Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

themida-unmutate

themida-unmutate A Python 3 tool to statically deobfuscate functions protected by Themida, WinLicense and Code Virtualizer 3.x's mutation-based obfuscation. The tool has been tested on Themida up to version 3.1.9. It's expected to work on WinLicense and Code Virtualizer as well. A Binary Ninja...

sast-scan

Introduction ███████╗ ██████╗ █████╗ ███╗ ██╗ ██╔════╝██╔════╝██╔══██╗████╗ ██║ ███████╗██║ ███████║██╔██╗ ██║ ╚════██║██║ ██╔══██║██║╚██╗██║ ███████║╚██████╗██║ ██║██║ ╚████║ ╚══════╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═══╝ Scan is a free open-source security tool for modern DevOps teams. With an integrated...

ExecuteAssembly

Description: ExecuteAssembly is an alternative of CS execute-assembly, built with C/C++ and it can be used to Load/Inject .NET assemblies by; reusing the host spawnto process loaded CLR Modules/AppDomainManager, Stomping Loader/.NET assembly PE DOS headers, Unlinking .NET related modules, bypassi...

CVE-2019-6693

CVE-2019-6693 Decrypt FortiGate configuration secrets Original advisory Vendor advisory For Fortigate VM/appliances below versions 6.2.0, 6.0.0 to 6.0.6, 5.6.10 configuration secrets are stored encrypted with a unique key. For versions above the non-default private-data-encryption parameter lets...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

slither-mcp

Slither MCP Server A Model Context Protocol MCP server that provides static analysis capabilities for Solidity smart contracts using Slither. Overview This MCP server wraps Slither static analysis functionality, making it accessible through the Model Context Protocol. It can analyze Solidity...

intercept

!zreadhttps://img.shields.io/badge/AskZread-.svg?style=plastic&color=00b0aa&labelColor=000000&logo=data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTQuOTYxNTYgMS42MDAxSDIuMjQxNTZD...

Dna

Dna Dna is a static binary analysis framework built on top of LLVM. Notably it's written almost entirely in C, including managed bindings for LLVM, Remill, and Souper. Functionality Dna implements an iterative control flow graph reconstruction inspired heavily by the SATURN paper. It iteratively...

huskyCI

This article can also be read inBrazilian Portuguese. Introduction huskyCI is an open source tool that orchestrates security tests and centralizes all results into a database for further analysis and metrics. It can perform static security analysis in Python BanditBandit and SafetySafety, Ruby...

Rawsec-website

RawSec Static website hosted on GitLab Pages Topics & Tags : Security Cybersecurity, Linux, News, System, Virtualization, ... Dev Install the required version of nodejs with nodenv. Then install the hexo cli tool: $ npm install -g hexo-cli Then install dependencies: $ npm i Then build and serve: ...

CVE-2020-0688-Scanner

CVE-2020-0688-Scanner Quick C tool for checking CVE-2020-0688 on multiple hosts with a non-intrusive method. Features Scan hosts from an input file. Passive check : grab exchange version by scraping html content. Produces an output file. Demo How to use Prerequisite Windows .NET framework 4.5.2...

android-check

Android Check Static code analysis plugin for Android project. Usage Modifications in /build.gradle: buildscript repositories jcenter dependencies ... classpath 'com.noveogroup.android:check:1.2.5' ... Modifications in //build.gradle: apply plugin: 'com.noveogroup.android.check' Configuration...

apkvuln

ApkVuln \ / \ / \ / \ / \ /\ \ \ \ /|\ \ \ | | | \ | |/ /\ \ / / | | | | | | | / \ | / ' \ V /| || | || . | // \|| |\ / /|||| With ApkVuln you will obtain the .java files of an APK and they will be analyzed in search of possible vulnerabilities in the code, for it will make use of regular...

shredder-rs

Shredder-RS A polymorphic mutation engine for x8664 binaries. Overview Shredder-RS implements instruction-level shredding to defeat static analysis. By breaking the linear flow of the code and injecting randomized junk nodes, it forces disassemblers to follow a complex graph of JMP-linked...

CVE-2023-34039

CVE-2023-34039 POC for CVE-2023-34039 VMWare Aria Operations for Networks vRealize Network Insight Static SSH key RCE Technical Analysis A root cause analysis of the vulnerability can be found on my blog: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/ Summary VMWa...

np-audit

np-audit — npm package auditor Static security analysis for npm packages — detects obfuscated lifecycle scripts, known vulnerabilities, and malicious patterns before they run. Drop-in replacement for npm install and npm ci. Zero dependencies. Pure Node.js built-ins only. 100 kB on the wire. npx...

dasel-melange-apko

dasel v3.3.1 — Melange + apko build, patched for CVE-2026-33320 This repo packages the dasel CLI v3.3.1 as an APK with Melange , builds a minimal container image with apko , and applies a fix for CVE-2026-33320 while staying on the v3.3.1 codebase a patch, not a version bump. The result is a 4 MB...

PulseAPK

PulseAPK 🌍 Languages English | Deutsch | Español | Français | עברית | 한국어 | Беларуская | Suomi | Latviešu | Eesti | Lietuvių | Čeština | Slovenčina | Magyar | العربية | Português | Русский | Українська | 中文 💡 Looking for a cross-platform alternative? Download PulseAPK Core here:...

CVE-2020-0688

Identify Exchange Servers vulnerable to CVE-2020-0688 CVE-2020-0688 is a critical vulnerability in Microsoft Exchange due to use of static keys. Although exploitation requires valid credentials at an email user level and the risk of mass-exploitation is low, this vulnerability might be very usefu...