httpdoom

HttpDoom - HTTP Attack surface analyser Validate large HTTP-based attack surfaces in a very fast and reliable way. Inspired by Aquatone. Installing You must have dotnet SDK at version 6+: root@kitploit: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra...

Searpy

🥀 Searpy 🔧 Strumento di ricerca batch, utilizzabile per raccolta e tracciamento Supporta Python 2 e Python 3 1. Install root@kitploit: git clone https://github.com/j3ers3/Searpy pip install -r requirements.txt 配置API及账号 ./config.py python Searpy -h 2. Help root@kitploit: Searpy Engine Tookit...

fav-up

Fav-up Ricerca per IP reale partendo dall'icona favicon e utilizzando Shodan. Installazione pip3 install -r requirements.txt Chiave API Shodan non quella gratuita Utilizzo CLI Prima definisci come passare la chiave API: -k o --key per passare la chiave allo stdin -kf o --key-file per passare il...

CVE-2020-5902

CVE-2020-5902 Shodan root@kitploit: http.favicon.hash:-335242539 "3992"...

CVE-2022-26134

CVE-2022-26134 1. Prima esegui gli script shodan per recuperare tutti gli IP python3 shodanscript.py -API yourapi -L limit -D "http.favicon.hash:-305179312 200" log.txt ex: python3 shodanscript.py -API xxxxxxx -L 10 -D "http.favicon.hash:-305179312 200" log.txt 2. Per tutti gli IP validi : cat...

C2

C2 mittels von python generiertem Favicon, mit powershell ausgelesen...

MurMurHash

MurMurHash Questo piccolo strumento serve per calcolare un valore MurmurHash di un favicon per cacciare siti di phishing sulla piattaforma Shodan. Cos'è MurMurHash? MurmurHash è una funzione di hash non crittografica adatta per la ricerca generale basata su hash. Il nome deriva da due operazioni ...

fav-up

Fav-up Lookups for real IP starting from the favicon icon and using Shodan. Installation pip3 install -r requirements.txt Shodan API key not the free one Usage CLI First define how you pass the API key: -k or --key to pass the key to the stdin -kf or --key-file to pass the filename which get the...

FavFreak

FavFreak - Armare favicon.ico per BugBounties, OSINT e quant'altro Una descrizione dettagliata è disponibile qui: Leggi il blog qui: https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 Introduzione Ho creato questo strumento per rendere il mio lavo...

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

CVE-2026-73210

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-73210

CVE-2026-73210 identifies a server-side request forgery in Lookyloo’s PlaywrightCapture when the only_global_lookup option is enabled. Favicons embedded in processed pages could be resolved and fetched directly via an aiohttp.ClientSession, bypassing browser request-routing protections and potent...

CVE-2026-73210 Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-73210 Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-73210

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

EUVD-2026-56151

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

PT-2026-70210

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the only global lookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retriev...

SUSE CVE-2026-17859

Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17859

Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...