log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

Burp-Log4j-HammerTime

Log4j-HammerTime Questa estensione dello Scanner Attivo di Burp Suite verifica lo sfruttamento delle vulnerabilità Apache Log4j CVE-2021-44228 e CVE-2021-45046. Questa estensione utilizza Burp Collaborator per verificare il problema. Utilizzo Abilita questa estensione Avvia una scansione attiva s...

collaborator

collaborator BurpSuite मानक/निजी Collaborator लाइब्रेरी...

Log4j-RCE-Exploiter

Log4j-RCE-Exploiter Scanner per Log4j RCE CVE-2021-44228 Installazione Per l'installazione, esegui il seguente comando con SUPERUSER ROOT root@kitploit: ▶ cd Log4j-RCE-Exploiter ▶ chmod 777 installer.sh ▶ ./installer.sh Utilizzo root@kitploit: ▶ log4jExploiter -d tesla.com -b...

CollaboratorPlusPlus

CollaboratorPlusPlus Als Open Source veröffentlicht von NCC Group Plc - http://www.nccgroup.com/ Entwickelt von Corey Arthur, [email protected] http://www.github.com/nccgroup/CollaboratorPlusPlus Dieses Projekt wird unter der AGPL veröffentlicht; weitere Informationen finden Sie in der...

Collabfiltrator

Collabfiltrator Esfiltra l'output di Blind Remote Code Execution e SQL injection tramite DNS usando Burp Collaborator. Versione: 4.0.1 Autori: Adam Logue Jared McLaren Frank Scarpella Ryan Griffin Autori AI: Claude 3.5 Sonnet ChatGPT 4o Requisiti: Burp Suite Professional 2024.12.1 o successiva...

log4j

log4j-detect Semplice script Python 3 per rilevare la vulnerabilità della libreria Java "Log4j" CVE-2021-44228 per un elenco di URL con multithreading Questo script è basato su takito1812/log4j-detect Di ExodataCyberdefense Lo script "log4j-detect.py" sviluppato in Python 3 è responsabile del...

malicious-pdf

Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...

marshalsec

Java Unmarshaller Security - Turning your data into code execution If you came here for Log4Shell/CVE-2021-44228, you may want to read about the exploitation vectors and affected Java runtime versions: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ Paper It's been more than two...

BlackThrone

BlackThrone PHP BlackThrone Script Uma alternativa de código aberto ao burp collaborator BlackThrone criado para detectar tráfego WebSocket e HTTP no site principal, fornecendo alguns cabeçalhos de servidor e informações do cliente. BlackThrone é uma ferramenta baseada na web para executar em...

CVE-2026-54505

In TREK before 3.1.0, the Journey add-on interpolates an unescaped trip title into journey.frontpage.suggestionText (via TranslationContext.tsx) and renders it with dangerouslySetInnerHTML in JourneyPage.tsx. A trip owner stores HTML in a qualifying trip title; GET /api/journeys/suggestions retur...

EUVD-2026-63694

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

Malicious code in carbon-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets...

Malicious code in optimizely-starter-kit-for-fastly-compute (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...

Malicious code in global-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer —...

Malicious code in ai-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...

MAL-2026-13934 Malicious code in ai-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8949a02ffb1efc0779485ac4daedb4c0c1810f0a1a87dc5ba60c6f72c6e1cf22 The preinstall lifecycle script in preinstall.js issues an HTTPS request whose hostname is constructed as os.hostname prefixed to a hardcoded...

CVE-2026-48765

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential through handleUpdateOAuthCredentials by supplying an attacker-controlled writable...

CVE-2026-48765

CVE-2026-48765 affects TypeBot (a chatbot builder tool). Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth credentialsId from a readable bot configuration and then overwrite that credential via handleUpdateOAuthCredentials using an attacker-controlled w...