hakoriginfinder

hakoriginfinder Herramienta para descubrir el host de origen detrás de un proxy inverso. Útil para eludir WAF y otros proxies inversos. ¿Cómo funciona? Esta herramienta primero realiza una solicitud HTTP al hostname/URL que proporcione y almacena la respuesta, luego realiza una solicitud a cada...

muraena

Muraena is an almost-transparent reverse proxy aimed at automating phishing and post-phishing activities. The tool re-implements the 15-years old idea of using a custom reverse proxy to dynamically interact with the origin to be targeted, rather than maintaining and serving static pages...

pomerium

Pomerium is an identity and context-aware reverse proxy. Pomerium builds secure, clientless connections to internal web apps and other services without a corporate VPN. Pomerium is: Easier with clientless access. Faster by being tunnel-free and deployed where your apps and services are. Safer...

redi

redi Automated redirector setup compatible with HTTP RATs CobaltStrike Beacon, meterpreter, etc, and CobaltStrike DNS Beacon. The script can either set up nginx reverse proxy, or DNS proxy/forwarder using dnsmasq. If HTTPS was selected, it will automatically setup letsencrypt certbot and obtain...

CVE-2018-11759

CVE-2018-11759 Proof of concept Description The Apache Web Server httpd specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported b...

CVE-2026-20896

CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC !WARNING Use this PoC only in a local lab or against a system you are explicitly authorized to test. https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b Overview CVE-2026-20896 is an authentication bypass in...

nginx-CVE-2017-7529

Nginx out-of-bounds read cache vulnerability CVE-2017-7529 Vulnerability Principle References: https://cert.360.cn/detailnews.html?id=b879782fbad4a7f773b6c18490d67ac7 http://galaxylab.org/cve-2017-7529-nginx%E6%95%B4%E6%95%B0%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/ When Nginx acts ...

frp

frp README | 中文文档 Patrocinadores frp es un proyecto de código abierto cuyo desarrollo continuo es posible gracias al apoyo de nuestros increíbles patrocinadores. Si deseas unirte a ellos, considera patrocinar el desarrollo de frp. Patrocinadores Oro El IDE completo diseñado para desarrolladores...

reproxy

Reproxy es un servidor/proxy inverso simple de borde HTTPs que admite varios proveedores docker, estático, archivo, catálogo consul. Uno o más proveedores suministran información sobre el servidor solicitado, la URL solicitada, la URL de destino y la URL de verificación de salud. Se distribuye co...

filtron

Filtron Proxy HTTP inverso para filtrar solicitudes según diferentes reglas. Se puede usar entre el servidor web de producción y el servidor de aplicaciones para evitar abusos del backend de la aplicación. El propósito original de este programa era defender searx, pero puede usarse para proteger...

CVE-2026-73276

A flaw was found in the Erlang/OTP inets httpd server. This vulnerability allows a remote attacker to perform HTTP Request Smuggling due to the server silently dropping HTTP headers that contain whitespace between the header field-name and the colon. When deployed behind a reverse proxy that...

CVE-2026-1010-WebSocket-Connection-Smuggling-via-Malformed-Upgrade-Header

CVE-2026-1010 – WebSocket Connection Smuggling Overview A reverse proxy and backend disagree on how to parse an HTTP request with a malformed WebSocket upgrade header. The proxy treats it as one request, while the backend interprets it as two, allowing an attacker to smuggle a hidden request. Thi...

oauth2-proxy

OAuth2 Proxy es una herramienta flexible de código abierto que puede actuar como un proxy inverso independiente o como un componente de middleware integrado en configuraciones existentes de proxy inverso o balanceadores de carga. Proporciona una forma simple y segura de proteger tus aplicaciones...

CVE-2026-20896

CVE-2026-20896 Gitea's official Docker image up to and including 1.26.2 ships REVERSEPROXYTRUSTEDPROXIES = in its default config. If you turn on reverse-proxy login, that wildcard means every source IP is treated as a trusted proxy, so anyone who can reach the port can send an X-WEBAUTH-USER head...

cve-2026-20896-gitea-poc

CVE-2026-20896 Gitea Docker Auth Bypass Checker Authorized red team / pentest operations only. This repository contains a minimal checker for CVE-2026-20896, an authentication bypass in official Gitea Docker images up to and including 1.26.2 when reverse-proxy authentication is enabled. What...

CVE-2023-20887

CVE-2023-20887 POC for CVE-2023-20887 VMWare Aria Operations for Networks vRealize Network Insight unauthenticated RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://kushagraojha.medium.com/vmware-vrealize-network-insight-cve-2023-20887-193f3c3d30a0...

CVE-2026-84186

Vulnerability involving incorrect access control in the Tools::getRemoteAddr function in PrestaShop, which allows the client’s IP address to be spoofed via the X-Forwarded-For header when the application is running behind a reverse proxy, load balancer or CDN. The application incorrectly processe...

CVE-2026-84186

This vulnerability affects PrestaShop and resides in the Tools::getRemoteAddr() function. When the application runs behind a reverse proxy, load balancer, or CDN, it incorrectly trusts the client-supplied X-Forwarded-For header instead of the IP provided by the trusted infrastructure, allowing an...

Apache Tomcat JK Connect <=1.2.44 - Manager Access

Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is so...

CVE-2026-20896-Gitea-Authentication-Bypass

CVE-2026-20896 - Gitea ≤1.26.2 Authentication Bypass 1. What is Gitea? Gitea is a lightweight, open-source Git hosting platform that allows organizations and developers to manage source code repositories, track issues, review changes, and collaborate on software projects. It provides functionalit...