dissect

dissect Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT part of NCC Group. This project is a meta package, it will install all other Dissect modules wi...

kubernetes-goat

Kubernetes Goat ✨ The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security 🚀 🙌 Refer to https://madhuakula.com/kubernetes-goat for the guide 📖 🧰 Setting up Kubernetes Goat Ensure you have admin access to the Kubernetes cluster...

CSPTPlayground

Campo de juegos de Path Traversal del lado del cliente !Doyensec Research...

web-hacking-playground

Web Hacking Playground 描述 Web Hacking Playground 是一个受控的 Web 黑客环境。它包含真实案例中发现的漏洞，既来自渗透测试也来自漏洞赏金项目。目标是让用户能够通过这些漏洞进行练习，并学习如何检测和利用它们。 还将涉及其他有趣的主题，例如：通过创建自定义有效载荷绕过过滤器、执行利用多个漏洞的链式攻击、开发概念验证脚本等。 重要说明 应用程序源代码是可见的。然而，本实验室采用黑盒方法。因此，不应通过审查代码来解决问题。 此外，需要注意的是，模糊测试（包括参数和目录）以及暴力攻击在本实验室中不会带来任何优势。 环境搭建 建议使用 Kali...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

MASTG-Hacking-Playground

MASTG 黑客游乐场 欢迎来到 MASTG 黑客游乐场，它是 OWASP 移动应用安全（MAS）项目 的一部分。 MASTG 黑客游乐场是一系列教育性的 iOS 和 Android 移动应用，它们被故意构建得存在安全漏洞，以便为开发者、安全研究人员和渗透测试人员提供实践指导。 这些应用中的漏洞来自 OWASP 移动应用安全测试指南（MASTG）（并未完全覆盖所有测试用例，但欢迎您扩展当前的覆盖范围）。 开发者可以识别提供的应用中的漏洞代码，了解使用此类模式的后果和风险，并可以在 MASTG 中查找最佳实践以缓解漏洞。...

CVE-2025-51865

CVE-2025-51865 Descripción de la vulnerabilidad Ai2 es un instituto de investigación de IA sin fines de lucro con sede en Seattle. Ai2 proporciona una aplicación web de prueba para chatear con su LLM, la cual es vulnerable a una Referencia Directa Insegura a Objetos IDOR en su componente de chat...

Rusty-Playground

Rusty-Playground 🦀 A collection of Rust programs showcasing some offensive-securtiy and evasions techniques Tool| Description| References ---|---|--- ClipboardMon| Monitors the clipboard for changes and logs clipboard content or copies files depending on detected changes.| - DumpMDEConfig|...

CVE-2020-24227

CVE-2020-24227 Playground Sessions: almacenamiento de credenciales de usuario en texto plano Playground Sessions v2.5.582 y versiones anteriores para Windows almacena las credenciales de usuario en texto plano, lo que permite a cualquier persona con acceso a...

Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload

The Quick Playground plugin for WordPress is vulnerable to remote code execution in all versions up to, and including, 1.3.1. The plugin exposes a blueprint REST API endpoint permissioncallback: returntrue that leaks the sync code, and an uploadimage endpoint that accepts file uploads with path...

cve-2021-4034-playground

Este repositorio no tiene un README...

CVE-2025-55315-detection-playground

Aquí hay algunas pruebas que se pueden realizar contra estos servicios para observar diferentes comportamientos en las rutas GET/POST entre las versiones parcheadas y no parcheadas de Kestrel. GET contra la versión no parcheada envía 200 y el socket permanece abierto root@kitploit: printf 'GET /...

Vulnerability-Playground-CVE-2025-61922

Vulnerability-Playground-CVE-2025-61922 Este playground simula la vulnerabilidad Customer Checkout en PrestaShop...

CVE-2026-91944

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...

CVE-2026-91942

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens fro...

EUVD-2026-78801

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...

CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...

CVE-2026-91944 crawl4ai before 0.9.3 DOM-based XSS via Playground UI

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement function assigns textContent back to innerHTML, re-parsing JSON responses as HTML. Attackers can inject malicious scripts through crawled page content like th...

CVE-2026-91944

crawl4ai versions before 0.9.3 are affected by a DOM-based XSS in the Playground UI. The root cause is in the forceHighlightElement() function, which assigns textContent back to innerHTML, causing JSON responses to be re-parsed as HTML. An attacker can inject malicious scripts via crawled page co...

CVE-2026-91942

crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Docker Playground UI . The root cause is that untrusted crawl results are assigned to element.innerHTML, allowing an attacker to craft malicious PDFs with event-handler markup that execute JavaScript in t...