Nodejs-Tracer

nodejs-tracer Simple Node.jstracer that logs calls to core modules, can spoof certain calls to defeat anti-analysis, save files written by the application and more. Useful to analyze heavily obfuscated Node.js malware. Usage root@kitploit: node -r .\tracer.js main.js Example trace with DISPLAYSTA...

XploitSPY

A cloud based Android Monitoring Tool, powered by NodeJS Features GPS Logging Microphone Recording View Contacts SMS Logs Send SMS Call Logs View Installed Apps View Stub Permissions Live Clipboard Logging Live Notification Logging WhatsApp, Facebook, Instagram, Gmail and more .... View WiFi...

L3MON

L3MON Layer 3 Advanced Network Management and Monitoring System L3MON is a cutting-edge network management and monitoring system developed using NodeJS. It empowers users with a robust and intuitive web-based interface that enables effortless network management and monitoring capabilities from an...

Recheck

Recheck Recheck Deep scan domain and find all possible domain to takeover Quick Links Demo Installation Feature Example Run / Installation How to run ? root@kitploit: git clone https://github.com/tegal1337/Recheck cd Recheck npm install npm start Feature Feature| Status ---|--- Deepscan domain| O...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

witcher

witcher Implement and monitor Appsec control at scale. Requirements NodeJS 20.13 Tested on Mac Ubuntu How to install root@kitploit: $ git clone [email protected]:mf-labs/witcher.git $ cd witcher $ npm i Build a Docker image root@kitploit: $ git clone [email protected]:mf-labs/witcher.gi...

nodejshell

NODEJSHELL - Reverse shell exploit for NodeJs deserialization CVE-2017-5941 The exploit automatically generates the reverse shell payload which is encoded in decimal and then in base64. After that, this payload is sent via an HTTP POST request that serializes the user input and stores it in a...

patchright

🎭 Patchright...

xvna

XVNA Extreme Vulnerable Node Application XVNA is an extreme vulnerable node application coded in NodejsExpressjs/MongoDB that helps security enthusiasts to learn application security. it's not counseled to host this application online as it is intended to be Vulnerable. We tend to suggest hosting...

ghostrecon

Herramienta de reconocimiento web basada en la nube, rápida y personalizable. Requisitos previos NodeJs Python3 Go pip3 npm Capturas de pantalla 📸 : Captura de pantalla 1 Captura de pantalla 2 Pasos para instalar en Linux y Mac🐧 👨🏽‍💻:...

CVE-2019-17625

CVE-2019-17625 Existe una vulnerabilidad de XSS almacenado en rambox 0.6.9 debido a parámetros no saneados en el campo de nombre cuando un usuario añade un servicio. Dado que rambox se ejecuta en NodeJS, esto permite la inyección de comandos del sistema operativo en una etiqueta o . Nota: Este...

burp-exporter

Exporter Extension for Burp Suite Community and Pro Follow us to know more about tips and others extensions Description Exporter is a Burp Suite extension to copy a request to a file or the clipboard as multiple programming languages functions. It also adds a tab called Exporter where you can...

NodeSecurityShield

Node Security Shield Node Security Shield NSS is an Open source Runtime Application Self-Protection RASP tool which aims at bridging the gap for comprehensive NodeJS security by enabling Developer and Security Engineer to declare what resources an application can access. Inspired by the Log4Shell...

Striker

Striker C2 Striker is a simple Command and Control C2 program. Disclaimer This project is under active development. Most of the features are experimental, with more to come. Expect breaking changes. Features A Agents Native agents for linux and windows hosts. Self-contained, minimal python agent...

prithvi

Prithvi Una herramienta de generación de informes para evaluación de seguridad Uso Este proyecto nuestro se puede utilizar para la generación de informes y es muy fácil de usar. Incluye las siguientes características 1. Podemos agregar tipos Owasp y recomendaciones con detalles. 2. Podemos agrega...

reconness

ReconNess Web App Why ReconNess? Well, we have seen a lot of bugbounty hackers organizing his recon using txt and doing a lot of bash scripts to filter the output to keep everything organized with the intention to focus only on the potentially vulnerable targets. But realistically this demands a...

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

Node.js st module Directory Traversal

A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. id: CVE-2014-3744 info: name: Node.js st module Directory Traversal author: geeknik severity: high description: A...

Lodash Template - Server-Side Template Injection (RCE)

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...

analyzer

This project automates the daily tasks of Threat Intelligence Analyzer role internally without external resources' interaction. It analyzes, visualizes and structures sensitive files Malware or data by extracting features, artifacts and IoC using different modules. The output of those modules can...