moniorg

moniorg 描述 攻击者通过查看证书透明度日志，可以完全被动地收集大量关于组织基础设施的信息，例如内部域名、电子邮件地址。 moniorg 利用证书透明度日志，根据 SSL 证书中的组织字段来监控新颁发的域名。 安装 git clone https://github.com/yousseflahouifi/moniorg.git 依赖要求 使用的 Python 版本：Python 3.x。 moniorg 依赖几个模块来运行： pip install os sys termcolor difflib json argparse 若要在 VPS...

hardcidr

hardCIDR Background A Linux Bash script to discover the netblocks, or ranges, in CIDR notation owned by the target organization during the intelligence gathering phase of a penetration test. This information is maintained by the five Regional Internet Registries RIRs: ARIN North America RIPE...

git-alerts

GitAlerts 它解决了什么问题？ 组织下创建的 GitHub 仓库可由 GitHub 管理员控制。然而，在组织用户账户下创建的任何仓库是无法控制的，除非组织采用了 GitHub 企业托管用户（EMU）模型。 组织用户账户下意外创建或用于测试目的的任何公开仓库，都可能泄露机密、内部信息、代码等。GitAlerts 可帮助您检测和监控此类情况。 示例 可由管理员控制 https://github.com// 无法由管理员控制 https://github.com// GitAlerts 平台（Web UI + API） 寻找一个完整的平台？ GitAlerts API...

cloud

Cloud Monitoring the Cloud Landscape Our mission with this project is to provide an always up-to-date and freely accessible map of the cloud landscape for every major cloud service provider. We've decided to kick things off with collecting SSL certificate data of AWS EC2 and GCP machines,...

seekr

A multi-purpose toolkit for gathering and managing OSINT-Data with a neat web-interface. Introduction Seekr is a multi-purpose toolkit for gathering and managing OSINT-data with a sleek web interface. Our desktop view enables you to have all of your favourite OSINT tools integrated in one. The...

kostebek

Reconnaissance Tool Introduction The Kostebek is a reconnaissance tool which uses firms' trademark information to discover their domains. Reference : https://evren.ninja/en/post/recon-is-everywhere/ Demo video : Setup Downloading Kostebek git clone https://github.com/esecuritylab/kostebek...

Benchmark

The OWASP Benchmark project GitHub repository has moved. There is now a new GitHub organization for OWASP Benchmark at: https://github.com/OWASP-Benchmark and what was https://github.com/OWASP/Benchmark is now: https://github.com/OWASP-Benchmark/BenchmarkJava Over time, additional subprojects are...

weakpass

Weakpass Here, you can find the list of tools and example of API server from weakpass.com for password and hash cracking in one place. 📂 Folder Structure tools A collection of password and hash cracking tools. Check them out: Kraker-js Lookup Passcheck Passgen libs Links to the libraries used in...

Mindmap

Hacking Articles- Mapa Mental de Ciberseguridad Una colección completa de mapas mentales de ciberseguridad que cubren tecnologías, herramientas, metodologías, cursos y certificaciones utilizados en la industria de la seguridad. Este repositorio organiza conceptos complejos de ciberseguridad en...

terraform-aws-secure-baseline

terraform-aws-secure-baseline Terraform Module Registry A terraform module to set up your AWS account with the reasonably secure configuration baseline. Most configurations are based on CIS Amazon Web Services Foundations v1.4.0 and AWS Foundational Security Best Practices v1.0.0. See Benchmark...

Redeye

Redeye 该项目由渗透测试人员为渗透测试人员构建。 Redeye 是一款旨在帮助您在渗透测试操作中以最高效、最有条理的方式管理数据的工具。 目录 Redeye 目录 开发者 概述 安装 Docker 源码 通用 特别感谢 致谢 开发者 Daniel Arad - @dandanarad && Elad Pticha - @eladpt 概述 服务器面板将显示所有已添加的服务器及服务器基本信息，例如：拥有用户、开放端口以及是否已被攻破。 进入服务器后，将出现一个编辑面板。我们可以添加在服务器上发现的新用户、发现的漏洞，并添加相关的成果和文件。...

shodan

Shodan Dorks by twitter.com/lothos612 Feel free to make suggestions Shodan Dorks Basic Shodan Filters city: Find devices in a particular city. city:"Bangalore" country: Find devices in a particular country. country:"IN" geo: Find devices by giving geographical coordinates...

git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

Pentest-Collaboration-Framework

Pentest Collaboration Framework Pentest Collaboration Framework - an opensource, cross-platform and portable toolkit for automating routine processes when carrying out various works for testing! Explore the docs » ‼️ Important Links...

domain-protect

domain-protect Domain Protect is now an OWASP project moved to: github.com/domain-protect/domain-protect...

Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure

Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken middleware, exposing team IDs, names, descriptions,...

Github Enterprise - Remote Code Execution

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

CVE-2026-100617

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...

CVE-2026-100604

ClawHub openclaw/clawhub contains an incorrect authorization vulnerability in the ClawHub application/backend: an organization-owned skill retains the ownerUserId of its original publisher, and transfer and lifecycle authorization checks trust that historical user before requiring current...

EUVD-2026-87712

Cap-go capgo.app fails to validate that principals in channelpermissionoverrides belong to the organization, allowing authenticated app/org admins to grant channel permissions to non-member users. Attackers with admin privileges can insert override rows with arbitrary external user UUIDs to grant...