subscraper

SubScraper Overview :smallbluediamond: Usage :smallbluediamond: Contribute SubScraper is a subdomain enumeration tool that uses a variety of techniques to find subdomains of a given target. Subdomain enumeration is especially helpful during penetration testing and bug bounty hunting to uncover an...

AzSubEnum

AzSubEnum - Azure Service Subdomain Enumeration AzSubEnum is a specialized subdomain enumeration tool tailored for Azure services. This tool is designed to meticulously search and identify subdomains associated with various Azure services. Through a combination of techniques and queries, AzSubEnu...

explain-my-curl

explain-my-curl explain-my-curl is a local-first CLI for understanding what a curl command is doing across DNS, TLS, and HTTP. This repository currently includes: A CLI command to parse and explain a curl input A starter TUI for interactive exploration Execution telemetry for DNS, TCP connect, TL...

HostileSubBruteforcer

HostileSubBruteforcer This app will bruteforce for exisiting subdomains and provide the following information: IP address Host if the 3rd party host has been properly setup. for example if site.example.com is poiting to a nonexisiting Heroku subdomain, it'll alert you - Currently only works with...

dscanner

dScanner 🔍 Automated web reconnaissance tool for security audits Description dScanner consolidates multiple reconnaissance tools into a single command for the initial phase of web pentesting. Only use with authorized systems!!!! 🚀 Installation Required dependencies: curl dnsutils nmap whois httpx...

4nonimizer

If you like the 4nonimizer, please help us with whatever you want! What is 4nonimizer? It is a bash script for anonymizing the public IP used to browsing Internet, managing the connection to TOR network and to different VPNs providers OpenVPN, whether free or paid. By default, it includes several...

hostresolver

==================================================================================== HostResolver Current version: 1.0.0 Send comments and bug reports to: [email protected] ==================================================================================== Contents: 1. Overview 2. Using...

CVE-2020-8277

CVE-2020-8277 For educational purposes only. Quick Run clone this repository $ git clone https://github.com/masahiro331/CVE-2020-8277 run bind $ docker build -t bind-local ./bind Need TCP fallback $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind use " v15.2.1" version If you use fixed...

CVE-2026-34207

CVE-2026-34207 The SSRF filter checked hostname text, but the actual destination was decided later by DNS. That gap let attacker-controlled Webhook URLs reach loopback, metadata, and private network targets. Intro I found this issue while reviewing Typebot , an open-source chatbot builder, with a...

domains-from-csp

domains-from-csp A Python script to parse domain names from CSP header A script to extract domain names from Content Security PolicyCSP headers The output is print to stdout for now Demo Screenshots 3rd party package dependency requests click Setup Clone this repo $ git clone...

Citrix-NetScaler-Memory-Leak-CVE-2025-5777

CVE-2025-5777 – Citrix NetScaler Memory Leak Updated PoC This repository contains an updated Proof-of-Concept PoC for exploiting CVE-2025-5777 – a memory leak vulnerability affecting Citrix NetScaler. The original PoC by 0xgh057r3c0n works perfectly, but some users reported connection errors due ...

subbrute

subdomain-bruteforcer SubBrute SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting...

submonitor

submonitor by xpl0ited1 Description Subdomain monitor with reporting capabilities to Slack, Discord and Telegram Usage: Configure the scanning targets on the targets.txt file, set the reporting config at the config.yaml, then create a cronjob to execute every day crontab -e 0 8 /usr/bin/submonito...

sublert

/ / / / / / / / \ / / / / / / / / / / / // / // / / / / / / //,/.//// / Author: Yassine Aboukir Version: 1.4.7 What's this about? Sublert is a security and reconnaissance tool that was written in Python to leverage certificate transparency for the sole purpose of monitoring new subdomains...

mass3

Quickly enumerate through a pre-compiled list of AWS S3 buckets using DNS instead of HTTP with a list of DNS resolvers and multi-threading. Warning: Be aware that this is really shitty golang code. I wrote it without any prior knowledge of Go Lang but it seems to do the job. Feel free to contribu...

CVE-2020-8277

CVE-2020-8277 For educational purposes only. Quick Run clone this repository $ git clone https://github.com/masahiro331/CVE-2020-8277 run bind $ docker build -t bind-local ./bind Need TCP fallback $ docker run --rm --name bind -it -p 53:53 -p 53:53/udp bind use " v15.2.1" version If you use fixed...

Massive-Subdomain-Enumerator

Massive-Subdomain-Enumerator This tool uses a combination of dictionary-based wordlists brute-force and DNS resolution checks to verify the existence of subdomains. Features Wordlist Processing: Capable of handling large wordlists efficiently. Multi-threading: Boosts search speed by using multipl...

SSRF-CVE-2020-15002

Summary The URL validation logic applied when handling /appsuite/api/oxodocumentfilter&action=addfile suffers from three defects which can be used to execute Time of Check Time of Use ToCToU SSRF attack. This issue allows malicious actors to execute HTTP GET requests on internal network services...

tilt

Tilt: Terminal Ip Lookup Tool An automatic ip lookup and reverse probing tool for passive reconnaissance ████████╗██╗██╗ ████████╗ ╚══██╔══╝██║██║ ╚══██╔══╝ ██║ ██║██║ ██║ ██║ ██║██║ ██║ ██║ ██║███████╗██║ ╚═╝ ╚═╝╚══════╝╚═╝ Description Tilt: Terminal ip lookup tool, is an easy and simple open...

EUVD-2026-112916

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlis...