CVE-2026-119027

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers.x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init that executes wh...

CVE-2026-119028 oapi-codegen 2.0.0 before 2.8.1 Code Injection via Non-String Enum Values

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...

CVE-2026-119028

oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in...

CVE-2026-119027 oapi-codegen 2.5.0 before 2.8.1 Code Injection via servers[].x-go-name Extension

oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers.x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init that executes wh...

HTTPLoot

HTTPLoot An automated tool which can simultaneously crawl, fill forms, trigger error/debug pages and "loot" secrets out of the client-facing code of sites. Usage To use the tool, you can grab any one of the pre-built binaries from the Releases section of the repository. If you want to build the...

CVE-2022-0492-Container-Escape

CVE-2022-0492-Container-Escape CVE-2022-0492-Container-Escape Implemented in Go Reference links: https://github.com/chenaotian/CVE-2022-0492 https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/...

smogcloud

☁️ Smogcloud Find exposed AWS cloud assets that you did not know you had. A comprehensive asset inventory is step one to any capable security program. We made smogcloud to enable security engineers, penetration testers, and AWS administrators to monitor the collective changes that create dynamic...

tlsx

Features • Installation • Usage • Running tlsx • Join Discord A fast and configurable TLS grabber focused on TLS based data collection and analysis. Features Fast And fully configurable TLS Connection Multiple Modes for TLS Connection Multiple TLS probes Auto TLS Fallback for older TLS version Pr...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

CVE-2022-24715-go

CVE-2022-24715 The Icinga Web 2 exploit written in go. The original python code can be found in: https://packetstormsecurity.com/files/173516/Icinga-Web-2.10-Remote-Code-Execution.html...

gobee

gobee Write your BPF programs in Go, not C. gobee transpiles a strict subset of Go into BPF C, generates typed Go bindings for the userspace side, and gates loads against the running kernel. The Go ecosystem has solid userspace tooling for BPF. The kernel side has always ended with "now write you...

rmm

Recon MindMap RMM Taking inspiration from the TBHM v4 recon edition by Jason Haddix Workshop, I developed a command-line interface CLI tool that will simplify the task of organizing a list of domains and subdomains. The aim is to create a tool that can easily generate complex domain structures...

delve

/statusIcon.svg The GitHub issue tracker is for bugs only. Please use the developer mailing list for any feature proposals and discussions. About Delve Installation Getting Started Documentation Command line options Command line client Plugins and GUIs Frequently Asked Questions Contributing AI...

nmap

nmap This library aims at providing idiomatic nmap bindings for go developers, in order to make it easier to write security audit tools using golang. What is nmap Nmap Network Mapper is a free and open-source network scanner created by Gordon Lyon. Nmap is used to discover hosts and services on a...

JShunter

JSHunter Professional JavaScript Security Analysis Tool Complete endpoint discovery, sensitive data detection, and advanced code analysis for security professionals About JSHunter is a comprehensive command-line tool for JavaScript security analysis and endpoint discovery. Built for security...

rapid-reset-check

Rapid Reset Check rapid-reset-check is a small Go CLI for quickly inventorying HTTPS endpoints that expose HTTP/2 and therefore need a CVE-2023-44487 mitigation review. The scanner is deliberately non-exploitative. It resolves each target, opens a certificate-verified TLS connection, offers h2 an...

go-pillage-registries

go-pillage-registries This project takes a Docker registry and pillages the manifest and configuration for each image in its catalog. It uses Google's crane command's package, which should follow docker's keychain semantics. If you would like to override this, just change authn.DefaultKeychain as...

CVE-2020-11546

Preface A GO language version of the CVE-2020-11546 exploitation tool, just for practicing GO language. Usage go get -u -v github.com/damit5/CVE-2020-11546@master CVE-2020-11546 Build Yourself git clone https://github.com/damit5/CVE-2020-11546 bash build.sh...

xsubfind3r

xsubfind3r xsubfind3r is a command-line utility designed to discover subdomains for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicl...

Next.js-Exploit-Tool

Next.js-Exploit-Tool Next.js-Exploit-Tool 图形化综合利用工具。 简介 一款针对 CVE-2025-55182 的独立安全评估工具，基于 Go 开发，提供图形化界面（GUI），用于快速完成漏洞检测与验证。 更新日志 v1.3.0 新增 Godzilla 哥斯拉 内存马支持 实现了基于 Node.js 的 Godzilla 内存马注入功能，本 Payload 需配合北辰师傅的项目GodzillaNodeJsPayload 使用。 致谢 Credits ：特别感谢 北辰师傅开源的 GodzillaNodeJsPayload 项目。 新增网络代理支持...