cygor

Cygor General Overview Cygor is a modular asset discovery framework that brings scanning, parsing, and service enumeration together in one workflow. It replaces the patchwork of separate tools with an automated process that handles discovery, enrichment, and targeted enumeration seamlessly —...

autoenum

/ / / // / / // // \ / \ / \ / / / // \ / // // // // / / // // // / / // // // / / / / / ,/ ,/ / / /// // ,/// // // Summary Autoenum is a recon tool which performs automatic enumeration of services discovered. I built this to save some time during CTFs and pen testing environments i.e. HTB,...

pentest-machine

pentest-machine Automates some pentesting work via an nmap XML file. As soon as each command finishes it writes its output to the terminal and the files in output-by-service/ and output-by-host/. Runs fast-returning commands first. Please send me protocols/commands/options that you would like to...

chomtesh

CHOMTE.SH Be sure to :star: this repo so you can keep up to date on any daily progress! CHOMTE.SH is a versatile framework designed for automating reconnaissance tasks in penetration testing. It's useful for bug bounty hunters and penetration testers in both internal and external network...

BaRMIe

BaRMIe BaRMIe is a tool for enumerating and attacking Java RMI Remote Method Invocation services. RMI services often expose dangerous functionality without adequate security controls, however RMI services tend to pass under the radar during security assessments due to the lack of effective testin...

neet

NEET - Network Enumeration and Exploitation Tool Neet is a flexible, multi-threaded tool for network penetration testing. It runs on Linux and co-ordinates the use of numerous other open-source network tools, with the aim of gathering as much network information as possible in clear, easy-to-use...

intelspy

Effectuez des scans automatisés de reconnaissance réseau pour collecter des renseignements sur le réseau. IntelSpy est un outil de renseignement réseau multi-threadé qui réalise une énumération automatisée des services réseau. Il effectue des scans de détection d'hôtes actifs, des scans de ports,...

intelspy

Perform automated network reconnaissance scans to gather network intelligence. IntelSpy is a multi-threaded network intelligence tool which performs automated network services enumeration. It performs live hosts detection scans, port scans, services enumeration scans, web content scans,...

Reconnoitre

A reconnaissance tool made for the OSCP labs to automate information gathering and service enumeration whilst creating a directory structure to store results, findings and exploits used for each host, recommended commands to execute and directory structures for storing loot and flags. Contributio...

msploitego

msploitego - La suite de pentesting pour Maltego CE CI EST UNE VERSION BÊTA, veuillez être indulgent et signaler tout problème Nouveautés Nouvelles fonctionnalités Prise en charge de plusieurs espaces de travail pour Metasploit via des requêtes Postgres Un script bash qui exécute des tonnes de...

bscan

:mag: an asynchronous target enumeration tool :magright: Synopsis bscan is a command-line utility to perform active information gathering and service enumeration. At its core, bscan asynchronously spawns processes of well-known scanning utilities, repurposing scan results into highlighted console...

aws-enumerator

AWS Service Enumeration Disclaimer The tool is in beta stage testing in progress, no destructive API Calls used read only actions . I hope, there will be no issues with the tool. If any issues encountered, please submit the ticket. Description The AWS Enumerator was created for service enumeratio...

WSO2 - Server Side Request Forgery

WSO2 products contain SSRF and reflected XSS vulnerabilities in the deprecated Try-It feature accessible only to administrative users, caused by improper URL validation and direct content reflection, letting attackers trick admins into executing arbitrary JavaScript and querying internal services...

goscan

GoScan is an interactive network scanner client, featuring auto-completion, which provides abstraction and automation over nmap. Although it started as a small side-project I developed in order to learn @golang, GoScan can now be used to perform host discovery, port scanning, and service...

goscan

GoScan est un client interactif de scan réseau avec auto-complétion, qui offre une abstraction et une automatisation autour de nmap. Bien qu'il ait commencé comme un petit projet personnel développé pour apprendre @golang, GoScan peut désormais être utilisé pour effectuer la découverte d'hôtes, l...

cantina

АРХИВИРОВАНО. Этот проект перенесён вcustom-oscp-tooling. Весь код Cantina теперь живёт там, вместе с набором инструментов Star Wars enum/advisor. Этот репозиторий оставлен только для чтения, для истории. Новое расположение: https://gitlab.com/WattoCyber/custom-oscp-tooling Запуск: python...

RDL-detect

Проверка службы Remote Desktop Licensing См. https://github.com/fortra/impacket/blob/master/examples/rpcdump.py Перечислите открытые службы через MSRPC и определите, содержит ли служба лицензирования терминального сервера Terminal Server Licensing по UUID: 3d267954-eeb7-11d1-b94e-00c04fa3080d...

MultiExploit

Многосервисный сканер уязвимостей Поддерживаемые уязвимости и векторы атак Уязвимости Microsoft SQL Server CVE-2023-21173 : Удаленное выполнение кода в SQL Server 2022 Возможная эксплуатация: Слабые конфигурации аутентификации Неправильно настроенные серверные субъекты Злоупотребление xpcmdshell...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

Nuxt OG Image has unauthenticated SSRF via `fonts[].path` URL parameter

Summary nuxt-og-image exposes an unauthenticated HTTP endpoint at /og/d/ that base64url-decodes and JSON.parses a fonts URL segment, then passes each fontsi.path value directly into fetch server-side without any URL validation no scheme allowlist, no loopback/RFC1918 block, no host allowlist, no...