rack-bug

Rack::Bug Code Climate Repository: http://github.com/brynary/rack-bug Description Rack::Bug adds a diagnostics toolbar to Rack apps. When enabled, it injects a floating div allowing exploration of logging, database queries, template rendering times, etc. Features Password-based security IP-based...

chart-down

chart-down Download and scan Helm charts for secrets using TruffleHog. Given a Helm repository URL, chart-down fetches the repo index, downloads every chart archive, extracts it, and runs TruffleHog against the contents. Requirements Go 1.19+ TruffleHog on PATH brew install trufflehog Install go...

JS-Secret-Hunter

JS Secret Hunter V2 🕵️‍♂️ JS Secret Hunter is an advanced Python tool designed for security researchers to automate the detection of hardcoded secrets in client-side JavaScript. Unlike simple scanners, V2 includes a dynamic crawler that parses the HTML of the target website to extract all loaded...

infisical

The open-source secret management platform : Sync secrets/configs across your team/infrastructure and prevent secret leaks. Community | Infisical Cloud | Self-Hosting | Docs | Website | X | Hiring Remote/SF Introduction Infisical is the open source security infrastructure platform that teams use...

CVE-2026-107604

A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which should normally be restricted. This...

CVE-2017-1000486

CVE-2017-1000486 This is a PoC of CVE-2017-1000486 with some payloads useful to bypass blacklisting lexicographic checks on standard functions used to achieve RCE getClass, exec, etc.. and for retrieving primefaces secret through Padding Oracle in order to be less noisy possible on exploitation...

CVE-2019-5420

CVE-2019-5420 PoC A remote code execution vulnerability in development mode Rails 5.2.2.1, 6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code...

DumpTheGit

DumpTheGit DumpTheGit busca en repositorios públicos para encontrar información sensible subida a los repositorios de Github. La herramienta marcará las coincidencias de archivos potencialmente sensibles como credenciales, claves secretas, tokens, etc., que hayan sido subidos accidentalmente por...

secretflow

简体中文｜English SecretFlow is a unified framework for privacy-preserving data intelligence and machine learning. To achieve this goal, it provides: An abstract device layer consists of plain devices and secret devices which encapsulate various cryptographic protocols. A device flow layer modeling...

git-all-secrets

git-all-secrets About git-all-secrets is a tool that can: Clone multiple public/private github repositories of an organization and scan them, Clone multiple public/private github repositories of a user that belongs to an organization and scan them, Clone a single public/private repository of an...

KeePwn

Un script en Python para ayudar a los equipos rojos a descubrir instancias de KeePass y extraer secretos. Características Descubrimiento de KeePass Buscar archivos de instalación de KeePass a través del recurso compartido SMB C$. Aceptar múltiples fuentes de objetivo IP, CIDR, hostname, archivo...

CVE-2026-107604

A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which should normally be restricted. This...

CVE-2026-93017

The insights-operator contains a security misconfiguration where the insights-operator-gather ClusterRole grants the gather service account excessive permissions. Specifically, it allows read access (get, list) to secrets in the core API group without any namespace or resource names restrictions....

HTTPLoot

HTTPLoot Una herramienta automatizada que puede rastrear, rellenar formularios, activar páginas de error/depuración y «saquear» secretos del código orientado al cliente de los sitios web. Uso Para usar la herramienta, puedes obtener cualquiera de los binarios precompilados desde la sección Releas...

dora

dora Características Extremadamente rápido ya que utilizamos ripgrep en el backend Pasos de explotación/PoC para muchas de las claves API, lo que permite redactar un buen informe para la caza de recompensas por errores A diferencia de muchos otros buscadores de claves API, dora también muestra la...

git-secrets-scan

Bitbucket Security: Secret Scanner Scans your files for hardcoded secrets, keys, and passwords. Creates a security Code Insights report if found. This Bitbucket Cloud supported Pipe leverages the gitleaks secret pattern registry to provide industry-leading Security Secrets Scanning capabilities t...

keyhog

Website · Documentation · Architecture · Vyre GPU engine KeyHog: GPU-accelerated secret scanner for code, cloud, and CI KeyHog is an open-source secret scanner in Rust that finds and verifies leaked API keys, tokens, passwords, and credentials across source code, Git history, containers, cloud...

gitleaks

Gitleaks ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ !WARNING Gitleaks está completo en cuanto a funcionalidades. No estoy incorporando nuevas funciones en Gitleaks. Las versiones futuras serán solo parches de seguridad. Estoy centrando mi atención en Betterleaks license:...

cq

cq Code Query, a universal code security scanning tool. CQ scans code for security vulnerabilities and other items of interest to security-focussed code reviewers. It outputs text files containing references to issues found, into an output directory. These output files can then be reviewed,...

CVE-2025-32965-xrpl-js-poc

CVE-2025-32965 — xrpl.js Supply Chain Attack PoC Report Vulnerability Description CVE Code: CVE-2025-32965 Vulnerability Type: Supply Chain Attack CWE-506: Embedded Malicious Code Target: xrpl.js library versions 4.2.1–4.2.4 and 2.14.2 Impact: User's wallet seed/secret data sent to the attacker...