chomtesh

CHOMTE.SH このリポジトリに :star: を付けて、毎日の進捗を最新の状態に保ちましょう！...

undetected-httpx

undetected-httpx undetected-httpx 是一个多功能 HTTP 探测工具包，灵感源自 httpx。它专为绕过现代反机器人基础设施而设计，通过模拟真实浏览器特征来实现。 传统 HTTP 客户端很容易被 WAF 识别并拦截。该工具利用浏览器级别的 TLS 和 HTTP 指纹（JA3/H2） 来伪装成合法用户，确保您的侦察活动不被察觉。 📦 安装 pip install undetected-httpx --upgrade 🎭 真实世界对比 你能看出区别吗？ 标准工具返回 403 Forbidden，而我们的工具返回 200 OK。 undetected-httpx...

surf

Surf - Escalate your SSRF vulnerabilities on Modern Cloud Environments surf allows you to filter a list of hosts, returning a list of viable SSRF candidates. It does this by sending a HTTP request from your machine to each host, collecting all the hosts that did not respond, and then filtering th...

surf

Surf - モダンクラウド環境におけるSSRF脆弱性を増幅させる surf を使用すると、ホストのリストをフィルタリングし、有効なSSRF候補のリストを取得できます。仕組みとしては、各ホストに対して自身のマシンからHTTPリクエストを送信し、応答がなかったすべてのホストを収集し、それらを外部向けホストと内部向けホストに分類します。...

httpx-action

httpx Action 让通过 GitHub Action 编排 httpx 变得简单。 示例用法 在主机列表上运行 httpx 的 GitHub Action - name: 💥 httpx - HTTP Web Server probing uses: projectdiscovery/httpx-action@main with: list: hosts.txt 示例工作流 ：.github/workflows/httpx.yml name: 💥 httpx - HTTP Web Server probing on: schedule: - cron: '0 0 '...

httprobe

httprobe 接收一个域名列表，并探测其中可用的 HTTP 和 HTTPS 服务器。 安装 ▶ go install github.com/tomnomnom/httprobe@latest 基本用法 httprobe 从 stdin 接收以换行符分隔的域名： ▶ cat recon/example/domains.txt example.com example.edu example.net ▶ cat recon/example/domains.txt | httprobe http://example.com http://example.net...

bothan

bothan 确认某个 ip:port 是否托管了 Empire。未来将支持其他 C2。 用法 Direct single query ❯❯ bothan -v localhost:8080 DEBU2020-01-19T20:25:02-05:00 Requesting... host="localhost:8080" INFO2020-01-19T20:25:02-05:00 SUCCESS host="http://localhost:8080" tool=empire Take a pre-existing list of host:port lines ❯❯ bothan -v...

CVE-2026-53930: Server-Side Request Forgery (SSRF)

NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without enforcing protocol or destination, allowing scheme abuse file:, ftp:, etc. and probing of internal HTTP...

CVE-2026-41195: Server-Side Request Forgery (SSRF)

mosparo is the modern solution to protect your online forms from spam. Prior to 1.4.13, the automatic rule package source URL feature allows a project member with the editor role to store an attacker-controlled URL that the server later fetches. Because the server follows http/https redirects and...