Resources-for-Application-Security

Updated post at https://ishaqmohammed.me/posts/resources-for-application-security/ Resources for Application Security Some good resources for getting started with application security Note: The resources which i have put are those which i will be using in my application security learnings, feel...

Moxy

Moxy Moxy Next-Gen Man in the middle proxy Open-source DAST tool for pentesting powered by agentic AI capabilities Supporting Ollama. Built on top of browser-use, Moxy streamlines dynamic application security testing. 🚀 INSANELY EASY TO USE And it's free, who doesn't like free stuff? Preview Aler...

defcon32

Defcon 32 - BugBounty Village ワークショップスライド プレゼンテーションスライド 脆弱性の解明: バグバウンティ偵察の包括的ガイド ドキュメント ProjectDiscovery ドキュメント ProjectDiscovery ツールのインストール PDTM をインストール Fuzzing / DAST ワークショップ...

OSTE-Meta-Scan

OSTE-Meta-Scanner This project is now maintained and supported by OSTE and is no longer available as an open-source project. For inquiries, commercial use, or support, please contact OSTE via LinkedIn, or official website, or sales team at +213.7.98.38.94.54 via whatsup. This project aims to...

GO-2026-6570 Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei

Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass in github.com/projectdiscovery/nuclei...

dast

dast CVE-2026-0828 构建（Build）：打开 Visual Studio 开发者命令行（x64 Native Tools）并编译代码 ： bash cl.exe /W3 /O1 /nologo exploit.c /Fe:exploit.exe 准备：确保测试机器上已安装易受攻击的 Safetica 驱动程序（ProcessMonitorDriver.sys）。如果没有，您需要自行获取（例如，从版本 11.26.19 的 Safetica 发行版中获取） 。 加载驱动程序（以管理员身份）：驱动程序必须加载到系统中。这可以通过具有管理员权限的控制台完成 ： bash sc...

dynast-bench

DynAST-Bench A DAST benchmark of intentionally-vulnerable apps with ground-truth answer keys for scoring scanners. ⚠️ This repository contains DELIBERATELY INSECURE applications. They exist only to benchmark security tooling - DAST scanners, SAST engines, and LLM security agents. Every app binds t...

akca

AKCA 高级 Web 安全扫描器 发现端点。测试 Web 应用。审查证据。 安装 · 使用 · 工作流程 · 扫描配置 · 覆盖范围 · 报告 · 支持 · 功能 · 更新日志 AKCA 是一款用 Go 编写的开源、以证据为导向的动态应用安全测试（DAST）扫描器。它将 HTTP 与浏览器辅助爬取、JavaScript 分析、API 导入、自适应主动测试、被动检查以及可重放的证据整合到一个命令行工作流程中。 为什么选择 AKCA 许多扫描器会先爬取应用，然后向每个发现的端点发送大量载荷。这种策略可能产生不必要的流量、触发防御系统，并产生需要大量人工分诊的微弱信号。AKCA...

slythestx

🐍 Slythestx 移动安全领域的瑞士军刀蠕虫 一个在 iOS 和 Android 上进行静态代码分析与动态漏洞挖掘的统一框架。 📖 目录 概述 主要功能 架构 分析器套件 快速开始 使用方法 发布与版本管理 路线图 贡献 免责声明 许可证 ⚡ 概述 Slythestx 是一款专注于移动端的安全工具包，将静态分析（SAST）和动态分析（DAST）整合到同一界面之下。它专为安全研究人员和移动端渗透测试人员打造，帮助他们快速识别目标的技术栈、审计源码中已知的危险模式，并与真实设备交互——无需同时操作十几个独立的工具。 该引擎以容器化 Web...

CVE-2026-90481

In PortSwigger Burp Suite DAST formerly Burp Suite Enterprise Edition before 2026.8, an authentication bypass can occur via an alternate path or channel...

EUVD-2026-86005

In PortSwigger Burp Suite DAST formerly Burp Suite Enterprise Edition before 2026.8, an authentication bypass can occur via an alternate path or channel...

CVE-2026-90481

In PortSwigger Burp Suite DAST formerly Burp Suite Enterprise Edition before 2026.8, an authentication bypass can occur via an alternate path or channel...

CVE-2026-90481

PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) versions before 2026.8 are vulnerable to an authentication bypass that can be triggered via an alternate path or channel. The provided documents do not specify the exact technical root cause or the specific component involved. N...

PT-2026-97848

In PortSwigger Burp Suite DAST formerly Burp Suite Enterprise Edition before 2026.8, an authentication bypass can occur via an alternate path or channel...

CVE-2026-90481: Authentication Bypass Using an Alternate Path or Channel

In PortSwigger Burp Suite DAST formerly Burp Suite Enterprise Edition before 2026.8, an authentication bypass can occur via an alternate path or channel...

CVE-2026-76805

A flaw was found in Nuclei, a vulnerability scanner. A malicious scan target can exploit a vulnerability in the Dynamic Application Security Testing DAST/fuzz mode where response content is evaluated twice and reinterpreted as template syntax. This allows the scan target to disclose sensitive...

CVE-2026-76802

A flaw was found in Nuclei, a vulnerability scanner. The Dynamic Application Security Testing DAST template loading process fails to enforce signature checks for code templates. This allows an attacker to craft a malicious template containing unsigned code, which, when processed by an operator...

Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the -env-vars / -ev option is explicitly enabled. This is an incomplete fix for CVE-2026-41645 / GHSA-jm34-66cf-qpvr. The original fix...

GHSA-JPVM-9FRM-HJCQ Nuclei: Environment Variable Disclosure via Response-Derived Data in DAST/Fuzz Mode

A vulnerability in Nuclei's DAST/fuzz expression evaluation path allows a malicious target server to trigger disclosure of scanner-host environment variables when the -env-vars / -ev option is explicitly enabled. This is an incomplete fix for CVE-2026-41645 / GHSA-jm34-66cf-qpvr. The original fix...

GHSA-JPF4-98QJ-QR67 Nuclei: Arbitrary Command Execution via DAST Code Signature Bypass

A vulnerability in Nuclei's DAST template loading path allows unsigned code: protocol templates to execute, bypassing the cryptographic signature requirement that is meant to prevent arbitrary command execution from untrusted templates. Affected Component The issue is in the template loader's DAS...