boringssl

BoringSSL BoringSSL is a fork of OpenSSL that is designed to meet Google's needs. Although BoringSSL is an open source project, it is not intended for general use, as OpenSSL is. We don't recommend that third parties depend upon it. Doing so is likely to be frustrating because there are no...

hacks

Hacks Hacky one-off scripts, tests etc...

pulledpork

PulledPork PulledPork for Snort and Suricata rule management from Google code Find us on Libera.Chat IRC pulledpork Copyright C 2009-2021 JJ Cummings, Michael Shirk and the PulledPork Team! Thank you for choosing to use PulledPork! This file provides some basic guidance on the usage of PulledPork...

longtongue

Generate customized Password/Passphrase wordlist based on target information Coded with 💙 by edoardottt Share on Twitter! Installation ⬇️ pipx pipx install longtongue Source git clone https://github.com/edoardottt/longtongue.git cd longtongue pip install -r requirements.txt python3 longtongue.py...

teams-cookies-bof

teams-cookies-bof Roba cookies de Teams mientras se ejecuta dentro del proceso ms-teams.exe. Publicación relacionada: https://tierzerosecurity.co.nz/2025/11/03/teams-cookies-bof.html Basado en: https://blog.randorisec.fr/ms-teams-access-tokens/. Esta herramienta se basa en gran medida en...

nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 84,997 Nuclei Templates for WordPress Security Scanning 🥳 Level up your WordPress security game! This project's got a treasure trove of fresh Nuclei templates for WordPress. Scan for weaknesses in Core, plugins, and themes – all based on the latest intel from Wordfence.com...

twebit

Bitcoin analysis with machine learning How it works? 1- Get tweets from twitter 2- Filter tweets 3- Tweet classification with naive bayes algorithm Positive,negative and neut Installation git clone https://github.com/omergunal/twebit cd twebit pip3 install -r requirements.txt Update your api keys...

cve-2021-44228

CVE-2021-44228 一个 Zeek 软件包，用于对 Log4J（CVE-2021-44228）利用尝试发出告警、标记 HTTP 连接，并可选地生成日志。 检测 HTTP 标头中包含的载荷：详见 检测 Log4Shell 的简化方法 的 说明。 使用 Zeek 签名 在 LDAP 搜索期间返回 Java 文件时生成告警。详见 通过 Zeek 与 LDAP 流量检测 Log4j 的 说明。 检测第二阶段的 Java 类何时被下载，无论载荷和第一阶段检测情况如何。详见 通过 Zeek 检测 Java 下载 Java 时的 Log4j 利用 的说明。 安装 $ zkg install...

heartbleedscanner

Heartbleed Scanner Network Scanner for OpenSSL Memory Leak CVE-2014-0160 -t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r...

zeek

The Zeek Network Security Monitor A powerful framework for network traffic analysis and security monitoring. Key Features — Documentation — Getting Started — Development — License Key Features In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis at...

EmbedInHTML

任意のファイルをHTMLに埋め込んで隠す 著者: Arno0x0x - @Arno0x0x このツールは、ファイル（ あらゆる種類のファイル ）を暗号化し、HTMLファイルにリソースとして埋め込み、組み込まれたリソースをユーザーがクリックする動作をシミュレートする自動ダウンロードルーチンと一緒に提供します。...

dnsdmpstr

dnsdmpstr Unofficial API & Client for DNS Dumpster and HackerTarget.com IP tools. https://dnsdumpster.com/ https://hackertarget.com/ip-tools/ Installation git clone https://github.com/zeropwn/dnsdmpstr cd dnsdmpstr pip3 install -r requirements.txt chmod +x ddump.py Usage As a command-line utility...

doona

Doona - Network fuzzing tool .:: About ::. Doona is a fork of the Bruteforce Exploit Detector Tool BED. BED is a program which is designed to check daemons for potential buffer overflows, format string bugs etc. Doona is Australian for duvet. It adds a significant enough number of features/change...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

creak

creak Performs some of the most famous MITM attack on target addresses located in a local network. Among these, deny navigation and download capabilities of a target host in the local network performing an ARP poison attack and sending reset TCP packets to every request made to the router. Born a...

WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting

A cross-site scripting vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. id: CVE-2012-4768 info: name: WordPress Plugin Download Monitor 3.3.5.9 - Cross-Site...

Moodle LTI module Reflected - Cross-Site Scripting

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

POS Codekop v2.0 - Broken Authentication

A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data. id: CVE-2023-36347 info: name: POS Codekop v2.0 - Broken Authentication author: princechaddha severity: high description: | A broken authentication mechanism ...

WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure

The WordPress Download Manager plugin before version 3.3.07 does not prevent directory listing on web servers that don't use htaccess, allowing unauthorized access to files stored in the download-manager-files directory. id: CVE-2024-13126 info: name: WordPress Download Manager 3.3.07 -...

Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal

The web server of Lawo AG vsm LTC Time Sync vTimeSync is affected by a "..." triple dot path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only...