xsscrapy

xsscrapy Fast, thorough, XSS/SQLi spider. Give it a URL and it'll test every link it finds for cross-site scripting and some SQL injection vulnerabilities. See FAQ for more details about SQLi detection. From within the main folder run: root@kitploit: ./xsscrapy.py -u http://example.com If you wis...

Scrapling

Effortless Web Scraping for the Modern Web العربيه | Español | Português Brasil | Français | Deutsch | 简体中文 | 日本語 | Русский | 한국어 Selection methods · Fetchers · Spiders · Proxy Rotation · CLI · MCP Scrapling is an adaptive Web Scraping framework that handles everything from a single request to a...

killshot

This project is no longer maintained ! KILLSHOT A Penetration Testing Framework, Information gathering tool & Website Vulnerability Scanner Why KillShot? You can use this tool to spider your website, gather important information, and automate data collection using tools such as WhatWeb, Host,...

netpwn

netpwn A framework made to automate tasks of pentesting. Written in python 2.7 Modules reverseshell - Creates a reverse shell with python to connect to a specific machine of your choice. sendfile - Allows you to send a file to target server. phpbackdoor - Generates a simple backdoor in php upload...

RWST

RWST Red Widow Spider Tools Termux Apps AD...

mzap

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...

subbrute

subdomain-bruteforcer SubBrute SubBrute is a community driven project with the goal of creating the fastest, and most accurate subdomain enumeration tool. Some of the magic behind SubBrute is that it uses open resolvers as a kind of proxy to circumvent DNS rate-limiting...

CloudScraper

CloudScraper is a Tool to spider and scrape targets in search of cloud resources. Plug in a URL and it will spider and search the source of spidered pages for strings such as 's3.amazonaws.com', 'windows.net' and 'digitaloceanspaces'. AWS, Azure, Digital Ocean resources are currently supported...

BlackWidow

ABOUT: BlackWidow is a python based web application spider to gather subdomains, URL's, dynamic parameters, email addresses and phone numbers from a target website. This project also includes Inject-X fuzzer to scan dynamic URL's for common OWASP vulnerabilities. DEMO VIDEO: BlackWidow Demo...

urlgrab

Welcome to urlgrab 👋 A golang utility to spider through a website searching for additional links with support for JavaScript rendering. Install root@kitploit: go get -u github.com/iamstoxe/urlgrab Features Customizable Parallelism Ability to Render JavaScript including Single Page Applications su...

scout

Scout Scout is a URL fuzzer and spider for discovering undisclosed VHOSTS, files and directories on a web server. A full word list is included in the binary, meaning maximum portability and minimal configuration. Aim and fire! Usage root@kitploit: Usage: scout command Available Commands: help Hel...

spider

Spider Rust向け最速のWebクローラー兼スクレイパー。 spider.cloud · ガイド · ドキュメント · 例 · Discord Spiderは、Rustで構築された並行性優先のクローリングエンジンです。ページが到着した瞬間にストリーミングし、ページが必要とする場合にのみJavaScriptをレンダリングし、コードを変更せずに単一のスクリプトから分散型フリートまでスケールします。同じエンジンがSpider Cloudを支えているため、ローカルでプロトタイプを作成し、1つの設定変更で管理されたインフラに移行できます。 クラウドで始める...

CVE-2024-0195-SpiderFlow

CVE-2024-0195 コード生成の制御の不適切（'コードインジェクション'） 概要 CVE-2024-0195 は、spider-flow 0.4.3 Web アプリケーションの FunctionController.java ファイル内の FunctionService.saveFunction 関数に存在する、重大なコードインジェクションの脆弱性です。攻撃者はリモートから悪意のあるコードを注入でき、そのコードがサーバー上で実行されます。これにより、アプリケーションの完全な侵害が可能になります。 影響 この脆弱性は、影響を受ける spider-flow...

Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting

Lantronix SecureLinx Spider SLS 2.2+ devices have XSS in the auth.asp login page. id: CVE-2018-10383 info: name: Lantronix SecureLinx Spider SLS 2.2+ - Cross-Site Scripting author: ritikchaddha severity: medium description: | Lantronix SecureLinx Spider SLS 2.2+ devices have XSS in the auth.asp...

WordPress Spider Calendar <=1.4.9 - SQL Injection

WordPress Spider Calendar plugin through 1.4.9 is susceptible to SQL injection. An attacker can execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php, thus making it possible to obtain sensitive information, modify data, and/or execut...

EasySpider 0.6.2 - Arbitrary File Read

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...

WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting

WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can injec...

sap-netweaver-0day-CVE-2025-31324

Scattered Lapsus$ Huntersとして知られるスーパーグループ — ShinyHunters、Scattered Spider、Lapsus$ のグループの組み合わせが、この0dayのPOCをリークしました。 この0dayはShinyHuntersによって作成され、実際に悪用中の中国の国家主体から盗まれたものです。 リーク先：https://t.me/leavemealonefbi/185...

CVE-2024-0195-SpiderFlow

CVE-2024-0195 코드 생성 제어 불량 '코드 인젝션' 치명적 2024 요약 CVE-2024-0195는 spider-flow 0.4.3 웹 애플리케이션의 FunctionController.java 파일 내 FunctionService.saveFunction 함수에서 발생하는 치명적인 코드 인젝션 취약점입니다. 공격자는 원격으로 악성 코드를 주입하여 서버에서 실행시킬 수 있습니다. 이로 인해 애플리케이션이 완전히 손상될 수 있습니다. 영향.. 이 취약점은 취약한 spider-flow 애플리케이션이 호스팅된 서버에서 원격 ...

Inventus

Inventus Inventus는 특정 도메인과 발견된 모든 하위 도메인을 크롤링하여 하위 도메인을 찾도록 설계된 스파이더입니다. Scrapy 스파이더이므로 필요에 따라 쉽게 수정하고 확장할 수 있습니다. 데모 asciicast 요구 사항 Linux -- Windows에서는 테스트하지 않았습니다. Python 2.7 또는 Python 3.3+ Scrapy 1.4.0 이상 설치 Inventus를 실행하려면 먼저 Scrapy가 설치되어 있어야 합니다. 먼저 저장소를 클론하고 해당 디렉토리로 이동합니다. root@kitploit: ...