corsair_scan

欢迎使用 Corsairscan Corsairscan 是一款用于测试跨域资源共享（CORS）错误配置的安全工具。CORS 是一种机制，允许网页上的受限资源被从最初提供该资源的域以外的其他域请求。如果配置不当，未授权的域也能访问这些资源。 什么是 CORS？ CORS 是一种基于 HTTP 标头的机制，允许服务器指示除自身以外的其他源（域、方案或端口），浏览器应允许从这些源加载资源。它通过添加新的 HTTP 标头来工作，让服务器描述哪些源被允许从 Web 浏览器读取该信息。 CORS...

theftfuzzer

┌┬┐┬ ┬┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┌─┐┌─┐┬─┐ │ ├─┤├┤ ├┤ │ ├┤ │ │┌─┘┌─┘├┤ ├┬┘ ┴ ┴ ┴└─┘└ ┴ └ └─┘└─┘└─┘┴└─ 介绍： TheftFuzzer 是一款用于对跨域资源共享（CORS）实现进行常见错误配置模糊测试的工具。 用法： python theftfuzzer.py -d 'http://example.com/api/data' 帮助： python theftfuzzer.py -h $ python theftfuzzer.py -h usage: theftfuzzer.py -h -d DOMAIN -...

CoolerControl 安全漏洞

CoolerControl is an open-source control software for cooling devices developed by CoolerControl. Versions of CoolerControl prior to 4.0.0 contained security vulnerabilities. These vulnerabilities were caused by incorrect CORS configurations, which could allow unverified remote attackers to read...

CORStest - A Simple CORS Misconfiguration Scanner

A simple CORSmisconfiguration scanner Based on theresearch of James Kettle CORStest is a quick & dirty Python 2 tool to find Cross-Origin Resource Sharing CORS misconfigurations. It takes a text file as input which may contain a list of domain names or URLs. Currently, the following potential...

5 Popular Web Hosting Services Found Vulnerable to Multiple Flaws

A security researcher has discovered multiple one-click client-side vulnerabilities in the some of the world's most popular and widely-used web hosting companies that could have put millions of their customers as well as billions of their sites' visitors at risk of hacking. Independent researcher...

meg+ - Automated Reconnaissance Wrapper

This wrapper will automate numerous tasks and help you during your reconnaissance process. The script finds common issues, low hanging fruit, and assists you when approaching a target. meg+ also allows you to scan all your in-scope targets on HackerOne in one go — it simply retrieves them using a...