warhorse

Warhorse Table of contents Overview Features Documentation Development Acknowledgments Overview Warhorse consists of a fully-featured Ansible playbook to deploy infrastructure in the cloud for conducting security assessments. The Playbook combines Terraform & Ansible to deploy and configure virtu...

Payload-and-Polyglot-Lists

Payload & Polyglot Lists Found a payload that doesn't work? Please open an issue with the payload, target context, and what you expected to happen. Pull requests with fixes or new payloads are always welcome. Research is ongoing. This project is under active development and will be updated...

domain

Info Recon-ng and Alt-DNS are awesome. This script combines the power of these tools with the ability to run multiple domains within the same session. TLDR; I just want to do my subdomain discovery via ONE command and be done with it. Only 1 module needs an api key /api/googlesite find instructio...

CVE-Lists

This repository does not have a README...

ublockdnsclient

uBlockDNS Client uBlockDNS Client is an independent project and is not affiliated with, endorsed by, or related to uBlock Origin or its maintainer. uBlockDNS Client brings DNS-level ad and tracker blocking to your entire device. It uses community-maintained filter lists such as EasyList and...

PAYLOAD-LISTS

الحمولات قائمة الحمولات: حمولات حقن SSTI حمولات XXE حمولات XSS تزوير الطلبات من جانب الخادم SSRF حمولات حقن SQL حمولات إعادة التوجيه المفتوحة حمولات حقن NoSQL حمولات حقن LDAP حمولات تضمين الملفات حمولات حقن الأوامر حمولات حقن CRLF حمولات حقن الأكواد حمولات حقن JavaScript من جانب الخادم SSJI حمولا...

smugglefuzz

SmuggleFuzz SmuggleFuzz, a configurable and rapid HTTP downgrade smuggling scanner. Empowering users with customizable gadget lists, it offers deeper insights into the reasons behind failed smuggling attacks. I am confident that numerous HTTP downgrade-based smuggling vulnerabilities remain...

duplicut

Duplicut :scissors: قم بإزالة التكرارات بسرعة من قوائم الكلمات الضخمة، دون تغيير الترتيب...

EIPP

قوائم كلمات المرور المحظورة EIPP أدوات للتعامل مع قوائم كلمات المرور المحظورة BPL الخاصة بحماية كلمات مرور Entra ID. تم تفريغ ملف eipp-global-bpl.txt الذي يحتوي على إدخالات قائمة كلمات المرور المحظورة العامة في 2024-04-11. مزيد من المعلومات على...

peer-tweet

PeerTweet Decentralized feeds using BitTorrent's DHT. Idea from Arvid and The8472 "DHT RSS feeds" http://libtorrent.org/dhtrss.html Screenshot Quick links Download the latest binaries from the releases page. Find and share PeerTweet addresses from the addresses issues page. What is PeerTweet?...

intelmq

docs/index.md...

OneListForAll

OneListForAll Wordlists for web fuzzing: curated micro, categorized short/long, and combined final lists. What this repo generates onelistforallmicro.txt: curated list maintained manually. dict/short.txt: per-category curated wordlist small/quality sources. dict/long.txt: per-category comprehensi...

IntruderPayloads

IntruderPayloads A collection of Burpsuite Intruder payloads, BurpBounty payloads https://github.com/wagiro/BurpBounty, fuzz lists and pentesting methodologies. To pull down all 3rd party repos, run install.sh in the same directory of the IntruderPayloads folder. Author: [email protected] -...

SecLists

About SecLists SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more. The goal is to...

dymerge

एक सरल, फिर भी शक्तिशाली उपकरण - विशुद्ध रूप से पायथन में लिखित - जो दिए गए वर्डलिस्ट को लेता है और उन्हें एक गतिशील शब्दकोश में विलय करता है जिसका उपयोग सफल शब्दकोश-आधारित या ब्रूटफोर्स हमले के लिए गोला-बारूद के रूप में किया जा सकता है। पायथन 2.6 और 2.7 के साथ संगत। लेखक: Nikolaos Kamarinakis...

log4j-log4shell-affected

log4j-log4shell-affected CVE-2021-44228 उर्फ log4shell या log4j RCE से प्रभावित घटकों और प्रभावित ऐप्स/विक्रेताओं की सूची, सुरक्षा प्रतिक्रियाकर्ताओं के लिए। हम मानते हैं कि विक्रेताओं और उत्पादों को इस प्रकार वर्गीकृत करना महत्वपूर्ण है: 1. आंतरिक जोखिम - जिसे पहले पैच करने की आवश्यकता है ताकि...

ASUSTOR ADM 3.1.0.RFQ3 - SQL Injection

ASUSTOR ADM version 3.1.0.RFQ3 is vulnerable to SQL injection via the albumid parameter in the /photo-gallery/api/album/treelists/ endpoint. An attacker can exploit this vulnerability to execute arbitrary SQL commands on the database, potentially leading to information disclosure or further...

Rukovoditel <= 3.2.1 - Cross Site Scripting

A stored cross-site scripting XSS vulnerability in the Global Lists feature /index.php?module=globallists/lists of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add". id:...

CVE-2026-84305

sqlparse , a non-validating SQL parser for Python, is vulnerable to quadratic CPU consumption in versions prior to 0.6.0. When processing attacker-controlled parenthesized tuple lists via sqlparse.format(sql, reindent=True) or sqlformat --reindent, the ReindentFilter._get_offset() function in sql...

CVE-2026-84305 sqlparse: Reindentation of tuple lists causes near-cap quadratic CPU consumption

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.formatsql, reindent=True and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter.getoffset in sqlparse/filters/reindent.py, where flattenuptotoken repeatedly rebuilds an...