gobuster

Gobuster 💻 Introduction A fast and flexible brute-forcing tool written in Go Gobuster is a high-performance directory/file, DNS and virtual host brute-forcing tool written in Go. It's designed to be fast, reliable, and easy to use for security professionals and penetration testers. ✨ Features 🚀...

S3Scanner

S3Scanner Features - Usage - Quick Start - Installation - Discuss A tool to find open S3 buckets in AWS or other cloud providers: AWS DigitalOcean DreamHost GCP Linode Scaleway Custom Features ⚡️ Multi-threaded scanning 🔭 Supports many built-in S3 storage providers or custom 🕵️‍♀️ Scans all...

SubDomainizer

Buy Me A Coffee SubDomainizer SubDomainizer is a tool designed to find hidden subdomains and secrets present is either webpage, Github, and external javascripts present in the given URL. This tool also finds S3 buckets, cloudfront URL's and more from those JS files which could be interesting like...

s3dns

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

restic

Introducción restic es un programa de copias de seguridad rápido, eficiente y seguro. Es compatible con los tres sistemas operativos principales Linux, macOS, Windows y algunos otros más pequeños FreeBSD, OpenBSD. Para instrucciones detalladas de uso e instalación, consulta la documentación. Pued...

DoodleCloud

DoodleCloud ☁️ Turn Instagram into your personal, infinite cloud storage. DoodleCloud is a Proof-of-Concept PoC tool that uses Instagram's internal API to store unlimited files for free. By converting files into "Visual Noise" images and uploading them as DM doodles, we can bypass file type...

dumper

About Dumper This is a CLI utility for creating backups databases of various types with flexible connection and storage settings. Opportunities: Multiple database systems can be managed. Support PostgreSQL , MySQL , MongoDB and etc. Work with SSH-Keys include passphrase. Custom dump name template...

covert-control

covert-control 通过将文件上传到 Google Drive、OneDrive、Youtube 或 Telegram 来远程控制系统，使用 Python 创建文件及监听器。支持创建文本文件、图像、音频或视频，命令可使用明文或 AES 加密。 covert-googledrive.py - 将文件上传至 Google Drive 的公共文件夹，控制系统。 covert-onedrive.py - 将文件上传至 OneDrive 的公共文件夹，控制系统。 covert-youtube.py - 将视频上传至 Youtube，控制系统（从 covert-tube 更新）。...

lazywarden

安全、自动化、多云 Bitwarden 备份与导入系统 Lazywarden 是一个 Python 自动化工具，用于备份和恢复你的密码库数据，包括 Bitwarden 附件。它允许你将备份上传到多个云存储服务，并在多个平台上接收通知。它还提供 AES 加密备份，并使用 Argon2 进行密钥衍生，确保数据最高安全性。 功能 🔒 最高安全性： 使用 AES-256 加密和 Argon2 密钥衍生保护数据。 🔄 自动备份与导入： 保持 Bitwarden 密码库最新且安全。 ✅ 完整性验证： SHA-256 哈希确保每次备份的数据完整性。 ☁️ 多云支持： 将备份存储到...

cve-2025-0364

CVE-2025-0364: BigAntSoft BigAnt Server Omisión de Registro de Cuenta a RCE por Subida de Archivos El BigAntSoft BigAnt Server, que proporciona un servidor de chat local alojado en Windows y orientado a casos de uso empresarial, es vulnerable a la ejecución remota de código sin autenticación...

EUVD-2026-78210

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

PT-2026-91759

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

[SECURITY] Fedora 45 Update: rclone-1.75.0-2.fc45

"rsync for cloud storage" - Google Drive, S3, Dropbox, Backblaze B2, One Driv e, Swift, Hubic, Wasabi, Google Cloud Storage, Azure Blob, Azure Files, Yandex Files...

Linux Distros Unpatched Vulnerability : CVE-2026-88046

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject...

DEBIAN-CVE-2026-88046

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

CVE-2026-88046

rclone prior to 1.75.1 does not reject parent-directory (..) segments in source Object.Remote() values before they are passed to destination backends via fs/list, fs/walk, fs/sync, or fs/operations. A flat-keyspace source store populated with non-rclone tooling can carry a raw .. key segment, and...

CVE-2026-88046

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...