c2

C2 The C2 repository seeks to provide a practical implementation of the ideas contained in the Red Team Infrastructure Wike at https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki. In particular, this repository provides two Go packages one for beaconers and another for downloaders. In...

nomore403

NoMore403 nomore403 es una herramienta de línea de comandos para probar bypass de control de acceso HTTP e inconsistencias en analizadores alrededor de respuestas 401, 403 y relacionadas. La herramienta está diseñada para trabajo práctico en seguridad web: bug bounty, pruebas de penetración,...

nomore403

NoMore403 nomore403 is a command-line tool for testing HTTP access-control bypasses and parser inconsistencies around 401, 403, and related responses. The tool is designed for practical web security work: bug bounty, penetration testing, security reviews, and regression testing of access-control...

cve-2023-20198

cve-2023-20198 Description. 1vere$k POC on the CVE-2023-20198 based on the Blog. Also including a check on hexademical response according to the original Cisco article. The script works in the two modes: check mode which is just makes a connection for the particular URL and checks a response code...

grc2

nimc2 Este software se encuentra en etapas muy tempranas de desarrollo y es posible que encuentres muchos problemas al usarlo nimc2 es un C2 muy ligero escrito completamente en nim. Sus usos van desde soporte al usuario hasta monitoreo de empleados. Si quieres probarlo, consulta la wiki para...

crlfmap

CRLFMap CRLFMap es una herramienta para encontrar vulnerabilidades de división HTTP ¿Por qué? Quería escribir una herramienta en Golang para concurrencia Quería poder fuzzear tanto parámetros como rutas Instalación go get github.com/ryandamour/crlfmap Ayuda Comandos disponibles: help Ayuda sobre...

crlfmap

CRLFMap CRLFMap is a tool to find HTTP Splitting vulnerabilities Why? I wanted to write a tool in Golang for concurrency I wanted to be able to fuzz both parameters and paths Installation go get github.com/ryandamour/crlfmap Help Available Commands: help Help about any command scan A scanner for...

ferret

Ferret The collaborative MITM proxy for security testers. Capture HTTP traffic, annotate requests with AI, run hunt sessions, replay traffic, and track findings from one interface. Quick start · Features · Screenshots · Configuration · Security · Contributing Quick start Install git clone...

CVE-2025-55315-PoC-Exploit

CVE-2025-55315 Pentest Tool HTTP Request Smuggling Exploitation Tool for ASP.NET Core Kestrel ⚠️ LEGAL WARNING THIS TOOL IS FOR AUTHORIZED SECURITY TESTING ONLY! Use ONLY on systems you own or have explicit written authorization to test Unauthorized access to computer systems is ILLEGAL Tool...

http2-bomb-detector

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 Non-destructive vulnerability detection tool — for Nginx / Apache httpd Vulnerability Background CVE-2026-49975 is a widespread remote denial-of-service vulnerability in the HTTP/2 protocol layer, discovered by security researcher Quang Luong. This...

CVE-2025-4664

🔒 Vulnerabilidad CVE-2025-4664 La vulnerabilidad CVE-2025-4664 es un fallo de seguridad de alta gravedad identificado en el componente Loader de Google Chrome, presente en versiones anteriores a la 136.0.7103.113. Este problema permite a un atacante remoto filtrar datos de origen cruzado mediante...

noisy

Noisy A simple python script that generates random HTTP/DNS traffic noise in the background while you go about your regular web browsing, to make your web traffic data less valuable for selling and for extra obscurity. Tested on MacOS High Sierra, Ubuntu 16.04 and Raspbian Stretch and is compatab...

chisel

Chisel Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go golang. Chisel is mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network. Table of...

Log4j-Scanner-Exploit

Log4Shell-Scanner-Exploit Bash script that allows identifying and/or exploiting the Log4Shell vulnerability remotely. This tool performs various tests using LDAP payloads and X-Api-Version, User-Agent, and X-Forwarded-For headers. Always use this script with prior authorization from the owner of...

Goahead-CVE-2017-17562

Goahead-CVE-2017-17562...

ritm

Ruby In The Middle Proxy de intercepción HTTP/HTTPS Ruby in the middle RITM es un proxy de intercepción HTTP/HTTPS con generación y firma de certificados sobre la marcha, que deja al usuario con todo el poder del lenguaje Ruby para interceptar e incluso modificar peticiones y respuestas a su...

ritm

Ruby In The Middle HTTP/HTTPS interception proxy Ruby in the middle RITM is an HTTP/HTTPS interception proxy with on-the-fly certificate generation and signing, which leaves the user with the full power of the Ruby language to intercept and even modify requests and responses as she pleases...

CLZero

CLZero A project for fuzzing HTTP/1.1 CL.0 Request Smuggling Attack Vectors. About Thank you to @albinowax, @defparam and @d3d else this tool would not exist. Inspired by the tool Smuggler all attack gadgets adapted from Smuggler and...

CVE-2010-5301

CVE-2010-5301 A proof of concept of an SEH overflow with arbitrary dll injection Description Kolibrì HTTP Server 2.0 is affected by a stack-based buffer overflow. At the time of discovery this vulnerability was exploited by simply overwriting the instruction pointer with a JMP ESP instruction,...

mitm-proxy

Go MITM Proxy A lightweight, developer-friendly Man‑in‑the‑Middle MITM HTTP/HTTPS proxy written in Go. It supports HTTP/1.1 and HTTP/2, CONNECT tunneling, WebSocket tunneling ws/wss, on‑disk response caching with flexible filters, and live config reloading. Badges Admin Dashboard Preview Overview...