filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

credcheck

Features Check credentils of given target. Check credentials passivlyusing regex. CMD-line script. Use as library Todos Publish on pypi Inclusion of api docs Pin-pointed regexes for Creds Test cases Multiple subparsers Complete regex Uses pre-requisite 3.6+ Command line usage python main.py...

secret-regex-list

Secret Regex List List of regex for scraping secret API keys and juicy information. You can directly copy this and put into your python code, some regexes might require three quotes or else it will break the code. "Cloudinary" : "cloudinary://.", "Firebase URL": ".firebaseio.com", "Slack Token":...

shiro-cve-2022-32532

Apache Shiro CVE-2022-32532 Reproduction Environment This is a minimal web application for reproducing CVE-2022-32532 Apache Shiro RegExPatternMatcher authentication bypass. Vulnerability Description CVE : CVE-2022-32532 Affected versions : Shiro 1.9.1 Cause : RegExPatternMatcher does not properl...

FiddleZAP

FiddleZAP FiddleZAP is a simplified version of EKFiddle for OWASP ZAP. With ZAP as your web proxy, you are able to flag malicious traffic based on predefined regular expressions. Example: Alert, highlighting and tagging when a regex matches on a string within the HTML source code of a compromised...

pmg

pmg Extract parameters/paths from urls usage : $ cat urls.txt | python3 PmG.py results Save results $ cat urls.txt | python3 PmG.py ResultsFile.txt here you can add more parameters/paths using regex :D wordlist = r'url=|password=|link=|u=|word=|username=|linkid=', r'+CSCOU+', CVE-2020-3452...

mkpath

mkpath Make URL path combinations using a wordlist Read a wordlist file and generate path combinations for given domain or list of domains. Input from wordlist file is lowercased and unique words are processed. Additionally, wordlist can be filtered using regex. When you use mkpath's -l parameter...

Jbin-website-secret-scraper

🎖️ Jbin will gather all the URLs from the website and then it will try to expose the secret data from them. It collects both URLs and JS links to scrape secrets out of it. Also if you are looking for a specific string in a page or want to run custom regex then you can do that too now with the new...

deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

SecretFinder

about SecretFinder SecretFinder is a python script based on LinkFinder, written to discover sensitive data like apikeys, accesstoken, authorizations, jwt,..etc in JavaScript files. It does so by using jsbeautifier for python in combination with a fairly large regular expression. The regular...

CVE-2022-22978

CVE 2022-22978: Authorization Bypass in RegexRequestMatcher 🥶 Overview According to the information I have gathered, this vulnerability relates to the RegexRequestMatcher class in the Spring Security framework. Specifically, applications using RegexRequestMatcher where the regular expression...

phpsploit

Full-featured C2 framework which silently persists on webserver via polymorphic PHP oneliner codeclimate maintainability Created by nil0x42 and contributors !https://assets.kitploit.com/production/public/readmes/320/aca304368ddb35833ee8b1f57c068ae36288119...

ARTLAS

ARTLAS Apache Real Time Logs Analyzer System Real time Apache log analyzer, based on top 10 OWASP vulnerabilities, identifies attempts of exploration in your web application, and notify you or your incident team on Telegram, Zabbix and Syslog/SIEM. ARTLAS uses the regular expression from the...

reproxy

Reproxy is a simple edge HTTPs server / reverse proxy supporting various providers docker, static, file, consul catalog. One or more providers supply information about the requested server, requested URL, destination URL, and health check URL. It is distributed as a single binary or as a docker...

SQLiDetector

SQLiDetector Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases. +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- | S|Q|L|i...

Log4Shell-Sandbox-Signature

Log4Shell-Sandbox-Signature Log4ShellCVE-2021-45046 Sandbox Signature Regex : https://github.com/back2root/log4shell-rex Cape Sandbox Signature Cuckoo Sandbox Signature...

url-regex-safe

url-regex-safe Regular expression matching for URL's. Maintained, safe, and browser-friendly version of url-regex. Resolves CVE-2020-7661cve for Node.js servers. Works in Node v14+ and browsers. Maintained for Spam Scannerspam-scanner and Forward Emailforward-email. Table of Contents Foreword...

endext

EndExt EndExt is a .go tool for extracting all the possible endpoints from the JS files Idea When you crawll all the JS files from waybackruls for example, or even collecting the JS files urls from your target website's home source page .. If the website was using API system and you wanna look fo...

jsleak

Description I was developing jsleak during most of my free time for my own need.It is easy-to-use command-line tool designed to uncover secrets and links in JavaScript files or source code. The jsleak was inspired by Linkfinder and regexes are collected from multiple sources. Features: Discover...

zap-scripts

zap-scripts Zed Attack Proxy Scripts for finding CVEs and Secrets. Building This project uses Gradle to build the ZAP add-on, simply run: ./gradlew build in the main directory of the project, the add-on will be placed in the directory build/zapAddOn/bin/. Usage The easiest way to use this repo in...