6616 matches found
jspanda
JSPanda JSpanda is client-side prototype pollution vulnerability scanner. It has two key features, scanning vulnerability the supplied URLs and analyzing the JavaScript libraries' source code. However, JSpanda cannot detect advanced prototype pollution vulnerabilities. How JSPanda works? Uses...
DET
DET extensible Data Exfiltration Toolkit DET is provided AS IS, is a proof of concept to perform Data Exfiltration using either single or multiple channels at the same time. This is a Proof of Concept aimed at identifying possible DLP failures. This should never be used to exfiltrate sensitive/li...
Limbas-4.3.36.1319-is-vulnerable-to-Cross-Site-Scripting-XSS-
Limbas-4.3.36.1319-is-vulnerable-to-Cross-Site-Scripting-XSS DESCRIPTION Limbas 4.3.36.1319 is vulnerable to Cross Site Scripting XSS LIMBAS http://www.limbas.org/ - 4.3.36.1319 PROOF OF CONCEMT UPDATE/up20.php the page reflexed with the XSS code EXAMPLE PAYLOAD 1'"&% DETAILS XSS Cross-site...
CloakBin
CloakBin Zero-Knowledge Encrypted Pastebin Your data is encrypted in your browser before it leaves your machine. The server only ever stores ciphertext. Live Demo β’ Report Bug β’ Request Feature Share a secret straight from your terminal. It encrypts on your machine before anything uploads: echo...
sharemylogin
ShareMyLogin Open Source This is the public source code for ShareMyLogin.com. What is ShareMyLogin? ShareMyLogin is a secure tool for sharing sensitive information like passwords, API keys, or config secrets. The Problem Sending a password over Slack, Email, or WhatsApp creates a permanent record...
Rogue-MySql-Server
Rogue-MySql-Server Edit script and change file to read and server port if you want. Run script and connect to your server for read file from client side. Read mysql.log for readed file content...
CVE-2022-31297
CVE-2022-31297 Haraj Script 3.7 - Reflected XSS Exploit Title: Haraj Script 3.7 - Reflected XSS Date: 2022-06-13 CVE: CVE-2022-31297 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://angtech.org/ Software Link: https://angtech.org/product/view/3 Version: 3.7 Tested on: LAMP, Ubuntu...
ppfuzz
ppfuzz Prototype Pollution Fuzzer A fast tool to scan client-side prototype pollution vulnerability written in Rust. π¦ Installation Binary Source Dependencies Demonstration Usage Basic Options Usage Supporting Materials Contributing Attribution Acknowledments License Installation Binary Simply,...
PublicSafe
PublicSafe Your Browser, Your Safe Space PublicSafe is a free and open-source browser extension focused on privacy, encryption, and user control. It provides client-side encryption tools designed to help users protect sensitive information before it leaves their browser. PublicSafe is built aroun...
pphack
pphack Advanced Client-Side Prototype Pollution Scanner Coded with π by edoardottt Share on Twitter! Install β’ Get Started β’ Examples β’ Changelog β’ Contributing β’ License Install π‘ Using Go go install github.com/edoardottt/pphack/cmd/pphack@latest pphack relies on chromedp, so you need Chrome or...
oopso
oopso An easy-to-use client-side OSINT query builder for discovering exposed file managers across search engines. Version: 1.0 Features Multi-engine support: Automatically translates fingerprints into native query syntax for Shodan, FOFA, ZoomEye, and Censys Extensive coverage: Built-in signature...
CVE-2020-28488
CVE-2020-28488 Denial of Service DoS - jQuery UI 1.12.1 - Exploit Payload for var i = 0; i DoS - jQuery UI 1.12.1 DoS - jQuery UI 1.12.1 Exploit PoC by Rafael Cintra Lopes function exploit for var i = 0; i Reference links CVE-2020-28488 Snyk jQuery UI Report...
CVE-2023-45540
HTML-Injection...
xtrace-sdk
The encrypted vector database. Your data never leaves your machine in plaintext. Documentation | X | LinkedIn Manage your AI memory β mem.xtrace.ai What is XTrace? Every vector database on the market requires you to hand your data to a third party in plaintext. XTrace doesn't. Your documents and...
CVE-2021-24891-Simulation
A hands-on, containerized lab environment to simulate and exploit a DOM-based Cross-Site Scripting XSS vulnerability in the Elementor Website Builder WordPress plugin, identified as CVE-2021-24891. π About The Vulnerability This lab demonstrates a DOM-based Cross-Site Scripting XSS vulnerability ...
cs-get-last-error
cs-get-last-error Obtain error messages from GetLastError codes directly inside the Cobalt Strike client without the help of Google search, net helpmsg, or Microsoft Error Lookup Tool. The error messages are included in the aggressor script, and no interaction with the beacon is required. The...
vulnrepo
VULNRΞPO - Vulnerability Report Generator & Repository A client-side, privacy-first vulnerability report manager for security professionals. All data is encrypted and stored locally in your browser β nothing is sent to any server by default. Live app: https://vulnrepo.com/ | Dev branch:...
JQueryingU
JQueryingU NOTES: Base client side detection code created by Christian Ludwig https://jsfiddle.net/ChristianL/AVyND/, and used by APT 29 in 2016. APT 29 modified the popup to be a POST request and used it during a conference shadowing campaign to profile user systems and who clicked before sendin...
PrettyTrusts
PrettyTrusts Try it out at:http://peewpw.github.io/PrettyTrusts Visualizes the output of PowerView's Get-DomainTrustMapping | Export-CSV -NoTypeInformation trusts.csv. Hand it the csv file and get a pretty diagram to play with! Should work with older and new PowerView outputs. Everything is...
html-poc
Proof of concept code for client-side vulnerabilities Basic HTML proof of concepts for issues such as: Clickjacking insecure CORS settings CSRF Tabnapping XSSI postMessage issues Most of these are pretty basic, but having them all in one place avoids writing the same things over and over again. T...