CVE-2022-26134

CVE-2022-26134 1. 最初にshodanスクリプトを実行してすべてのIPを取得します python3 shodanscript.py -API yourapi -L limit -D "http.favicon.hash:-305179312 200" log.txt ex: python3 shodanscript.py -API xxxxxxx -L 10 -D "http.favicon.hash:-305179312 200" log.txt 2. すべての有効なIPに対して : cat log.txt | httpx -o forexploits.txt 3...

httpdoom

HttpDoom - HTTP Attack surface analyser Validate large HTTP-based attack surfaces in a very fast and reliable way. Inspired by Aquatone. Installing You must have dotnet SDK at version 6+: root@kitploit: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg...

FavFreak

FavFreak - 武器化 favicon.ico 用于漏洞赏金、OSINT 及其他 详细描述请参见此处： 阅读博客：https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 简介 我创建这个工具是为了在使用 Favicon 哈希进行侦察时让工作更轻松。它从标准输入读取 URL 列表（支持 http 或 https 协议），然后获取 favicon.ico 并计算其哈希值。它根据 favicon 哈希对域名/子域名/IP...

CVE-2020-5902

CVE-2020-5902 Shodan root@kitploit: http.favicon.hash:-335242539 "3992"...

fav-up

Fav-up faviconアイコンから実際のIPを検索し、Shodanを使用します。 インストール pip3 install -r requirements.txt Shodan APIキー（無料版ではないもの ） 使用方法 CLI まず、APIキーの渡し方を定義します： -k または --key: 標準入力でキーを渡す -kf または --key-file: キーを取得するファイル名を指定 -sc または --shodan-cli: Shodan CLIからキーを取得（初期化済みの場合） 現在、このツールは以下の3つの方法で使用できます： -ff または --favicon-file...

fav-up

Fav-up Lookups for real IP starting from the favicon icon and using Shodan. Installation pip3 install -r requirements.txt Shodan API key not the free one Usage CLI First define how you pass the API key: -k or --key to pass the key to the stdin -kf or --key-file to pass the filename which get the...

MurMurHash

MurMurHash この小さなツールは、ファビコンの MurmurHash 値を計算して、Shodan プラットフォーム上でフィッシングウェブサイトをハントするためのものです。 MurMurHash とは？ MurmurHash は、汎用的なハッシュベースのルックアップに適した非暗号化ハッシュ関数です。その名前は、内部ループで使用される2つの基本操作、乗算（MU）とローテーション（R）に由来します。現在のバージョンは MurmurHash3 であり、32ビットまたは128ビットのハッシュ値を生成します。128ビットを使用する場合、x86 と x64...

C2

通过Python生成的favicon实现C2，使用powershell读取。...

Searpy

🥀 Searpy 🔧 バッチ検索ツール。収集とトレーサビリティに利用可能 py2 と py3 に対応 1. Install root@kitploit: git clone https://github.com/j3ers3/Searpy pip install -r requirements.txt 設定APIとアカウント ./config.py python Searpy -h 2. Help root@kitploit: Searpy Engine Tookit optional arguments: -h, --help show this help message and...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra...

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

CVE-2026-85613

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-85613

OpenPanel before 2.3.0 is vulnerable to an unauthenticated cross-site scripting (XSS) flaw in the favicon proxy endpoint GET /misc/favicon . An attacker can supply a URL pointing to a malicious SVG file with embedded scripts; when a victim's browser loads the proxy, the script executes on the API...

CVE-2026-85613 OpenPanel Unauthenticated XSS via SVG Favicon Proxy

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

CVE-2026-85612 OpenPanel before 2.3.0 SSRF via favicon and og endpoints

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrary internal hosts and cloud metadata...

CVE-2026-85612

OpenPanel before 2.3.0 contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in the /misc/favicon and /misc/og endpoints. These endpoints accept an attacker-supplied url parameter with insufficient validation, allowing an attacker to force the API to fetch arbitrary interna...

CVE-2026-85242

A flaw was found in PlaywrightCapture. This vulnerability, known as Server-Side Request Forgery SSRF, allows an attacker to bypass network restrictions. By manipulating a favicon URL to redirect to an internal network address, an attacker can trick the PlaywrightCapture host into making requests ...

CVE-2026-85242

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...

CVE-2026-85242 Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture

PlaywrightCapture contains a server-side request forgery SSRF vulnerability in its favicon retrieval functionality. When onlygloballookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other non-public network addresses. However,...