batchql

BatchQL BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet,...

icebox

IceBox Icebox is a Virtual Machine Introspection solution that enable you to stealthily trace and debug any process kernel or user. It's based on project Winbagility. Files which might be helpful: INSTALL.md: how to install icebox. BUILD.md: how to build icebox. Demo Project Organisation fdp: Fas...

icebox

IceBox Icebox — это решение для виртуального машинного интроспекции VMI, которое позволяет скрытно отслеживать и отлаживать любой процесс ядро или пользовательский. Оно основано на проекте Winbagility. Файлы, которые могут оказаться полезными: INSTALL.md: как установить icebox. BUILD.md: как...

mal_unpack

malunpack Dynamic unpacker based on PE-sieve 📖 Read more . It deploys a packed malware, waits for it to unpack the payload, dumps the payload, and kills the original process. !CAUTION This unpacker deploys the original malware. Use it only on a VirtualMachine. ⚙ Usage Basic usage: malunpack.exe...

graphql-cop

GraphQL Cop - Security Audit Utility for GraphQL About GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL. GraphQL Cop allows you ...

applepie

applepie, une implémentation d'hyperviseur pour Bochs Bonjour ! Bienvenue sur applepie ! C'est un outil conçu pour le fuzzing, l'introspection et la recherche de bugs ! C'est un hyperviseur utilisant l'API Windows Hypervisor Platform présente dans les versions récentes de Windows plus précisément...

CVE-2024-40094

CVE-2024-40094 ENF ExecutableNormalizedFields Exploit de déni de service Ce script exploite la vulnérabilité CVE-2024-40094 dans graphql-java en déclenchant un déni de service basé sur ExecutableNormalizedFields ENF. Il construit une requête d'introspection GraphQL spécialement conçue avec des...

graphicator

Graphicator Graphicator is a GraphQL "scraper" / extractor. The tool iterates over the introspection document returned by the targeted GraphQL endpoint, and then re-structures the schema in an internal form so it can re-create the supported queries. When such queries are created is using them to...

graphicator

Graphicator Graphicator est un « scraper » / extracteur GraphQL. L'outil parcourt le document d'introspection renvoyé par le point de terminaison GraphQL ciblé, puis restructure le schéma sous une forme interne afin de pouvoir recréer les requêtes prises en charge. Lorsque ces requêtes sont créée...

SuiteCRM Unauthenticated Graphql Introspection

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...

graphql-threat-matrix

GraphQL Threat Matrix Why graphql-threat-matrix? graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities across multiple GraphQL implementations. The differences in how GraphQL implementations interpret and conform to the...

aura

Ce dépôt a été déplacé vers un nouvel emplacement : https://github.com/SourceCode-AI/aura Audit de sécurité et introspection de code À propos du problème La tendance actuelle dans le développement est d'utiliser beaucoup de paquets en phase de développement, même s'ils n'offrent qu'une...

GraphCrawler

GraphCrawler LE Kit de test automatisé GraphQL Graph Crawler est le kit de test automatisé le plus puissant pour tout endpoint GraphQL. La version 1.2 est sortie !! NOUVEAU : peut rechercher des endpoints pour vous en utilisant le puissant outil Graphinder d'Escape Technology. Il suffit de le...

CVE-2026-94276

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-103246

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification...

CVE-2026-94276

Apache APISIX versions 3.12.0 through 3.18.0 are vulnerable to an Improper Authentication issue in the openid-connect plugin . When using remote introspection against an authorization server supporting multiple issuers, a token valid for one issuer may be incorrectly accepted on a route restricte...

CVE-2026-94276 Apache APISIX: Openid-connect introspection validation issue

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-94276 Apache APISIX: Openid-connect introspection validation issue

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

EUVD-2026-90769

Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization server that serves multiple issuers, a token that introspects as active for one issuer may get accepted on a route restricted to another. This issue...

CVE-2026-103246

The n8n workflow automation tool is vulnerable to Credential Disclosure in versions prior to 2.39.6 and 2.40.x before 2.40.1 . The root cause is a failure to validate credential ownership during inline agent node-tool introspection . An attacker can reference arbitrary credential IDs to decrypt a...