7922ab741ba357d3d9bb14201acdffd89639cb0b7a8850180d6dd9a8266e9f7 On require of cdn-img-fetch, index.js unconditionally invokes https.get against https://raw.githubusercontent.com/cavecrew/proj/main/banner.png and...

Vxscan

Vxscan 2.0 English | 简体中文 Python3 comprehensive scanning tool, mainly used for sensitive file detection directory scanning and js leak interface, WAF/CDN identification, port scanning, fingerprint/service identification, operating system identification, weak password detection, POC scanning, SQL...

subdomain3

Subdomain3 README.md enChinese 中文 Descripción Subdomain3 es una herramienta de nueva generación que ayuda a los testers de penetración a descubrir más información en menos tiempo que otras herramientas. La información incluye subdominios, IP, CDN, entre otros. Disfrútala. Captura de pantalla Patr...

nali

Nali 一个查询IP地理信息和CDN提供商的离线终端工具. English 功能 支持多种数据库 纯真 IPv4 离线数据库 ZX IPv6 离线数据库 Geoip2 城市数据库 可选 IPIP 数据库 可选 ip2region 数据库 可选 DB-IP 数据库 可选 IP2Location DB3 LITE 数据库 可选 CDN 服务提供商查询 支持管道处理 支持交互式查询 同时支持IPv4和IPv6 支持多语言 查询完全离线 全平台支持 支持彩色输出 安装 从源码安装 Nali 需要预先安装 Go = 1.19. 安装后可以从源码安装软件: $ go install...

metabigor

Metabigor - 无需 API 密钥的 OSINT 强力工具 Metabigor 是什么？ Metabigor 无需你注册任何 API 密钥，即可测绘目标的基础设施。网络范围、证书、关联域名、暴露的端口、CDN 厂商和代码泄露——全部来自免费数据源，并且所有结果都可以相互通过管道衔接。 功能特性 网络发现 - 从 ASN、组织、域名或 IP 查找 IP 范围（CIDR） 证书透明日志 - 通过 crt.sh 发现子域名 IP 富化 - 通过 Shodan InternetDB 获取端口、主机名和 CVE（免费，无需密钥） GitHub 代码搜索 - 通过 grep.app...

CVE-2024-26144-test

CVE-2024-26144-test Requirement: Docker compose Deno $ deno run --allow-run --allow-net check.ts If you want to test CDN, please set the URL in argument. Make sure all caches are purged before run! $ deno run --allow-run --allow-net check.ts https://example.com/ Results If HTTP response contains...

bucky

项目暂时搁置。 Bucky Bucky 是一款自动化工具，旨在发现 S3 存储桶配置错误。Bucky 由两个模块组成：Bucky Firefox 插件和 Bucky 后端引擎。Bucky 插件读取网页源码，使用正则表达式Regex匹配用作内容分发网络CDN的 S3 存储桶，并将其发送至 Bucky 后端引擎。后端引擎接收来自插件的数据，检查该 S3 存储桶是否公开可写。如果存储桶存在漏洞，Bucky 会自动上传一个文本文件作为概念验证PoC。 工作原理 Bucky 插件将从用户访问的网页中发现的 S3 存储桶名称详细信息发送至后端引擎。 它使用 AWS PHP SDK 来发现配置错误。...

CVE-2023-30533

POC - CVE-2023-30533 A POC for CVE-2023-30533 Copied as per: https://cdn.sheetjs.com/advisories/CVE-2023-30533: All releases of SheetJS Community Edition up to version 0.19.2 are affected. This includes: - scripts and modules on the SheetJS CDN through version 0.19.2 2 - modules published with th...

Abused-Legitimate-Services

Abused Legitimate Services Legitimate third-party Platform-as-a-Service PaaS providers are becoming increasingly leveraged by threat actors for phishing and malware deployment. PaaS providers such as cloud instances, marketing platforms, content delivery networks CDN, and dynamic DNS servers have...