sif

安装 · 用法 · 模块 · 文档 · 贡献 快速、并发的侦察到利用，全在一个二进制文件中。每个扫描器共享一个连接池化的 HTTP 客户端。 sif 是什么？ sif 是一个侦察与利用扫描器，在一个二进制文件中完成整个链路：子域名枚举、端口扫描、爬虫、nuclei、框架/CVE 检测、JS 密钥提取、Web 漏洞探测（CORS/XSS/重定向）、云与接管检查。25 种以上扫描类型，一条命令完成。 root@kitploit: sif -u https://example.com -dnslist -ports -crawl -js -framework -nuclei nuclei 和...

Mr.SIP

SIP Security, Attack and Audit Framework Mr.SIP is...

ad-ldap-enum

ad-ldap-enum ad-ldap-enum 是一个Python脚本，用于从Active Directory收集用户/计算机及其组成员信息。在大型Active Directory环境中，像NBTEnum这样的工具不够快。通过向域控制器执行LDAP查询，ad-ldap-enum能够针对特定的Active Directory属性，快速构建组成员关系。 输出文件 DomainGroupMembership.csv ExtendedDomainUserInformation.csv ExtendedDomainComputerInformation.csv 可选：当使用 -x/--exce...

john

John the Ripper This is the community-enhanced, "jumbo" version of John the Ripper. It has a lot of code, documentation, and data contributed by jumbo developers and the user community. It is easy for new code to be added to jumbo, and the quality requirements are low, although lately we've start...

cloud_enum

cloudenum Future of cloudenum I built this tool in 2019 for a pentest involving Azure, as no other enumeration tools supported it at the time. It grew from there, and I learned a lot while adding features. Building tools is fun, but maintaining tools is hard. I haven't actively used this tool...

Gitlab CE/EE 13.4 - 13.6.2 - Information Disclosure

GitLab CE and EE 13.4 through 13.6.2 is susceptible to Information disclosure via GraphQL. User email is visible. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2020-26413 info:...

Nosql-MongoDB-injection-username-password-enumeration

NoSQL注入用户名密码枚举脚本 使用此脚本，我们可以枚举存在NoSQL（MongoDB）注入漏洞的Web应用程序的用户名和密码。 漏洞标题：NoSQL注入用户名/密码枚举。 作者：Kalana Sankalpa Anon LK。 网站：https://blogofkalana.wordpress.com/2019/11/14/nosql-injection-username-and-password-enumeration/ 如何运行 用法 root@kitploit: nosqli-user-pass-enum.py -h -u URL -up parameter -pp...

saas_enum

SaaS Enum SaaS Enum es una herramienta de línea de comandos para descubrir las plataformas SaaS que una empresa puede estar utilizando. La herramienta busca registros DNS que coincidan con patrones de proveedores conocidos y, opcionalmente, realiza comprobaciones web ligeras para confirmar...

osi.ig

Open Source Information Instagram so recently ig started sending html response insted of json to "unknown" requests. i REALLY wanted this to work without login since i don't use ig anymore, tried few ways i knew to get it working without login but it didn't work :/ anyways since lot of people are...

saas_enum

SaaS Enum SaaS Enum 是一款用于发现公司可能正在使用的 SaaS 平台的命令行工具。该工具会查找与已知提供商模式匹配的 DNS 记录，并可选择执行轻量级 Web 检查以进行确认。 安装 root@kitploit: pip install -r requirements.txt 用法 基本检查 提供公司短名称（子域名）以针对所有提供商进行测试： root@kitploit: python saasenum.py -i example 批量模式 从文件中处理多家公司并将结果保存为 CSV： root@kitploit: python saasenum.py -b...

CVE-2026-21012-Rust-serde-Deserialization-of-Untrusted-Enum-Variant-Injection-

CVE-2026-21012 – Rust serde Deserialización de Enum No Confiable Inyección de Variantes Código del Programa Rust root@kitploit: // serdevuln.rs - Deserializes an enum from user JSON without validation use serde::Deserialize, Serialize; use serdejson; deriveDeserialize, Debug enum AdminAction...

CVE-2025-48734

CVE-2025-48734：Apache Commons BeanUtils – 枚举 declaringClass 信息泄露与 RCE 链 仅用于教育和授权的安全研究目的。 该仓库提供了一个受控的实验室环境，用于重现 Apache Commons BeanUtils 中的 CVE-2025-48734 漏洞，并探索攻击者在特定条件下如何升级到远程代码执行（RCE）。 📖 漏洞描述 CVE-2025-48734 影响 Apache Commons BeanUtils 1.11.0 之前的版本（以及 2.x 分支 2.0.0-M2 之前的版本）。问题在于 PropertyUtilsBea...

CVE-2026-81515

Steeltoe.Discovery.Eureka (versions 4.0.0 through 4.3.0) deserializes the Eureka registry response as a single unit. A malformed actionType , status , isCoordinatingDiscoveryServer , or timestamp field aborts the entire fetch, affecting the JsonInstanceInfoConverter , BoolStringJsonConverter , an...

onedrive_user_enum

onedriveuserenum v2.10 enumera usuarios válidos de OneDrive Para obtener un análisis completo de la técnica de enumeración y de OneDrive enum, consulta el blog aquí: https://www.trustedsec.com/blog/onedrive-to-enum-them-all/ Si buscas la versión anterior de OneDrive Enum sin base de datos, puedes...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: enable basic endpoint checking The catcprobe function fills three URBs with hardcoded endpoint pipes without verifying the endpoint descriptors. This occurs as follows: - usbsndbulkpipeusbdev, 1 and...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fixed the type of the second parameter in the odneditdpmtable callback. With Clang’s kernel control flow integrity kCFI, CONFIGCFICLANG, indirect call targets are validated against the expected function pointer...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: usb: gadget: uvc: Fixed a dereference of ERRPTR in uvcv4l2.c. Fixed the potential dereference of ERRPTR in findformatbypix and uvcv4l2enumformat. Also, fixed the following matching errors:...

azuredevops-enum

ado-enum 一个使用个人访问令牌（PAT）枚举 Azure DevOps 组织的命令行工具。它通过查询 Azure DevOps REST API 来呈现项目、仓库、服务连接、构建、构建产物和安全设置 — 在对 ADO 环境进行授权安全评估时非常有用。 功能范围与 ADOKit 类似。主要区别：采用 Python 实现，因此更具可移植性；该工具专注于只读枚举，并且能够枚举权限。 root@kitploit: Azure DevOps enumeration tool — projects, repositories, service connections, and more...

OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree

Summary The @typespec/openapi3 emitter retains the value of a @versioned enum member and interpolates it into the output filename as version without sanitizing path separators or traversal components. The completed path reaches the compiler's emitFile, which creates the parent directory and write...

SUSE CVE-2026-80910

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses EAR SPKR PA Gain" and the four "WSA RX Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol-value.integer.value0 a long instead ...