Parsero

什么是 Parsero？ Parsero 是一个用 Python 编写的免费脚本，用于读取 Web 服务器的 Robots.txt 文件并查看 Disallow 条目。Disallow 条目告知搜索引擎，Web 服务器上托管的哪些目录或文件不得被索引。例如，"Disallow: /portal/login" 意味着 www.example.com/portal/login 上的内容不允许被 Google、Bing、Yahoo 等爬虫索引。这是管理员不向搜索引擎分享敏感或私人信息的一种方式。 但有时这些在 Disallow 条目中输入的路径，用户无需使用搜索引擎，只需访问 URL...

CVE-2024-57778

CVE-2024-57778 描述 ：Orbe ONetView Roteador Onet-1200 中的一个问题允许远程攻击者通过将服务器响应从状态码 500 提升至状态码 200 来实现权限提升。 版本 ：发现于 Orbe ONetView Roteador Onet-1200 Orbe 1680210096，但适用于所有版本。 概念验证 当访问路由器的菜单页面 http://192.168.1.1/menu.html 并点击任意选项时，将显示 500 错误码： 之后，我们可以激活 Burp Suite 来捕获应用程序的响应。然后，再次访问...

CVE-2024-9466

CVE-2024-9466 CVE-2024-9466 概念验证 PoC 描述 该脚本通过将 /home/userSpace/devices/debug.txt 附加到目标URL或IP地址列表来检查CVE-2024-9466漏洞。它根据HTTP响应状态码以及请求是否被重定向来判断目标是否存在漏洞。 设置 确保在与脚本相同的目录中存在一个 targets.txt 文件。该文件应包含要检查的URL或IP地址列表，每行一个。例如： http://example.com http://192.168.1.1...

forbidden

Forbidden 绕过 4xx HTTP 响应状态码及更多。 该工具基于 Python Requests、PycURL 和 HTTP Client。 在 Kali Linux v2024.2（64 位）上测试。 仅用于教育目的。希望能有所帮助！ 未来计划： 添加 silent 选项以抑制控制台输出。 添加 no color 选项以禁用彩色控制台输出。 添加对 hop-by-hop HTTP 请求头的测试。 添加对 User-Agent HTTP 请求头的测试。 添加对 HTTP cookies 的测试。 添加对 HTTP 走私的测试。 添加对 CRLF 的测试。 添加对 Log4j...

rsdl

rsdl 子域名扫描器 v.2 使用 Ping 方法扫描子域名并检查 HTTP/HTTPS 状态。 标志| 值| 描述 ---|---|--- --hostname| example.com| 扫描的域名。 --output| | 以域名记录输出。 --list| /tmp/lists/example.txt| 子域名字典文件。 新特性 检查 HTTP/HTTPS 状态 更新了 HTTP/HTTPS 请求的超时时间 扫描速度更快 扫描 IP 地址 新的终端界面 安装 go get github.com/tismayil/rsdl 克隆仓库并构建（ go build rsdl.go ）...

Horn3t

Horn3t 🐝 - 更好的子域名侦察 侦察 你的目标，速度极快 提升 生产力，专注于看起来 有趣 的网站 枚举 关键站点，即刻行动 刺中 你的目标 Horn3t 是你探索子域名的头号可视化工具。 基于出色的 Sublist3r 框架（或可扩展为你喜欢的任何框架），它搜索子域名并生成精美的图片预览。通过 HTTP 状态码快速了解目标概况，添加自定义发现的子域名，并一键直接访问找到的 URL。 安装 安装 Google Chrome 使用 pip3 安装 requirements.txt 使用 pip3 安装 sublist3r 的 requirements.txt 将目录放入你选择的 W...

url-status-checker

状态检查器 URL 状态检查器 v2.1 状态检查器是一个 Python 脚本，用于检查一个或多个 URL/域名的状态，并根据其 HTTP 状态码进行分类。 版本 2.1.0 功能特性 检查单个或多个 URL/域名的状态。 异步 HTTP 请求以提升性能。 跟随重定向。 跟踪所有涉及的 IP 地址。 基于颜色编码的输出，更直观地显示状态码。 检查多个 URL 时显示进度条。 将结果保存到输出文件。 对无法访问的 URL 和无效响应进行错误处理。 命令行界面，易于使用。 安装 1. 克隆仓库： root@kitploit: git clone...

Sublist3r

About Sublist3r Sublist3r is a python tool designed to enumerate subdomains of websites using OSINT. It helps penetration testers and bug hunters collect and gather subdomains for the domain they are targeting. Sublist3r enumerates subdomains using many search engines such as Google, Yahoo, Bing,...

CVE-2026-55227 Observable object existence disclosure in private Weblate projects via globally scoped object lookups

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 Forbidden instead of 404 Not Found when a user requests an object they a...

PT-2026-82296

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description Several endpoints perform object lookups using a global scope instead of restricting the search to projects the user is authorized to access. Consequently, the system returns an HTTP 403 Forbidden...

Astra Linux – Vulnerability in Apache2

HTTP/2 incoming headers that exceed the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client continues to send headers, this can lead to memory exhaustion...

CVE-2026-55998

The CVE describes an unauthenticated import endpoint vulnerability: /v3/import/{token}_{clusterId}.yaml returns 502 for valid cluster IDs that reference clusters with private registry secrets due to a null pointer dereference in pkg/systemtemplate/private_registry.go ; non-existent cluster IDs re...

CVE-2026-8359

When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBinLoadHttpModule function in the dll would be called to set up a "module" object for that module. However, WOSHttpStatusModule.dll is not prese...

PT-2026-44093

When processing a request with a URL path starting with /status or /sysinfo, WOSHttpStatusModule.dll is to be loaded to handle such URL patterns. The WOSBin LoadHttpModule function in the dll would be called to set up a "module" object for that module. However, WOSHttpStatusModule.dll is not...

CVE-2026-44425

ShellHub is a centralized SSH gateway. Prior to 0.24.2, the device list endpoint accepts user-controlled identifiers in the the name field of each filter property in the base64-encoded filter query parameter and the sortby query parameter, which are then passed directly as BSON/SQL keys in the...

CVE-2026-42041

CVE-2026-42041 affects Axios, a promise-based HTTP client for browser and Node.js. The issue is a prototype pollution gadget in the validateStatus merge strategy (uses the in operator), allowing pollution of Object.prototype to cause HTTP error responses (401/403/500, etc.) to be treated as succe...

Axios 授权问题漏洞

Axios is an open-source HTTP client developed by Axios. Versions prior to Axios 1.15.1 and 0.31.1 have a vulnerability related to authorization. This vulnerability stems from the use of the mergeDirectKeys merging strategy in validateStatus. This strategy uses the in operator to traverse the...

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

Summary The /api/auth/login authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a 401/403 response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable dela...

CVE-2026-23738

CVE-2026-23738 affects Asterisk; prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user-supplied cookie/GET parameter values are echoed into the HTML of the /httpstatus page without escaping, enabling reflected XSS. The issue is mitigated by upgrading to the patched series (20.7...

Improper Check for Unusual or Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the auth-url annotation when a specific misconfiguration occurs involving a custom-errors configuration that includes HTTP errors 401 or 403, and the configured default custom-erro...