malicious-pdf

Malicious PDF Generator ☠️ Generate 67 malicious PDF test files for testing phone-home callbacks, SSRF, XSS, XXE, NTLM credential theft, and data exfiltration in PDF viewers, converters, and web applications. Can be used with Burp Collaborator or Interact.sh Used for penetration testing, bug bount...

log4j-detect

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...

collaborator

collaborator BurpSuite 표준/비공개 Collaborator 라이브러리...

BlackThrone

BlackThrone PHP BlackThrone Script An open source Alternative to burp collaborator BlackThrone created To detect websockets and HTTP traffic in the main website with provide some server header and client info. BlackThrone is web based tool to run on webservers with PHP . It will detect the visito...

Collabfiltrator

Collabfiltrator Burp Collaborator를 통해 DNS로 블라인드 원격 코드 실행RCE 및 SQL 인젝션 출력을 외부 유출합니다. 버전: 4.0.1 작성자: Adam Logue Jared McLaren Frank Scarpella Ryan Griffin AI 작성자: Claude 3.5 Sonnet ChatGPT 4o 요구 사항: Burp Suite Professional 2024.12.1 이상 지원: 소스에서 빌드하기 Burp Suite Professional에 설치하기 원본 블로그 게시물 지원되는 RCE...

CollaboratorPlusPlus

CollaboratorPlusPlus NCC Group Plc가 오픈소스로 공개 - http://www.nccgroup.com/ 개발자: Corey Arthur, [email protected] http://www.github.com/nccgroup/CollaboratorPlusPlus 이 프로젝트는 AGPL 라이선스로 공개됩니다. 자세한 내용은 LICENSE를 참조하세요. 릴리스에서 여기로 다운로드하세요. 배경 이 도구는 Burp Suite에서 제공하는 기존 Collaborator 기능을 확장하여 다양한 편의 기능과...

Log4j-RCE-Exploiter

Log4j-RCE-Exploiter Log4j RCE CVE-2021-44228을 위한 스캐너 설치 설치를 위해 SUPERUSERROOT 권한으로 다음 명령을 실행하세요: root@kitploit: ▶ cd Log4j-RCE-Exploiter ▶ chmod 777 installer.sh ▶ ./installer.sh 사용법 root@kitploit: ▶ log4jExploiter -d tesla.com -b 6nuulng8dd2sivtd3kht31s9e0kq8f.burpcollaborator.net -h, --help...

log4j

log4j-detect URL 목록에 대해 "Log4j" Java 라이브러리 취약점CVE-2021-44228을 멀티스레딩으로 탐지하는 간단한 Python 3 스크립트 이 스크립트는 takito1812/log4j-detect를 기반으로 합니다. ExodataCyberdefense 제공 Python 3로 개발된 "log4j-detect.py" 스크립트는 지정된 URL 목록이 CVE-2021-44228에 취약한지 여부를 탐지하는 역할을 합니다. 이를 위해 스레드더 높은 성능를 사용하여 지정된 목록의 각 URL에 GET 요청을 보냅니...

marshalsec

Java Unmarshaller Security - Turning your data into code execution If you came here for Log4Shell/CVE-2021-44228, you may want to read about the exploitation vectors and affected Java runtime versions: https://mbechler.github.io/2021/12/10/PSALog4ShellJNDIInjection/ Paper It's been more than two...

Burp-Log4j-HammerTime

Log4j-HammerTime 이 Burp Suite Active Scanner 확장 프로그램은 Apache Log4j CVE-2021-44228 및 CVE-2021-45046 취약점의 악용을 검증합니다. 이 확장 프로그램은 Burp Collaborator를 사용하여 문제를 확인합니다. 사용 방법 이 확장 프로그램 활성화 특정 대상에 대해 Active Scan 실행 이 모듈의 검사만 실행하려면 extensions-only.json 프로필을 가져와 Active Scan 프로필로 선택하면 됩니다. 세부 사항 Active Scan ...

MAL-2026-16140 Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

MAL-2026-14434 Malicious code in openai-pr-reviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3553acd3c5abc3f71b55740c4b06b2eb278f81bb678c55211f2287a498b60b61 The package's preinstall hook runs index.js, which collects the installer's hostname, username, home directory, DNS servers, current working director...

CVE-2026-54505

In TREK before 3.1.0, the Journey add-on interpolates an unescaped trip title into journey.frontpage.suggestionText (via TranslationContext.tsx) and renders it with dangerouslySetInnerHTML in JourneyPage.tsx. A trip owner stores HTML in a qualifying trip title; GET /api/journeys/suggestions retur...

EUVD-2026-63694

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...

Malicious code in carbon-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets...

Malicious code in optimizely-starter-kit-for-fastly-compute (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...

MAL-2026-14139 Malicious code in prism-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6570c9056bf020fdada0366045c4e91a0f5cb21171fe27df9fcea82259e7809 The package declares preinstall: "node index.js", which fires automatically on npm install. index.js collects host identifiers os.hostname,...

Malicious code in global-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer —...

MAL-2026-13952 Malicious code in global-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5449036ad6a1bf0ee192023ddb23ea7afefe53da7133ab91f4ffbc6d3253f5dc package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identity and OS files from the installer —...