SubOver

SubOver 注記 - このプロジェクトは終了しました。今後アップデートは提供されません！申し訳ありません！ しかし、もっと素晴らしいものがすぐに登場します！...

crlfmap

CRLFMap CRLFMapは、HTTP Splittingの脆弱性を発見するためのツールです。 なぜ？ Golangで並行処理のためのツールを書きたいと思いました。 パラメータとパスの両方をファジングできるようにしたいと思いました。 インストール go get github.com/ryandamour/crlfmap ヘルプ Available Commands: help Help about any command scan A scanner for all your CRLF needs Flags: -h, --help help for crlfmap scan の使い...

RatRace

RatRace Webアプリケーション、API、最新サービスの競合状態を体系的に検出・悪用するための軽量CLIツール。 解決する課題 競合状態は、最新のアプリケーションにおける最も影響の大きいセキュリティ脆弱性のひとつですが、自動スキャナーでは十分にカバーされていません。Nuclei、ffuf、sqlmapなどのツールは静的脆弱性の発見に優れていますが、並行性に基づく問題には根本的に対応できません。...

pillager

Pillager Pillage filesystems for sensitive information with Go. Table of Contents 1. Summary 2. Installation 3. Usage 4. Exfiltration 5. Documentation Summary Pillager is designed to provide a simple means of leveraging Go's strong concurrency model to recursively search directories for sensitive...

bscan

:mag: an asynchronous target enumeration tool :magright: Synopsis bscan is a command-line utility to perform active information gathering and service enumeration. At its core, bscan asynchronously spawns processes of well-known scanning utilities, repurposing scan results into highlighted console...

cngo

cngo v1 快速 Golang 工具，接收包含域名的文件名，并为每个域名获取 cname s 安装 $ go get -u github.com/yghonem14/cngo 基本用法 cngo 只接受文本文件： $ cngo -f /targets/spotify.txt creativeservice.spotify.com - creativeservicespotify.s3.amazonaws.com crashdump.spotify.com - www.crashdump.s3.amazonaws.com 并发 你可以使用 -c 标志设置并发值： $ cngo -f...

wonitor

web monitor fast, zero config web endpoint change monitor. for comparing responses, a selected list of http headers and the full response body is stored on a local key/value store file. no configuration needed. to increase network throughput, a --worker flag allows to set the concurrency when...

hacks

Hacks Hacky one-off scripts, tests etc...

ssrfuzz

SSRFUZZ SSRFuzz is a tool to find Server Side Request Forgery vulnerabilities, with CRLF chaining capabilities Why? I wanted to write a tool in Golang for concurrency I wanted to fuzz parameters for SSRF vulnerablities, as well as fuzz both paths and parameters for CRLF injections I was inspired ...

udpx

Fast and lightweight, UDPX is a single-packet UDP scanner written in Go that supports the discovery of over 45 services with the ability to add custom ones. It is easy to use and portable, and can be run on Linux, Mac OS, and Windows. Unlike internet-wide scanners like zgrab2 and zmap, UDPX is...

Zin

バージョン 1.0 😎 Zin 😎 バグバウンティ用のペイロードインジェクター（Go言語製） 機能 複数のペイロードをすべてのパラメータに注入 単一のペイロードをすべてのパラメータに注入 レスポンスを出力フォルダに保存 ステータスコードとレスポンス長を表示 レスポンス内のパターンをgrep可能 非常に高速 セットアップが簡単 インストール $ go get -u github.com/ethicalhackingplayground/Zin 新機能 ✅ レスポンス内のパターンマッチング ✅ ステータスコードのマッチング 引数 | / | ' \ / /| | | | | /||| ||...

haaukins

Haaukins Haaukins is a highly accessible and automated virtualization platform for security education, it has three main components Docker, Virtualbox and Golang, the communication and orchestration between the components managed using Go programming language. The main reason of having Go...

jsfinder

Features | Installation | Usage | Demo | TODOs| Contact jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the UR...

bxss

Bxss - Blind XSS Scanner 🚀 Description Bxss is a high-performance Blind XSS scanner that automates the detection of blind XSS vulnerabilities in web applications. ✨ Features Injects Blind XSS payloads into custom headers & parameters Supports multiple HTTP methods PUT, POST, GET, OPTIONS High-spe...

fprobe

FProbe FProbe - Fast HTTP Probe Installation GO111MODULE=on go get -u github.com/theblackturtle/fprobe Features Take a list of domains/subdomains and probe for working http/https server. Optimize RAM and CPU in runtime. Support special ports for each domain Verbose in JSON format with some...

CVE-2023-44487

CVE-2023-44487 CVE-2023-44487 の POC Python で書かれています。 .env ファイルを編集して、ターゲット URL を入力し、総リクエスト数と同時実行数を編集してください。 愛を込めて -qmvt...

CVE-2023-23752

CVE-2023-23752 CVE-2023-23752 Joomla Unauthenticated Information Disclosure Description 高并发検出をサポート urlをurls.txtに書き込みます。http://ip:port & https://ip:port 形式のみサポート -pパラメータでプロキシを追加 Just run Usage Help .\CVE-2023-23752.exe -h ██████╗██╗ ██╗███████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██████╗...

dirsearch

DirSearch This software is a Go implementation of the original dirsearch tool written by Mauro Soria. DirSearch is the very first tool I write in Go, mostly to play and experiment with Go's concurrency model, channels, and so forth : Purpose DirSearch takes an input URL -url parameter and a...

plution

plution Prototype pollution scanner using headless chrome What this is Plution is a convenient way to scan at scale for pages that are vulnerable to client side prototype pollution via a URL payload. In the default configuration, it will use a hardcoded payload that can detect 11 of the cases...

surf

Surf - Escalate your SSRF vulnerabilities on Modern Cloud Environments surf allows you to filter a list of hosts, returning a list of viable SSRF candidates. It does this by sending a HTTP request from your machine to each host, collecting all the hosts that did not respond, and then filtering th...