electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

petereport

PeTeReport PeTeReport Pe nTe st Report is an open-source application vulnerability reporting tool designed to assist pentesting/redteaming efforts, by simplifying the task of writting and generation of reports. Focused in product security, the tool help security researchers and pentesters to...

email-prediction-asterisks

ASTERISKS & OBELIX Email prediction asterisks is a script that allows you to identify the emails hidden behind asterisks. It is a perfect application for osint analysts and security forces. It allows to intelligently predict, using Intelx leaks, which emails are related to the person we are looki...

chaos

chaos chaos is an 'origin' IP scanner developed by RST in collaboration with ChatGPT. It is a niche utility with an intended audience of mostly penetration testers and bug hunters. An origin-IP is a term-of-art expression describing the final public IP destination for websites that are publicly...

autotimeliner

AutoTimeliner 自动从易失性内存转储中提取取证时间线。 AutoTimeliner 对 Windows、Linux 和 macOS 内存镜像运行多个 Volatility3 插件，然后将它们的输出合并为一个单一的、排序后的 CSV 时间线： 通用时间线插件 插件| 捕获内容 ---|--- timeliner| 跨插件时间戳事件（支持时适用于所有操作系统系列） Windows 插件集 插件| 捕获内容 ---|--- timeliner| 来自进程、注册表、句柄等的时间戳 mftscan| 内存中找到的 MFT 文件条目 shellbags|...

h8mail

h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent. 📖 Table of Content Table of Content Features APIs Usage Usage examples Thanks & Credits Related...

fileintel

fileintel 此工具用于收集给定文件的各种情报来源。Fileintel 采用模块化设计，因此可以轻松添加新的情报来源。 文件通过文件哈希（MD5、SHA1、SHA256）进行标识。输出为 CSV 格式并发送到 STDOUT，以便将数据保存或通过管道传输到其他程序。由于输出为 CSV 格式，Excel 等电子表格软件或数据库系统可以轻松导入数据。 本程序适用于 Python v2，但理论上也兼容 Python v3。如果发现不兼容 Python v3，请提交问题。 此代码已在 Windows 7 和 Mac OSX El Capitan 上测试。如果在其他类型的机器上尝试使用，请告知...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

hostintel

hostintel 此工具用于收集主机的各种情报来源。 Hostintel 采用模块化编写，因此可以轻松添加新的情报来源。 主机通过 FQDN 主机名、域名或 IP 地址来识别。此工具目前仅支持 IPv4。输出为 CSV 格式，发送到标准输出，因此数据可以保存或通过管道传输到其他程序。由于输出为 CSV 格式，电子表格软件（如 Excel）或数据库系统可以轻松导入数据。 我在 YouTube 上为这个工具做了一个简短的介绍：https://youtu.be/aYK0gILDA6w 此工具适用于 Python v2 和 Python v3。如果你发现它不适用于 Python v3，请提交一...

godehashed

Godehashed 一款使用 dehashed.com API 搜索受损资产的 Golang 工具。结果可编译为 CSV 文件以供进一步分析。 截图 Dehashed API 您必须向工具提供 API 密钥。请参阅 apikeytemplate.txt 文件中的示例。 安装 要在 CLI 中安装该工具，请运行以下命令。您的 $GOPATH 必须已经设置好。 go get https://github.com/an00byss/godehashed 用法 ./godehashed -s email -i apikey.txt -e SOMEDOMAIN -o leaks.csv...

Security_Article

SecurityArticle scrapy website Article and link ... 0x01 Crear un nuevo proyecto 0x02 Definir los objetivos 0x03 Crear el crawler 0x04 Almacenar contenido e.g. pip3 install lxml,scrapy root@kitploit: 文章标题 ArticleTitle //@id="wrapper"/main/div/article/header/h5/a/text...

CVE-2026-78209

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...

CVE-2026-78209

exceljs-hardened versions before 5.0.0 are vulnerable to CSV formula injection . The library fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. An attacker who can influence exported cell values can inject spreadsheet formulas that execute when the ...

Nessus-CVE-POC-Finder

Nessus-CVE-POC-Finder Python script to parse .nessus file, ext...

Exploit for Path Traversal in Fortinet Fortiproxy

CVE-2018-13379 — Mass Exploit for Fortine...

Exploit for CVE-2026-27944

Nginx UI Discovery Scanner - CVE-2026-27944 Version Detector ht...

EUVD-2017-13053

Malware in sbrugna...

CVE-2020-22275

Easy Registration Forms ER Forms Wordpress Plugin 2.0.6 allows an attacker to submit an entry with malicious CSV commands. After that, when the system administrator generates CSV output from the forms information, there is no check on this inputs and the codes are executable...

Trawler - PowerShell Script To Help Incident Responders Discover Adversary Persistence Mechanisms

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

Spartacus - DLL Hijacking Discovery Tool

Why "Spartacus"? If you have seen the film Spartacus from 1960, you will remember the scene where the Romans are asking for Spartacus to give himself up. The moment the real Spartacus stood up, a lot of others stood up as well and claimed to be him using the "I AM SPARTACUS" phrase. When a proces...