CVE-2022-22978

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I gathered, this is a vulnerability related to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...

rusty-hog

Rusty Hog is a secret scanner built in Rust for performance, and based on TruffleHog which is written in Python. Rusty Hog provides the following binaries: Ankamali Hog: Scans for secrets in a Google doc. Berkshire Hog: Scans for secrets in an S3 bucket. Choctaw Hog: Scans for secrets in a Git...

PhishingKitHunter

PhishingKitHunter Find phishing kits which use your brand/organization's files and image. PhishingKitHunter or PKHunter is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files as CSS, JS, .... This tool - write ...

jsleak

Description I was developing jsleak during most of my free time for my own need.It is easy-to-use command-line tool designed to uncover secrets and links in JavaScript files or source code. The jsleak was inspired by Linkfinder and regexes are collected from multiple sources. Features: Discover...

recheck

recheck The trustworthy ReDoS checker License MIT License. 2020-2025 C TSUYUSATO "MakeNowJust" Kitsune...

zap-scripts

zap-scripts Zed Attack Proxy Scripts for finding CVEs and Secrets. Building This project uses Gradle to build the ZAP add-on, simply run: root@kitploit: ./gradlew build in the main directory of the project, the add-on will be placed in the directory build/zapAddOn/bin/. Usage The easiest way to u...

CVE-2023-27704

CVE-2023-27704 CVE-2023-27704 Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service ReDoS fix at Everything 1.5 alpha Suggested description Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of...

CVE-2022-22947-POC

CVE-2022-22947-POC CVE-2022-22947 batch detection script. The echo command is not regex-filtered. Please use it for now; I will update later. Place url.txt in the script directory. Directly run: python 脚本.py Demo: After the scan is complete, a success.txt file will be generated. This script will...

caronte

caronte$ Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using...

webpalm

🌐 Advanced Web Traversal & Data Extraction 🚀 🔍 Crawl websites efficiently, extract structured data, and visualize connections. 🕵️‍♂️ 🗺️ Table of Contents 📦 Installation ⚡ Features 🚀 Usage 📌 Examples 📜 Regex Patterns 🤝 Contributing ⚡ Features 🌳 Structured Web-Tree Generation 🕵️ Regex-Based Data...

Jbin-website-secret-scraper

🎖️ Jbin will gather all the URLs from the website and then it will try to expose the secret data from them. It collects both URLs and JS links to scrape secrets out of it. Also if you are looking for a specific string in a page or want to run custom regex then you can do that too now with the new...

recollapse

REcollapse REcollapse es una herramienta auxiliar para el fuzzing de expresiones regulares en caja negra con el fin de evitar validaciones y descubrir normalizaciones en aplicaciones web. También puede ser útil para evadir WAF y mitigaciones débiles de vulnerabilidades. Para más información, echa...

SQLiDetector

SQLiDetector Script simple en Python compatible con el perfil BurpBounty que te ayuda a detectar inyecciones SQL "basadas en errores" enviando múltiples solicitudes con 14 payloads y verificando 152 patrones regex para diferentes bases de datos. root@kitploit:...

sniffles

Sniffles--Generador de Capturas de Paquetes para IDS y Evaluación de Expresiones Regulares Sniffles es una herramienta para crear capturas de paquetes que probarán IDS que usan patrones fijos o expresiones regulares para detectar comportamientos sospechosos. Sniffles funciona de manera muy simple...

titus

Titus: High-Performance Secrets Scanner Titus is a high-performance secrets scanner that detects credentials, API keys, and tokens in source code, files, and git history. It ships with 487 detection rules covering hundreds of services and credential types, drawn from NoseyParker and Kingfisher...

pmg

pmg Extrae parámetros/rutas de URLs uso : $ cat urls.txt | python3 PmG.py resultados Guardar resultados $ cat urls.txt | python3 PmG.py ResultsFile.txt aquí puedes añadir más parámetros/rutas usando regex :D root@kitploit: wordlist = r'url=|password=|link=|u=|word=|username=|linkid=', r'+CSCOU+',...

ApplicationInspector

Introduction Microsoft Application Inspector is a software source code characterization tool that helps identify coding features of first or third party software components based on well-known library/API calls and is helpful in security and non-security use cases. It uses hundreds of rules and...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

sleuthkit

The Sleuth Kit INTRODUCTION The Sleuth Kit is an open source forensic toolkit for analyzing Microsoft and UNIX file systems and disks. The Sleuth Kit enables investigators to identify and recover evidence from images acquired during incident response or from live systems. The Sleuth Kit is open...

CVE-2026-42533-Config-Scanner

nginx capture-clobber scanner A read-only static scanner that flags nginx configurations vulnerable to the complexvalue two-pass capture-clobbering bug class F5/nginx SIRT advisory, July 2026. It parses your config and reports the vulnerable pattern with the reason and location. It does not explo...