theftfuzzer

root@kitploit: ┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘└─┘┴└─ Introduction: TheftFuzzer is a tool that fuzzes Cross-Origin Resource Sharing implementations for common misconfigurations. Usage: python theftfuzzer.py -d 'http://example.com/api/data'...

dorkX

dorkX Pipe different tools with google dork Scanner Version 1.0 Install zoid@MSI /dorkX git clone https://github.com/ethicalhackingplayground/dorkX zoid@MSI /dorkX cd dorkX zoid@MSI /dorkX go build dorkx.go zoid@MSI /dorkX go build corsx.go zoid@MSI /dorkX go build csrfx.go zoid@MSI /dorkX go bui...

corsair_scan

Welcome to Corsairscan Corsairscan is a security tool to test Cross-Origin Resource Sharing CORS misconfigurations. CORS is a mechanism that allows restricted resources on a web page to be requested from another domain outside the domain from which the first resource was served. If this is not...

CorsMe

What is CorsMe ?...

Astra

Astra 由于现有 API 的持续变更以及新 API 的不断添加，REST API 渗透测试变得复杂。安全工程师或开发者可将 Astra 作为其流程的组成部分，从而在开发周期早期检测并修补漏洞。Astra 能够自动检测和测试登录与登出（身份验证 API），因此任何人都可以轻松将其集成到 CICD 流水线中。Astra 可以接受 API 集合作为输入，因此也可用于独立模式下的 API 测试。 SQL 注入 跨站脚本攻击 信息泄露 身份验证与会话管理失效 CSRF（包括 Blind CSRF） 速率限制 CORS 配置错误（包括 CORS 绕过技术） JWT 攻击 CRLF 检测 Blin...

Astra

Astra REST API penetration testing is complex due to continuous changes in existing APIs and newly added APIs. Astra can be used by security engineers or developers as an integral part of their process, so they can detect and patch vulnerabilities early during development cycle. Astra can...

ApiHunter

Support Development If this project helps your work, support ongoing maintenance and new features. ETH Donation Wallet 0x11282eE5726B3370c8B480e321b3B2aA13686582 Scan the QR code or copy the wallet address above. 🎯 ApiHunter 📺 Video Demo Click to watch the full demo on YouTube 🖥️ Desktop App...

CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS

CVE-2023-47014-Sticky-Notes-App-Using-PHP-with-Source-Code-v1.0-CSRF-to-CORS Exploit Author: emirhanerdogu Vendor Homepage https://www.sourcecodester.com/php/16928/sticky-notes-app-using-php-source-code.html Software Link...

LightRAG <= 1.5.3 - Credentialed CORS Wildcard

LightRAG = 1.5.4 contains a broken access control vulnerability caused by default CORSORIGINS= with allowcredentials=True in lightragserver.py, letting malicious websites perform authenticated API requests, exploit requires authenticated user. id: CVE-2026-61736 info: name: LightRAG = 1.5.3 -...

SmartAsset-CORS-CVE-2020-26527

SmartAsset-CORS-CVE-2020-26527 CVE-2020-26527 Smart Asset - versión 2020.7 Se descubrió un problema en API/api/Version en Damstra Smart Asset 2020.7. El intercambio de recursos de origen cruzado confía en orígenes aleatorios al aceptar la cabecera arbitraria 'Origin: example.com' y responder con...

not-slithering-anywhere

Resumen Not Slithering Anywhere es la versión en Python3 de nuestra aplicación vulnerable Not Go-ing Anywhere. Está pensada para demostrar una serie de problemas de seguridad comunes en aplicaciones Python, así como para servir de base para campos de pruebas de herramientas estáticas y dinámicas...

fast-security-scanners

Fast security scanners/checks A small contribution to community : We use all these tools in security assessments and in our vulnerability monitoring service Check your domain for DNS NS takeover Repo docker run --dns=8.8.8.8 -e VULNID=dnsnstakeover -e DOMAIN=site.com whitespots/dnsnstakeover Cach...

CVE-2026-27579-CORS-Misconfiguration-Leading-to-Authenticated-Data-Exposure

CVE-2026-27579 – Configuración incorrecta de CORS que conduce a la exposición de datos autenticados 📌 Referencia de aviso ID de CVE: CVE-2026-27579 GHSA: GHSA-qh5m-p8jh-hx88 Proveedor: karnop Producto: realtime-collaboration-platform Gravedad: ALTA CVSS 7.4 Vector:...

nuclei-templates

Nuclei Templates Community curated list of templates for the nuclei engine to find security vulnerabilities in applications. Documentation • Contributions • Discussion • Community • FAQs • Join Discord Templates are the core of the which powers the actual scanning engine. This repository stores a...

Corsy

Corsy CORS Misconfiguration Scanner Introduction Corsy is a lightweight program that scans for all known misconfigurations in CORS implementations. Requirements Corsy only works with Python 3 and has just one dependency: requests To install this dependency, navigate to Corsy directory and execute...

of-CORS

of-CORS of-CORS is Truffle Security's tool suite for identifying and exploiting CORS misconfigurations on the internal networks of bug bounty targets using typosquatting. You can read more here https://trufflesecurity.com/blog/of-CORS How Does it Work?? of-CORS is a Python3 web application built ...

recox

Recox v2.0 RecoX is an incredibly versatile and powerful tool that is specifically designed to aid in the identification and classification of vulnerabilities within web applications. The script is able to detect vulnerabilities that are not typically included in the OWASP top ten vulnerabilities...

CORStest

CORStest A simple CORS misconfiguration scanner Based on the research ofJames Kettle CORStest is a quick & dirty Python 3 tool to find Cross-Origin Resource Sharing CORS misconfigurations. It takes a text file as input which may contain a list of domain names or URLs. Currently, the following...

whatsapp-mitd-mitm

WhatsApp MitD & MitM Introduction This repository contains PoC code and tools that were developed as part of our research 01 on remotely exploiting Man-in-the-Disk MitD vulnerabilities on WhatsApp for Android. As discussed in our blog post, the code and accompanying scripts found here, were used ...

CVE-2019-17633

CVE-2019-17633 Eclipse Che CSRF que conduce a RCE Este error permite que un sitio web remoto cree e inicie un contenedor Docker arbitrario en máquinas que ejecuten Che antes de las versiones 7.3.0 y 7.4.1 cuando un usuario visita una página web. Vulnerabilidad Se trata de un error de CSRF que...