wonitor

web monitor fast, zero config web endpoint change monitor. for comparing responses, a selected list of http headers and the full response body is stored on a local key/value store file. no configuration needed. to increase network throughput, a --worker flag allows to set the concurrency when...

ipsourcebypass

This Python script can be used to bypass IP source restrictions using HTTP headers. Features 17 HTTP headers. Multithreading. JSON export with --json outputfile.json. Auto-detecting most successful bypasses...

ipsourcebypass

Este script de Python se puede usar para eludir las restricciones de fuente IP usando cabeceras HTTP. Características 17 cabeceras HTTP. Multihilo. Exportación JSON con --json outputfile.json. Detección automática de las soluciones más exitosas...

CVE-2020-17518

Уязвимость обхода каталога в Apache Flink, позволяющая читать/записывать удалённые файлы через REST API Номер уязвимости: CVE-2020-17518 Описание уязвимости: CVE-2020-17518: запись удалённых файлов через REST API Затронутые версии: Flink 1.5.1 – 1.11.2 Безопасные версии: Flink 1.11.3 или Flink...

cve-2026-22732-poc

CVE-2026-22732 — Proof of Concept Spring Security silently drops HTTP response security headers. Demo / educational use only; run it against nothing but this local app. | ---|--- CVE| CVE-2026-22732 CWE-425, published 2026-03-19 CVSS 3.1| 9.1 CRITICAL — AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Direct...

aquatone

AQUATONE Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. Installation 1. Install Google Chrome or Chromium browser -- Note: Google Chrome is currently giving unreliable results when...

CVE-2017-12542-Exploit

Bypass de autenticación de HP iLO CVE-2017-12542 Este repositorio contiene un exploit de prueba de concepto para CVE-2017-12542 , una vulnerabilidad de bypass de autenticación que afecta a ciertas versiones del firmware de HP Integrated Lights-Out iLO. La vulnerabilidad permite acceso no...

log4j2-CVE-2021-45046

Sample Log4j2 vulnerable application CVE-2021-45046 Versions Affected: all versions from 2.0-beta9 to 2.15.0 This application is based on Spring Boot web application vulnerable to CVE-2021-45046 It uses Log4j 2.14.1 through spring-boot-starter-log4j2 2.6.1. Running the application Run it:...

CVE-2026-21710

CVE-2026-21710 — Node.js req.headersDistinct DoS Summary...

L4sh

Log4Shell RCE Exploit fully independent exploit does not require any 3rd party binaries. The exploit spraying the payload to all possible logged HTTP Headers such as X-Forwarding , Server-IP , User-Agent Usage root@kitploit: python main.py -i lhost -u http://target:targetport -c "commandtoexecute...

CVE-2014-6271

CVE-2014-6271 Shellshock Exploit en Python Una implementación limpia, eficiente e interactiva en Python diseñada para probar la vulnerabilidad Shellshock CVE-2014-6271 mediante inyección de variables de entorno HTTP. 📝 Descripción Shellshock CVE-2014-6271 es una vulnerabilidad crítica de segurida...

cve-2016-5699-jinzheng-sha

cve-2016-5699-report Reading Course Report This repo references an example. simple-client.py is a Python script to make HTTP requests to the URL passed from a command argument. simple-server.py uses Flask to construct a simple HTTP server to print the headers of received requests. Set Up Install...

CVE-2024-58384

A flaw was found in Tornado's CurlAsyncHTTPClient component. This vulnerability, known as CRLF Carriage Return Line Feed injection, occurs because the client fails to properly reject carriage return and line feed characters in HTTP request headers. A remote attacker can exploit this by injecting...

EUVD-2024-55766

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests...

CVE-2026-12758

IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP headers...

CVE-2026-12758

IBM Cloud Pak for Business Automation is vulnerable to an authorization bypass caused by improper validation of HTTP headers. A remote attacker with low privileges can exploit this to invoke restricted endpoints, resulting in low confidentiality and low integrity impact (CVSS 3.1 score 5.4, MEDIU...

CVE-2026-73191

Apache Syncope is affected by a URL Redirection to Untrusted Site (Open Redirect) vulnerability in its SRA module when configured for CAS authentication . The root cause is that the target Apereo CAS instance's URL is calculated by unconditionally trusting client-supplied Forwarded HTTP headers ,...

nextjs-CVE-2025-29927

nextjs-CVE-2025-29927 Una plantilla de Nuclei para detectar CVE-2025-29927, la vulnerabilidad de omisión de autenticación en Next.js. Si quieres entender exactamente cómo funciona esta vulnerabilidad, puedes leer el excelente artículo de los investigadores originales aquí Esta plantilla es bastan...

CVE-2026-90668

A flaw was found in UnrealIRCd. The webserver component does not properly limit the number of HTTP request headers. A remote attacker can exploit this vulnerability by sending an HTTP request with an excessive number of headers, leading to memory consumption and an unresponsive server. This can...

PT-2026-91187

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentication, the target Apereo CAS instance's URL is calculated by unconditionally looking at client-supplied forwarded HTTP headers. This issue affects Apache Syncope:...