heap-viewer

HeapViewer An IDA Pro plugin to examine the heap, focused on exploit development. Currently supports the glibc malloc implementation ptmalloc2. 3rd place winner of the 2018 Hex-Rays Plugin Contest Requirements IDA Pro = 7.0 Tested on glibc 2.23 = 2.26 GraphView for linked lists bins/tcache Struct...

aquatone

AQUATONE Aquatone एक उपकरण है जो बड़ी संख्या में होस्टों पर वेबसाइटों के दृश्य निरीक्षण के लिए है और HTTP-आधारित आक्रमण सतह का त्वरित अवलोकन प्राप्त करने के लिए सुविधाजनक है। इंस्टॉलेशन 1. Google Chrome या Chromium ब्राउज़र स्थापित करें -- नोट: Google Chrome वर्तमान में हेडलेस मोड में चलने पर...

lscript

The lazy script has not been updated for a while due to me being very busy with my life. I will try my best to upload an update when I find the time Welcome to the LAZY script v2.1.4 A video Hackersploit made : https://www.youtube.com/watch?v=oBpo5sElrMY A video sstec made:...

celerystalk

celerystalk celerystalk helps you automate your network scanning/enumeration process with asynchronous jobs aka tasks while retaining full control of which tools you want to run. Interactive Demo: Bug Bounty Mode HackerOne Interactive Demo: Vulnerability Assessment / PenTest Mode Retired...

reternal-quickstart

RE:TERNAL Note: Still under development, only use for testing and do not expose interfaces! Current compose doesn't work yet, only try when you know what you're doing RE:TERNAL is a centralised purple team orchestration service to manage third-party C2 frameworks. Agents are installed on endpoint...

eyeballer

Eyeballer Give those screenshots of yours a quick eyeballing. Eyeballer is meant for large-scope network penetration tests where you need to find "interesting" targets from a huge set of web-based hosts. Go ahead and use your favorite screenshotting tool like normal EyeWitness or GoWitness and th...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...

crackerjack

!CAUTION This repo is unmaintained, visit https://github.com/sadreck/crackerjack for the latest version. CrackerJack Web Interface for Hashcat by Context Information Security Contents Introduction Architecture Features Limitations Installation Troubleshooting Screenshots License Introduction...

Astra Linux – Vulnerability in Flatpak

Flatpak is a Linux application sandboxing and distribution framework. A path traversal vulnerability affects versions of Flatpak prior to 1.12.3 and 1.10.6. The flatpak-builder command applies the finish-args option last in the build process. At this point, the build directory will have full acce...

Malicious code in saaa9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3011e5a125f4db4febea1bf6778ed69ebb11009d2a1b119a46118822f3ef6e93 The package is published as a 'System binary configuration tool' but the shipped code is a covert Windows surveillance overlay. On execution, index.j...

MAL-2026-10925 Malicious code in tilaver-mfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8713506d95648bc2ee9d15418c356259ca9f1d10fb305fd546e3d38c911aea0e index.js is a heavily obfuscated custom VM-bytecode dispatcher with 0x-style identifiers Windows infostealer that executes on module load. It...

MAL-2026-6404 Malicious code in syco1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43be65a0930b121cf4d610c70b2d07165e4d335dece4344590b471d078fa5b5 Package self-describes as a 'System binary configuration tool' but ships a covert screen and clipboard surveillance overlay. pointer.py captures...

MAL-2026-6279 Malicious code in forge-jsx4 (npm)

forge-jsx4 is a remote access trojan RAT published to the public npm registry by the account rafaelsilva [email protected]. Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control...

CVE-2025-32437 AutoGPT has a DoS vulnerability in MediaDurationBlock

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, MediaDurationBlock will download and store the video in a temporary directory without deleting before all noded are done. StepThroughItemsBlock can be used t...

CVE-2025-10560

Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access information. The originally exposed AWS credentials...

CVE-2025-10560

Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access information. The originally exposed AWS credentials...

CVE-2025-10560 Hardcoded cloud credentials in Worksnaps client application binaries expose production cloud resources

Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The exposed credentials included AWS access keys, S3 bucket names, and related cloud access information. The originally exposed AWS credentials...

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Multiple security vulnerabilities in the Crawl4AI Docker API server affecting endpoints for crawling, markdown/LLM extraction, screenshots, PDFs, webhooks, monitoring, JavaScript execution, and configuration...

Malicious code in coderzero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bd26d5ae306572deded5926f2a32dd34de72377da3363cafc4c4026b9c5a93d When a user runs the coderzero CLI, the bundled Python client client/noderzero.py starts a clipboard monitor that polls pyperclip.paste every 300ms a...

MAL-2026-5568 Malicious code in forge-jsx2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce40276c3c58337b7db3272f89e0716b017b4d63bfa625b8757b9d1969ec9f9 The package masquerades as an 'Autodesk Forge' integration but ships no Forge API code. On npm install, scripts/postinstall-agent.mjs materializes a...