gotestwaf

GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...

OpenDoor

OpenDoor — OWASP Web Recon & Directory Discovery Platform OpenDoor is an open-source CLI Recon Platform for authorized web reconnaissance, directory discovery, subdomain enumeration, fingerprints, WAF detection, bypass probing, response filtering, reporting, open-redirect checks, bounded crawl an...

WhatWaf

WhatWaf? WhatWaf is an advanced firewall detection tool who's goal is to give you the idea of "There's a WAF?". WhatWaf works by detecting a firewall on a web application, and attempting to detect a bypass or two for said firewall, on the specified target. SIDE-NOTE: Any issue that is not the...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

waf-checker

Una potente aplicación web para probar qué tan bien protege tu Cortafuegos de Aplicaciones Web WAF contra vectores de ataque comunes. → waf-checker.com ← Características Pruebas de seguridad 19+ categorías de ataque listas para usar: Inyección SQL, XSS, Path Traversal, Inyección de Comandos, SSRF...

waf-checker

WAF Checker Este proyecto te ayuda a comprobar qué tan bien protege tu Web Application Firewall WAF tu producto contra ataques web comunes. Se puede ejecutar como un Cloudflare Worker con una interfaz web interactiva incorporada o como una herramienta CLI independiente de Node.js. Características...

Cerberus

Cerberus A powerful vulnerability scanner. Subdomain enumeration uses aioDNS with asyncio for asynchronous fast scanning. It covers the target's full asset scope for batch vulnerability scanning, middleware information collection, automatic proxy IP collection, and automatically uses proxy IPs to...

Recon

👑 Recon 👑 The step of recognizing a target in both Bug Bounties and Pentest can be very time-consuming. Thinking about it, I decided to create my own recognition script with all the tools I use most in this step. All construction of this framework is based on the methodologies of @ofjaaah and...

waf-detector

WAF Detector CLI tool for detecting, testing, and profiling Web Application Firewalls WAFs and Content Delivery Networks CDNs. Important: Only test systems you own or have explicit authorization to test. For AI coding agents: See AGENTS.md for skill mapping and workflow pointers. Use...

AutoSQLi

AutoSQLi, the new way script-kiddies hack websites Features Save System - there is a complete save system, which can resume even when your pc crashed. - technology is cool Dorking - from the command line one dork : YES - from a file: NO - from an interactive wizard: YES Waffing - Thanks to...

cdncheck

cdncheck Features • Installation • Usage • Join Discord cdncheck is a tool for identifying the technology associated with dns / ip network addresses. Features CDN , CLOUD and WAF Detection Easy to use as library Easily extendable providers IP, DNS input support Text, JSONL output Filters on outpu...

dfir-malware-investigation

DFIR Malware Investigation Lab – Spring4Shell CVE-2022-22965 A comprehensive Digital Forensics & Incident Response DFIR project that simulates, detects, and investigates the Spring4Shell CVE-2022-22965 critical vulnerability. This project demonstrates the complete incident response lifecycle from...

Exploit for CVE-2025-32429

CVE-2025-32429 Vulnerability Checker A Python-based vulnerabi...

CVE-2024-41661

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-50094. Reason: This candidate is a duplicate of CVE-2023-50094. Notes: All CVE users should reference CVE-2023-50094 instead of this candidate...

CVE-2024-41661

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-50094. Reason: This candidate is a duplicate of CVE-2023-50094. Notes: All CVE users should reference CVE-2023-50094 instead of this candidate...

CVE-2024-41661

...

CVE-2024-41661

CVE-2024-41661 is rejected; use CVE-2023-50094 instead.

CVE-2022-39957 Response body bypass in OWASP ModSecurity Core Rule Set via a specialy crafted charset in the HTTP Accept header

The OWASP ModSecurity Core Rule Set CRS is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

This work includes testing and improvement tools for C...

Vxscan

This is a Python-based comprehensive scanning tool called Vxscan. It is used for sensitive file detection, WAF/CDN identification, port scanning, fingerprint/service identification, operating system identification, weak password detection, POC scanning, SQL injection, and other functions. The too...