undetected-httpx

undetected-httpx undetected-httpx is a multi-purpose HTTP probing toolkit inspired by httpx. It is specifically engineered to bypass modern anti-bot infrastructures by mimicking real-world browser signatures. Traditional HTTP clients are easily fingerprinted and blocked by WAFs. This tool leverag...

CVE-2024-3640_WafBypass

CVE-2024-3640 Exploitation du plugin WafBypass woodpacker La méthode de contournement consiste en réalité à insérer des commentaires XML pour contourner les mots-clés. Détection différée Exécution de commande avec retour Cheval de mémoire personnalisé...

xss_vulnerability_challenges

Scénarios de vulnérabilité XSS défis Ce dépôt est une application PHP dockerisée contenant plusieurs défis de vulnérabilité XSS. Les concepts abordés dans ces défis sont : Contournement de validation JavaScript Contournement des entités HTML Contournement de WAF Contournement de liste noire...

pFuzz

What is pFuzz / pFuzz Nedir ❓ pFuzz is an advanced red teaming fuzzing tool which we developed for our research. It helps us to bypass web application firewall by using different methods at the same time. pFuzz web uygulama araştırmaları için geliştirdiğimiz, gelişmiş bir fuzzing aracıdır. Farklı...

XIP

XIP Description XIP generates a list of IP addresses by applying a set of transformations used to bypass security measures e.g. blacklist filtering, WAF, etc. asciicast Further explaination on our blog post article Usage root@kitploit: python3 xip.py --help Docker alternative Official image You c...

log4j-scanner

log4j-scanner Сканер уязвимостей Log4j — это автоматизированный сканер для поиска уязвимостей log4j CVE-2021-44228 и CVE-2021-45046 в веб-приложениях. Возможности 1- Поддерживает сканирование нескольких URL 2- Содержит полезные нагрузки payload, которые могут обходить некоторые WAF 3- Поддерживае...

Log-4j-scanner

log4j-scan 취약한 log4j 호스트를 찾기 위한 완전 자동화된 정확하고 광범위한 스캐너 기능 URL 목록 지원. 60개 이상의 HTTP 요청 헤더 퍼징 기존 도구들이 다루던 3-4개 헤더에 국한되지 않음. HTTP POST 데이터 파라미터 퍼징. JSON 데이터 파라미터 퍼징. 취약점 발견 및 검증을 위한 DNS 콜백 지원. WAF 우회 페이로드. 🚨 공지 Log4J v2.15.0에는 완전한 RCE를 허용하는 패치 우회가 존재합니다. FullHunt는 CVE-2021-45046을 안정적으로 탐지하기 위해...

wpx

root@kitploit: █ █░ ██▓███ ▒██ ██▒ ██▀███ ▄▄▄ ▓██ ██▓ ▓█░ █ ░█░▓██░ ██▒ ▒▒ █ █ ▒░▓██ ▒ ██▒▒████▄ ▒██ ██▒ ▒█░ █ ░█ ▓██░ ██▓▒ ░░ █ ░▓██ ░▄█ ▒▒██ ▀█▄ ▒██ ██░ ░█░ █ ░█ ▒██▄█▓▒ ▒ ░ █ █ ▒ ▒██▀▀█▄ ░██▄▄▄▄██ ░ ▐██▓░ ░░██▒██▓ ▒██▒ ░ ░ ▒██▒ ▒██▒░██▓ ▒██▒ ▓█ ▓██▒ ░ ██▒▓░ ░ ▓░▒ ▒ ▒▓▒░ ░ ░ ▒▒ ░ ░▓ ░░ ▒▓ ░▒▓░ ...

autopentest-ai

AutoPentest An agentic pentesting MCP server that automates web application penetration testing using the full OWASP Web Security Testing Guide and PortSwigger Web Security Academy technique references. Point it at a target — it crawls your app, maps every endpoint, then spawns role-specialized...

CVE-2025-55182-Auto-Scanner

CVE-2025-55182 Scanner — это высокопроизводительный инструмент для обнаружения уязвимых конечных точек Server Action в Next.js. Он использует многопоточное сканирование, определение на основе уровня уверенности и множество индикаторов ответа для выявления потенциальных уязвимостей удалённого...

XORpass

XORpass is an encoder to bypass WAF filters using XOR operations. Installation & Usage root@kitploit: git clone https://github.com/devploit/XORpass cd XORpass $ python3 xorpass.py -h Example of bypass: Using clear PHP function: Using XOR bypass of that function: root@kitploit: $ python3 xorpass.p...

recollapse

REcollapse REcollapse est un outil auxiliaire pour le fuzzing de regex en boîte noire afin de contourner les validations et découvrir les normalisations dans les applications web. Il peut également être utile pour contourner les WAF et les atténuations de vulnérabilités faibles. Pour plus...

WAF_buster

WAFbuster Disrupt WAF by abusing SSL/TLS Ciphers About WAFbuster This tool was created to Analyze the ciphers that are supported by the Web application firewall being used at the web server end.Reference:https://0x09al.github.io/waf/bypass/ssl/2018/07/02/web-application-firewall-bypass.html.It...

NextRce

NextRce — инструмент эксплуатации RSC в Next.js CVE-2025-55182 Продвинутый сканер и инструмент эксплуатации уязвимостей для Next.js App Router РазработаноMitsec 🔥 Новая возможность: режим обхода WAF UTF-16LE Стандартные полезные нагрузки, содержащие такие ключевые слова, как childprocess или...

WAF-A-MoLE

WAF-A-MoLE A guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool f...

TREVORproxy

TREVORproxy A SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses! See the accompanying Blog Post for a fun rant and some cool demos! Note: If you're looking to defend against this...

JYso

JYso It can be used as a tool for ysoserial and JNDIExploit at the same time, and has the bypass function of multiple JNDI high versions, WAF, and RASP 🚀 Getting Started Guide 📢 Please take a moment to read this document, it will help you quickly get familiar with JYso! 🧐 Use the Documentation...

waf-bypass

WAF Bypass Tool WAF Bypass Tool est un outil open source pour analyser la sécurité de tout WAF pour les faux positifs et faux négatifs en utilisant des charges utiles prédéfinies et personnalisables. Vérifiez votre WAF avant qu'un attaquant ne le fasse. WAF Bypass Tool est développé par l'équipe...

WAFNinja

WAFNinja root@kitploit: WAFNinja - Penetration testers favorite for WAF Bypassing WAFNinja is a CLI tool written in Python. It shall help penetration testers to bypass a WAF by automating steps necessary for bypassing input validation. The tool was created with the objective to be easily...

hakoriginfinder

hakoriginfinder Outil pour découvrir l'hôte d'origine derrière un proxy inverse. Utile pour contourner les WAF et autres proxys inverses. Comment ça marche ? Cet outil effectue d'abord une requête HTTP vers le nom d'hôte/URL que vous fournissez et stocke la réponse, puis il effectue une requête...