dcrawl

dcrawl dcrawl is a simple, but smart, multi-threaded web crawler for randomly gathering huge lists of unique domain names. How it works? dcrawl takes one site URL as input and detects all links in the site's body. Each found link is put into the queue. Successively, each queued link is crawled in...

domainhunter

Domain Hunter Authors Joe Vest @joevest & Andrew Chiles @andrewchiles Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchas...

cve-2024-36401-geoserver-rce

CVE-2024-36401 — Unauthenticated RCE in GeoServer A complete, reproducible study of CVE-2024-36401 , an unauthenticated remote code execution flaw in GeoServer — the most widely deployed open-source server for geospatial data. The bug is an eval injection : through the parameters of the OGC...

CVE-2020-8163

CVE-2020-8163 Enviroment and exploit to CVE-2020-8163 Blind remote code execution of user-provided local names in Rails 5.0.1 and 4.2.11.2 Create the enviroment 1. create docker container mapping port 4000 to 8001 sudo docker run --rm -it -p 8001:4000 ruby:2.3 bash 2. update and install some tool...

CVE-2026-118780

The Forge (also known as node-forge ) JavaScript TLS implementation is vulnerable to a persistent availability impact in versions prior to 1.4.1 . The root cause is that the pki.verifyCertificateChain() and pki.createCaStore() functions improperly handle duplicate subject names . Specifically, th...

getaltname

GSAN - Get Subject Alternative Names GSAN is a tool that can extract Subject Alternative Names SAN found in SSL Certificates directly from https servers which can provide you with DNS names subdomains or virtual servers. It doesn't rely on Certificate Transparency logs, it connects directly to th...

weape

wEAPe Weape-Wireless-EAP-Extractor Script ============================================ Auto extracts EAP 802.1x user names Developed by Daniel Compton at Info-Assure Ltd https://github.com/commonexploits/weape.git Installing git clone https://github.com/commonexploits/weape.git How To Use...

mwebfp

LNHG - Massive Web Fingerprinter mwebfp Introduction The "LowNoiseHG LNHG Massive Web Fingerprinter " "mwebfp " from now on was conceived in July 2013 after realizing the usefulness of webserver screenshots to pentesters, during an engagement with large external or internal IP address ranges, as ...

dorky

Dorky Dorky is a command-line tool that searches GitHub and GitLab for matches in organization names, repository names, and usernames based on a list of input words. This tool can be helpful in identifying potential targets for security assessments, finding interesting projects, and discovering n...

gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

cloud

Cloud Monitoring the Cloud Landscape Our mission with this project is to provide an always up-to-date and freely accessible map of the cloud landscape for every major cloud service provider. We've decided to kick things off with collecting SSL certificate data of AWS EC2 and GCP machines,...

CVE-2025-27210_NodeJS_Path_Traversal_Exploit

CVE-2025-27210NodeJSPathTraversalExploiter Proof of Concept CVE-2025-27210, a precise Path Traversal vulnerability affecting Node.js applications running on Microsoft Windows. This vulnerability leverages the specific way Windows handles reserved device file names e.g., AUX, CON, NUL when combine...

pipe_finder

Pipe Finder 1.0 Automated script to search in SMB protocol for availables pipe names Screenshots Requirements metasploit-framework wget locate pipeauditv2.rb module https://github.com/peterpt/pipeauditorfb - It will be installed on first run Install Requirements apt-get install metasploit-framewo...

pe-sieve

Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...

udpx

Fast and lightweight, UDPX is a single-packet UDP scanner written in Go that supports the discovery of over 45 services with the ability to add custom ones. It is easy to use and portable, and can be run on Linux, Mac OS, and Windows. Unlike internet-wide scanners like zgrab2 and zmap, UDPX is...

CVE-2020-9484

Remote Code Execution Exploit in Apache Tomcat 9.0.27 Apache Tomcat 9.0.27 is vulnerable to Remote Code Execution with the CVE-ID CVE-2020-9484. Other versions may be affected as well. Tested on Kali 2020.4 and JDK 8. This bash script is a simpel proof-of-concept. For educational purpose only...

CVE-2017-16082

CVE-2017-16082 Overview Affected versions of pg contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. There are two specific scenarios in which it is likely for an application to be vulnerable: 1. The application executes...

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

gimphash

gimphash gimphash is a proposed method to calculate an imphash equivalent for Go binaries. It's name stands for G o-imp ort-hash. Golang binaries contain their dependencies as part of the executable. These dependencies include both standard library packages and third party dependencies and can be...

wordlistgen

wordlistgen What and why? wordlistgen is a tool to pass a list of URLs and get back a list of relevant words for your wordlists. Wordlists are much more effective when you take the application's context into consideration. wordlistgen pulls out URL components, such as subdomain names, paths, quer...