FiddleZAP

FiddleZAP FiddleZAP is a simplified version of EKFiddle for OWASP ZAP. With ZAP as your web proxy, you are able to flag malicious traffic based on predefined regular expressions. Example: Alert, highlighting and tagging when a regex matches on a string within the HTML source code of a compromised...

mXtract

mXtract mXtract is an opensource linux based tool that analyzes and dumps memory. It is developed as a pentration testing tool, its primary purpose is to scan memory for private keys, ips, and passwords using regexes. Remember, your results are only as good as your regexes. Screenshots Scan with...

SQLiDetector

SQLiDetector Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases. +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- | S|Q|L|i...

git-wild-hunt

git-wild-hunt A tool to hunt for credentials in the GitHub wild AKA githunt Getting started 1. Install the tool 2. Configure your GitHub token 3. Search for credentials 4. See results cat results.json | jq 📺 Demo Installation requirements: virtualenv, python3 1. git clone...

PhishingKitHunter

PhishingKitHunter Find phishing kits which use your brand/organization's files and image. PhishingKitHunter or PKHunter is a tool made for identifying phishing kits URLs used in phishing campains targeting your customers and using some of your own website files as CSS, JS, .... This tool - write ...

FakeDns

FakeDns Update 4/14/2020 - Python 2 support removed and code swapped to Python3 Now with round-robin & improved options! Bugs: @crypt0s - Twitter [email protected] - Email A python regular-expression based DNS server! USAGE: ./fakedns.py -h -c Config path -i interface IP address --rebind The...

EKFiddle

EKFiddle v.1.2.6 An extension/rules for the Fiddler Classic web debugger to analyze malicious web traffic. Fiddler Classic Installation Download and install Fiddler from here: https://www.telerik.com/fiddler Download and run EKFiddleExtension.exe Alternatively, download EKFiddle.dll and put it in...

yaralyzer

EL YARALIZADOR Inspecciona visualmente todas las coincidencias regex y sus primos más sexis y misteriosos, las coincidencias YARA encontradas en datos binarios y/o texto. Observa lo que sucede cuando fuerzas varias codificaciones de caracteres sobre esos bytes coincidentes. Con colores. Inicio...

httpgrep

Descripción Una herramienta Python rápida y asíncrona que escanea servidores HTTPS y busca cadenas o patrones regex en cuerpos y cabeceras de respuestas HTTP. Acepta hosts individuales, URLs, rangos CIDR, rangos IP o archivos; escanea múltiples puertos por objetivo único, listas separadas por com...

CVE-2022-22978-PoC

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I have gathered, this vulnerability is related to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...

anteater

Anteater - Marco de Verificación de Puerta CI/CD Descripción Anteater es un marco abierto para evitar la fusión no deseada de cadenas nominadas, nombres de archivo, binarios, funciones obsoletas, código/credenciales de entorno de staging, etc. Cualquier cosa que pueda especificarse con sintaxis d...

mnemosyne

Mnemosyne is a generic Windows-based memory scraping tool. It scans a process memory space for a search string or regex unicode and ascii then if found, spits these out either to stdout, a file or a socket to a remote listener. The utility is useful for memory scraping a process, as a...

GitMiner3

Autor: UnkL4b Site: bravul.com Blog: unkl4b.github.io Github: UnkL4b X: @UnkL4b WARNING +---------------------------------------------------+ | DEVELOPERS ASSUME NO LIABILITY AND ARE NOT | | RESPONSIBLE FOR ANY MISUSE OR DAMAGE CAUSED BY | | THIS PROGRAM |...

CVE-2026-93761 Denial of service via unbounded regex matching in Mongoid's in-memory query matcher

An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthenticated party to cause excessive processing within an embedding application process. Applications that place user-supplied text into a pattern-matching query...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

nginx: NGINX: Arbitrary code execution via crafted HTTP requests

A flaw was found in NGINX. An unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP requests when the map directive uses regular expression regex matching and references regex capture variables before referencing the map output variable. This can lead to a heap...

Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

Problem descriptionProtego constructs regular expressions to match URLs against robots.txt Allow: and Disallow: directives, see protego.urlpattern.URLPattern.preparepatternforregex. Every in the directive value is translated into a lazy .? regex piece, thus a specially crafted directive value wit...

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...