BFScan

BFScan Herramienta para el procesamiento inicial de aplicaciones APK / XAPK / APKM / DEX / JAR / WAR. Busca cadenas en el código fuente y los recursos que parezcan URI, rutas o secretos Genera solicitudes HTTP sin procesar y especificaciones OpenAPI basadas en archivos de configuración, anotacion...

barq

barq barq：AWS 云后渗透框架！ 这是什么？ barq 是一个后渗透框架，允许您轻松地对正在运行的 AWS 基础设施执行攻击。它允许您攻击正在运行的 EC2 实例，而无需拥有原始实例的 SSH 密钥对。它还允许您枚举和提取 AWS 中存储的 Secrets 和 Parameters。 先决条件 一个现有的 AWS 账户访问密钥 ID 和密钥（某些情况下还需要 Token） Python 2 或 3。两者均可运行。 要运行 msfvenom payload，您需要在工作站上安装 msfvenom，并正确设置 PATH。 安装 对于 Python 2： root@kitploit:...

nord-stream

Nord Stream Nord Stream es una herramienta que permite extraer secretos almacenados en entornos CI/CD mediante el despliegue de pipelines maliciosos. Actualmente es compatible con Azure DevOps, GitHub y GitLab. Puedes encontrar más información en el siguiente artículo de blog:...

jsluicepp

📄 Tabla de contenidos 👋 Introducción 🛠️ Configuración 📝 Uso 📜 Características Monitorizar URLs Enviar a Repeater Secretos Notificaciones de secretos Copiar URL Coincidencia positiva/negativa Solo en el alcance Etiquetas en línea Ocultar duplicados Mostrar parametrizados Importar/Exportar Guardar...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra...

adiskreader-secretsdump

🚩 Patrocinadores Si te gusta este proyecto, considera comprar licencias de OctoPwn, nuestra suite completa de pentesting que se ejecuta en tu navegador! Para notificaciones sobre nuevas compilaciones/lanzamientos y otra información, únete a nuestro Discord adiskreader-secretsdump Extrae secretos ...

CVE-2025-36753 SWD Interface Open on Growatt ShineLan-X

The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device...

EUVD-2022-2736

Malicious code in bioql PyPI...

PT-2025-30401

The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access an...

CVE-2021-29620

Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity XXE attacks. This allows a user to import a specifically-crafted XML...

CVE-2018-1000010

Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

GHSA-MGFG-7533-7JF6 ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL

Impact This is not a vulnerability in the code per se, but included Varnish VCL templates enable compression of API and JSON messages. This is a potential case of the BREACH vulnerability, which affects HTTP compression, where secrets can be extracted through carefully crafted requests. The fix...

Code Injection

Woodpecker is vulnerable to Code Injection. The vulnerability is due to insufficient user validation, allowing any user to trigger malicious workflows that can either take over the host running the agent or extract secrets by overwriting plugin entry points...

Code Injection

Woodpecker is vulnerable to Code Injection. The vulnerability is due to insufficient user validation, allowing any user to trigger malicious workflows that can either take over the host running the agent or extract secrets by overwriting plugin entry points...

CVE-2024-41121

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...

GHSA-XW35-RRCP-G7XM Woodpecker's custom workspace allow to overwrite plugin entrypoint executable

Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are...

Woodpecker's custom environment variables allow to alter execution flow of plugins

Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are...

GHSA-3WF2-2PQ4-4RVC Woodpecker's custom environment variables allow to alter execution flow of plugins

Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are...

CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...

CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...