fses

fses Fucking Search Engines Scraper - python library to scrap url's from search engines Search Engines we scrap root@kitploit: Ask Bing DuckDuck GO UOL Yahoo Install root@kitploit: git clone https://github.com/mthbernardes/fses.git cd fses pip install -r requeriments.txt Usage Simple search using...

ChatGPT个人专用版 - Server Side Request Forgery

A Server-Side Request Forgery SSRF in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter. id: CVE-2024-27564 info: name: ChatGPT个人专用版 - Server Side Request Forgery author: DhiyaneshDK...

paskto

Paskto - Passive Web Scanner Paskto will passively scan the web using the Common Crawl internet index either by downloading the indexes on request or parsing data from your local system. URLs are then processed through Nikto and known URL lists to identify interesting content. Hash signatures are...

pwndrop

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...

domhttpx

domhttpx is a google search engine dorker with HTTP toolkit built with python, can make it easier for you to find many URLs/IPs at once with fast time. List Install Usage Flags Basic Usage One Keyword Multiple Keyword Extract Title Page Extract Title Page from Real Path Extract Status Code Extrac...

gospider

GoSpider GoSpider - Fast web spider written in Go Painless integrate Gospider into your recon workflow? this project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine Installation GO install root@kitploit: GO111MODULE=on go install...

subcrawl

SubCrawl SubCrawl is a framework developed by Patrick Schläpfer, Josh Stroschein and Alex Holland of HP Inc’s Threat Research team. SubCrawl is designed to find, scan and analyze open directories. The framework is modular, consisting of four components: input modules, processing modules, output...

nginx_log_check

nginxlogcheck Nginx log security analysis script Features Top 20 address statistics SQL injection analysis Scanner alert analysis Vulnerability exploitation detection Sensitive path access File inclusion attack Webshell Find Top 20 URLs by response length Find rare script file access Find 302...

spyse.py

spyse.py Python API wrapper and command-line client for the tools hosted on spyse.com. "Spyse is a developer of complete DAAS Data-As-A-Service solutions for Internet security professionals, corporate and remote system administrators, SSL / TLS encryption certificate providers, data centers and...

urlhunter

root@kitploit: o Utku Sen's /\o Oo |/ =- .===O- URL -O- / /U' hunter /|\ || |/ \ | utkusen.com |K || twitter.com/utkusenen urlhunter è uno strumento di ricognizione che permette di cercare su URL esposti tramite servizi di accorciamento come bit.ly e goo.gl. Il progetto è scritto in Go. Come?...

CSRF-breach

Progetto violazione di sicurezza - Cross Site Request Forgery Dolibarr 7.0.0 è affetto da: Cross Site Request Forgery CSRF. L'impatto è: permettere a HTML malintenzionato di cambiare la password dell'utente, disabilitare utenti e disabilitare la crittografia delle password. Il componente è:...

Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

Hitachi Pentaho Business Analytics Server - Bypass Authorization

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented. id: CVE-2022-43939 info: name: Hitachi Pentaho Business Analytics Server - Bypass Authorization author: daffainf...

CVE-2023-0099-exploit

CVE-2023-0099-exploit Titolo Exploit: simple urls 115 - Reflected XSS Google Dork: Autore Exploit: AmirZargham Homepage del fornitore: https://getlasso.co/ Link del software: https://wordpress.org/plugins/simple-urls/ Versione: 115...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

CVE-2018-7600-Masschecker

CVE-2018-7600-Masschecker Strumento per verificare la vulnerabilità CVE-2018-7600 su diversi URL...

CVE-2026-53580

Trilium is an open-source hierarchical note-taking application affected in versions prior to 0.104.0 . The automatic image-download feature accepts file:// URLs in tags within text notes and performs a filesystem read with no path validation . Because the HTML sanitizer allows the file scheme, a...

CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...