2861 matches found
Payload-and-Polyglot-Lists
Payload & Polyglot Lists Found a payload that doesn't work? Please open an issue with the payload, target context, and what you expected to happen. Pull requests with fixes or new payloads are always welcome. Research is ongoing. This project is under active development and will be updated with n...
SecLists
About SecLists SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to...
smugglefuzz
SmuggleFuzz SmuggleFuzz, a configurable and rapid HTTP downgrade smuggling scanner. Empowering users with customizable gadget lists, it offers deeper insights into the reasons behind failed smuggling attacks. I am confident that numerous HTTP downgrade-based smuggling vulnerabilities remain...
PAYLOAD-LISTS
Payloads List of payloads: SSTI-injection payloads XXE payloads XSS payloads Server Side Request ForgerySSRF SQL injection payloads Open Redirect payloads NoSQL injection payloads LDAP injection payloads File inclusion payloads Command injection payloads CRLF injection payloads Code injection...
IntruderPayloads
IntruderPayloads A collection of Burpsuite Intruder payloads, BurpBounty payloads https://github.com/wagiro/BurpBounty, fuzz lists and pentesting methodologies. To pull down all 3rd party repos, run install.sh in the same directory of the IntruderPayloads folder. Author: [email protected] -...
ublockdnsclient
uBlockDNS Client uBlockDNS Client is an independent project and is not affiliated with, endorsed by, or related to uBlock Origin or its maintainer. uBlockDNS Client brings DNS-level ad and tracker blocking to your entire device. It uses community-maintained filter lists such as EasyList and...
awesome-lists
Security lists for SOC/DFIR detections 🐾 Threat Hunting: ThreatHunting keywords Site ThreatHunting keywords Lists ThreatHunting Yara rules ThreatHunting searches Windows Services Searches User-Agents Searches DNS Over HTTPS Searches Suspicious TLDs Searches HijackLibs Searches Phishing & DNSTWIST...
OneListForAll
OneListForAll Wordlists for web fuzzing: curated micro, categorized short/long, and combined final lists. What this repo generates onelistforallmicro.txt: curated list maintained manually. dict/short.txt: per-category curated wordlist small/quality sources. dict/long.txt: per-category comprehensi...
Rukovoditel <= 3.2.1 - Cross Site Scripting
A stored cross-site scripting XSS vulnerability in the Global Lists feature /index.php?module=globallists/lists of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add". id:...
ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection
ASUSTOR ADM version 3.1.0.RFQ3 is vulnerable to SQL injection via the albumid parameter in the /photo-gallery/api/album/treelists/ endpoint. An attacker can exploit this vulnerability to execute arbitrary SQL commands on the database, potentially leading to information disclosure or further...
EUVD-2026-101753
Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses. Attackers can supply recipients like a display name with a parenthesized comment in the domain, so illegal character...
peer-tweet
PeerTweet Decentralized feeds using BitTorrent's DHT. Idea from Arvid and The8472 "DHT RSS feeds" http://libtorrent.org/dhtrss.html Screenshot Quick links Download the latest binaries from the releases page. Find and share PeerTweet addresses from the addresses issues page. What is PeerTweet?...
domain
Info Recon-ng and Alt-DNS are awesome. This script combines the power of these tools with the ability to run multiple domains within the same session. TLDR; I just want to do my subdomain discovery via ONE command and be done with it. Only 1 module needs an api key /api/googlesite find instructio...
log4j-log4shell-affected
log4j-log4shell-affected Lists of affected components and affected apps/vendors by CVE-2021-44228 aka Log4shell or Log4j RCE for security responders. We believe it is important to classify the vendors and products between: 1. Internal risk - what you need to patch first to remove risk internally ...
CVE-2026-109629
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lis...
CVE-2026-109629 Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lis...
duplicut
Duplicut :scissors: Elimina rápidamente duplicados de listas de palabras masivas, sin cambiar el orden Creado por nil0x42 y colaboradores 📖 Resumen Hoy en día, la creación de listas de palabras para contraseñas generalmente implica concatenar múltiples fuentes de datos. Idealmente, las contraseña...
CVE-Lists
This repository does not have a README...
dymerge
Una herramienta simple pero poderosa, escrita puramente en Python, que toma listas de palabras dadas y las fusiona en un diccionario dinámico que puede usarse como munición para un ataque exitoso basado en diccionario o por fuerza bruta. Compatible con Python 2.6 y 2.7. Autor: Nikolaos Kamarinaki...