w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

dnstwist

See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence. DNS fuzzing is an...

CVE-2025-0108

CVE-2025-0108 - PAN-OS PoC SCRIPT /!\ Aviso de exención de responsabilidad: Este script se proporciona 'tal cual' y exclusivamente con fines educativos. Se recomienda encarecidamente a los usuarios que actúen con cautela y lo utilicen dentro de los límites de las consideraciones legales y éticas...

CVE-2025-49132_poc

CVE-2025-49132 PoC Improved This is an improved version of the CVE-2025-49132 proof of concept exploit. CVE Information CVE ID : CVE-2025-49132 NVD Reference : https://nvd.nist.gov/vuln/detail/cve-2025-49132 Wiz Database : https://www.wiz.io/vulnerability-database/cve/cve-2025-49132 Original Work...

http-pulse_ssl_vpn.nse

RESUMEN Script NSE simple para detectar la divulgación de archivos de Pulse Secure SSL VPN mediante solicitudes de recursos HTTP especialmente manipuladas. Este exploit lee /etc/passwd como prueba de concepto. Esta vulnerabilidad afecta a 8.1R15.1, 8.2 anteriores a 8.2R12.1, 8.3 anteriores a...

CVE-2022-2414-Proof-Of-Concept

CVE-2022-2414-Proof-Of-Concept Se encontró una falla en pki-core. El acceso a entidades externas al analizar documentos XML puede provocar ataques de entidad externa XML XXE. Esta falla permite que un atacante remoto pueda recuperar el contenido de archivos arbitrarios mediante el envío de...

CVE-2021-3831

PHP Exploit CVE-2021-3831 Script Overview This PHP script is designed to interact with a target website by generating specific MD5 hashes and making HTTP requests to exploit potential vulnerabilities. It is intended for educational purposes and should only be used in environments where you have...

Bulk_403_Bypass

Bypass Masivo de 403 Este es un script de Bash que realiza un bypass masivo de 403 añadiendo una cabecera personalizada a las peticiones HTTP. Puede ser útil para probar si un sitio web es vulnerable a técnicas de bypass de 403. Uso Para usar el script, pasa una lista de URLs como argumento de...

http_bridge

Http Bridge Motivación Escribí este programa como una prueba de concepto para probar la idea de poder enviar paquetes de flujo TCP a través de solicitudes HTTP simples como PUT, PATCH, POST, GET, sin usar un método de proxy como CONNECT. También como ejercicio de práctica para entrenar mi novata...

cdb

Pown CDB Pown CDB is a Chrome Debug Protocol utility. The main goal of the tool is to automate common tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses. This is particularly useful during penetration tests and other types of...

hfinger

Hfinger - fingerprinting de peticiones HTTP de malware Herramienta para fingerprinting de peticiones HTTP de malware. Basada en Tshark y escrita en Python3. ¡Prototipo funcional! :- Su objetivo principal es proporcionar representaciones únicas huellas digitales de las peticiones de malware, que...

ASUS-AiCloud-RCE

Origasus origasus.go ile derlenen, ASUS AiCloud / AsusWRT ile ilişkilendirilebilecek uçların yetkili güvenlik testi veya savunma analizi ör. kendi cihazınız, yazılı penetest laboratuvarı kapsamında incelenmesi için yazılmış bir Go programıdır. Önemli: Bu tür yazılımların yetkisiz sistemlere karşı...

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

phpstress

phpstress Night Lion Security proof of concept denial of service / stress tester for PHP websites running with Apache and NGINX systems PHP-FPM and PHP-CGI Using a standard cable/DSL connection, this attack can flood a Linux web server’s CPU and RAM using standard HTTP requests. This attack effec...

jsfinder

Features | Installation | Usage | Demo | TODOs| Contact jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the UR...

xcat

XCat XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities. For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/ It supports an large number of features: Auto-selects injections run xcat injections for a list Detects t...

Re2Pcap

Re2Pcap: Crea archivos PCAP a partir de peticiones o respuestas HTTP sin procesar en segundos Re2Pcap es la abreviatura de Request2Pcap y Response2Pcap. Los usuarios de la comunidad pueden crear rápidamente un archivo PCAP usando Re2Pcap y probarlos contra las reglas de Snort. Re2Pcap te permite...

CVE-2026-50522

CVE-2026-50522 Microsoft SharePoint CVE-2026-50522 cargas útiles y análisis. Peticiones HTTP...

ReverseHttp

ReverseHttp Backdoor en Python que se comunica mediante solicitudes HTTP POST/GET Requisitos Python 2.7 Cherrypy pip install cherrypy Requests pip install requests Uso: Ejecuta el script del listener, luego el controlador, luego envía el archivo backdoor y espera conexiones. Captura de pantalla...

slowloris

slowloris.py - Simple slowloris in Python What is Slowloris? Slowloris is basically an HTTP Denial of Service attack that affects threaded servers. It works like this: 1. We start making lots of HTTP requests. 2. We send headers periodically every 15 seconds to keep the connections open. 3. We...