wfuzz

Wfuzz - The Web Fuzzer Wfuzz has been created to facilitate the task in web applications assessments and it is based on a simple concept: it replaces any reference to the FUZZ keyword by the value of a given payload. A payload in Wfuzz is a source of data. This simple concept allows any input to ...

wafw00f

WAFW00F The Web Application Firewall Fingerprinting Tool. — FromEnable Security -blue.svg How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions. If that is not successful, it sends a number o...

CVE-2020-35669

CVE-2020-35669 dummy server please run dummy server using 1st terminal sudo nc -l 127.0.0.1 80 apply given diff diff --git a/main.dart b/main.dart index 8c78291..a46f4d0 100644 --- a/main.dart +++ b/main.dart @@ -4,7 +4,7 @@ import 'package:http/src/request.dart'; void main async var r = Request...

SqliSniper

Features • Installation • Usage • Running SqliSniper • Contributing • SqliSniper is a robust Python tool designed to detect time-based blind SQL injections in HTTP request headers. It enhances the security assessment process by rapidly scanning and identifying potential vulnerabilities using...

cve-2025-55182-react2shell-analysis

CVE-2025-55182 React2Shell — Security Analysis Overview This project is a technical analysis of CVE-2025-55182, a critical Remote Code Execution RCE vulnerability disclosed in December 2025. The vulnerability affects React Server Components and allows attackers to execute arbitrary code via...

CVE-2025-55182

CVE-2025-55182 — React2Shell Critical Remote Code Execution in React Server Components. Severity: CRITICAL | CVSS v3.1: 10.0 Maximum | Status: Actively Exploited What Is This? React2Shell is a critical security vulnerability in React Server Components RSC — a modern feature that lets React run...

CVE-2026-44789-n8n-PrototypePollution-RCE

CVE-2026-44789 — n8n HTTP Request Node Pagination Prototype Pollution → RCE An authenticated n8n The public advisory states only that the pollution "combined with other techniques could lead to RCE" — it does not disclose a gadget. This repo documents and automates a concrete, verified...

CVE-2021-40346

CVE-2021-40346: HAProxy HTTP Request Smuggling - ACL Bypass Overview This project demonstrates CVE-2021-40346 , a critical integer overflow vulnerability in HAProxy that enables HTTP Request Smuggling attacks to bypass security controls. CVSSv3 Score: 7.5 High Contributors: 1. Boian Eduard 2...

CVE-2017-5638

CVE-2017-5638 Apache Struts 2.0 RCE vulnerability This is a script to exploit CVE-2017-5638 - It allows an attacker to inject OS commands into a web application through the content-type header Apache Struts 2 is an open-source web application framework for developing Java EE web applications. It...

CVE-2024-3273

CVE-2024-3273 Proof of Concept PoC This repository contains a Proof of Concept PoC for CVE-2024-3273, a security vulnerability discovered in D-Link NAS devices. The vulnerability allows attackers to execute arbitrary commands on vulnerable devices. Description CVE-2024-3273 is a vulnerability in...

ritm

Ruby In The Middle HTTP/HTTPS interception proxy Ruby in the middle RITM is an HTTP/HTTPS interception proxy with on-the-fly certificate generation and signing, which leaves the user with the full power of the Ruby language to intercept and even modify requests and responses as she pleases...

CVE-2021-40346

CVE-2021-40346 — HAProxy Integer Overflow leading to HTTP Request Smuggling Vulnerability Summary HAProxy is an open-source reverse proxy and load balancer that handles load distribution and ACL access control rules processing. CVE-2021-40346 is an ACL bypass vulnerability that occurs when HAProx...

CVE-2019-16278

CVE-2019-16278 - Nostromo nhttpd RCE Vulnerability Description Remote Code Execution vulnerability in Nostromo nhttpd versions 2&1 Usage python3 cve-2019-16278.py Example: python3 cve-2019-16278.py 192.168.1.100 80 "id" python3 cve-2019-16278.py 10.10.10.10 8080 "cat /etc/passwd" python3...

http-request-smuggler

HTTP Request Smuggler This Burp Suite extension automatically detects and exploits HTTP Request Smuggling vulnerabilities using advanced desynchronization techniques developed by PortSwigger researcher James Kettle. It supports comprehensive scanning for HTTP/1.1 and HTTP/2-downgrade desync...

HTTPLeaks

HTTPLeaks What is this? This project aims to enumerate all possible ways, a website can leak HTTP requests. In one single HTML file. See the file leak.html raw text version in the root of this repository. What is it for? You can use this to test your browser for CSP leaks , your web-mailer for HT...

nodejs-http-transfer-encoding-smuggling-poc

nodejs-http-transfer-encoding-smuggling-poc PoC of HTTP Request Smuggling in nodejs CVE-2020-8287 src/index.js header: 'Host', '127.0.0.1', 'Transfer-Encoding', 'chunked', 'Transfer-Encoding', 'eee' , body: 'A' header: 'Host', '127.0.0.1' , body: '' data: 'HTTP/1.1 200 OK\r\n' + 'Date: Tue, 05 Ja...

CVE-2026-23744-Remote-Code-Execution-POC

CVE-2026-23744 - MCPJam inspector Remote-Code-Execution: Proof Of Concept POC MCPJam inspector 3. Run the exploit python3 exploit.py...

BurpSuite-Grand-Master-Tools

BurpSuite-Grand-Master-Tools Bynu11secur1ty — A modular toolkit that transforms Burp captures into instant, repeatable actions. Convert. Reuse. Open. Automate. 🚀 Elevator pitch BurpSuite-Grand-Master-Tools is a lightweight, auditable, and extensible toolkit for pentesters and bug bounty hunters...

CVE-2024-29973

CVE-2024-29973 - Remote Command Injection Vulnerability Description CVE-2024-29973 is a critical vulnerability found in certain Zyxel networking devices. This vulnerability allows an unauthenticated attacker to execute arbitrary commands on the target device by exploiting improper input validatio...

react2shell-scanner

🚨 React2Shell Scanner CVSS 10.0 RCE in React Server Components. Is your React 19 app vulnerable? Fast, accurate scanner for CVE-2025-55182 React2Shell - a critical remote code execution vulnerability exploited in the wild. Zero false positives with intelligent Server Components detection. 🚨 About...