burpfox

🦊 BurpFox A Burp Suite extension that integrates Dalfox XSS scanner directly into your workflow. Features 🎯 Right-click scanning - Scan requests directly from Proxy History or Repeater. ⚙️ Full Dalfox options - Context-aware, WAF evasion, Blind XSS and more. Prerequisites 1. Install Dalfox...

haiti

HAITI HA sh I denT ifI er What is it? A CLI tool and library to identify hash types hash type identifier. CLI library Features 675+ hash types detected Modern algorithms supported SHA3, Keccak, Blake2, etc. Hashcat and John the Ripper references CLI tool & library Hackable Installation...

react2shell-ultimate

React2Shell Ultimate Scanner v2.0 CVE-2025-66478 対応のプロフェッショナル Next.js RSC RCE 脆弱性スキャナー 🎯 概要 React2Shell Ultimate は、CVE-2025-66478 - React Server Components RSC を使用する Next.js アプリケーションに影響を与える重大なリモートコード実行 RCE 脆弱性 - 向けの包括的な脆弱性スキャナーです。 🆕 v2.0 の新機能 バージョン 2.0 では、大幅な機能強化とプロフェッショナル向け機能が追加されています: ✨ 強化された G...

pymultitor

PyMultiTor Python 멀티 스레드 Tor 프록시, 동시에 두 곳에 존재하고 싶었던 적이 있나요? 이 질문을 스스로에게 던졌을 때, 실제로 이 솔루션을 머릿속에서 개발하기 시작했습니다. 침투 테스트를 수행하는 동안 "공격" IP를 차단하는 보안 장치로 인한 문제가 자주 발생합니다. 이것이 정말 짜증나서, 이 문제에 대한 해결책을 제공하는 스크립트를 작성했습니다. 많은 수의 IP 주소로 공격을 수행하면 더 나은 결과가 보장됩니다 - 특히 공격웹 애플리케이션 방화벽 우회, 무차별 대입 공격 등을 시도할 때 더욱 그렇습니다...

CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authentication Bypass Advanced Bypass 🔥 Overview An advanced PoC for CVE-2025-29927 , allowing authentication bypass in Next.js Middleware by manipulating specific headers. This template enhances WAF evasion and security bypass techniques. 🚀 Features ✅...

Log4Shell-obfuscated-payloads-generator

Log4Shell-obfuscated-payloads-generator Log4Shell-obfuscated-payloads-generator can generate primary obfuscated or secondary obfuscated CVE-2021-44228 or CVE-2021-45046 payloads to evade WAF detection. The design idea of ​​Log4Shell-obfuscated-payloads-generator Installation root@kitploit: git...

bantam

Bantam 경량 서버 풋프린트, 멀티스레드 통신, 고급 페이로드 생성 및 난독화 도구를 갖춘 고급 PHP 백도어 관리 도구입니다. 요청 고유 암호화 키를 사용한 종단간 암호화와 WAF, IDS, SIEM 시스템을 우회하도록 설계된 페이로드 스트리밍을 제공합니다. 암호화가 불가능할 때 탐지를 방지하기 위해 여러 페이로드 무작위화 및 난독화 기술을 통합하고 있습니다. Bantam은 리눅스 PHP 사후 익스플로잇 권한 상승에 이상적인 도구로, 열거 스크립트를 쉽게 업로드할 수 있게 해줍니다. Bantam은 또한 플러그인 시스템을...

crithit

crithit Website Directory and file brute forcing at extreme scale. CritHit takes a single wordlist item and tests it one by one over a large collection of hosts before moving onto the next wordlist item. The intention of brute foricng in this manner is to avoid low limit Web Application Firewall...

CVE-2023-5561-POC-Updated

CVE-2023-5561-POC-Updated This repository contains a modified version of the original Proof-of-Concept PoC for CVE-2023-5561. The original PoC, which can be found here, sends a high volume of requests in parallel, which may trigger Web Application Firewalls WAFs or cause the server to block the...

log4j-scan

log4j-scan 취약한 log4j 호스트를 찾기 위한 완전 자동화된 정확하고 광범위한 스캐너 기능 URL 목록 지원 60개 이상의 HTTP 요청 헤더 퍼징 기존 도구처럼 3-4개 헤더만 퍼징하지 않음 HTTP POST 데이터 파라미터 퍼징 JSON 데이터 파라미터 퍼징 취약점 발견 및 검증을 위한 DNS 콜백 지원 WAF 우회 페이로드 🚨 공지 2022년 10월 20일 FullHunt가 Apache Commons Text RCECVE-2022-42889 식별 업데이트를 출시했습니다. Apache Commons Text RC...

burp-awesome-tls

Awesome TLS この拡張機能は Burp の HTTP および TLS スタックをハイジャックし、任意のブラウザの TLS フィンガープリント JA3 を偽装できるようにします。 Burp Suite のパワーを強化しつつ、CloudFlare、 PerimeterX、Akamai、DataDome などの各種 WAF によるフィンガープリント検出の可能性を低減します。 この拡張機能は、醜いハック、リフレクション、またはフォークされた Burp Suite Community コードに頼らずに動作します。 スポンサー...

BurpSuiteHTTPSmuggler

Burp Suite HTTP Smuggler WAFをバイパスしたり、さまざまなテクニックを使ってその効果をテストしたりするためにペネトレーションテスターを支援するBurp Suite拡張機能です。 この拡張機能は、NCC GroupのSoroush Dalili（@irsdl）によって開発されました。 最初のリリース（v0.1）は、手動で行うのがかなり複雑なEncoding機能のみをサポートしています。 詳細については、参考文献を参照してください。 次のバージョンでは、さらに多くのテクニックとバグ修正が含まれる予定です。 スクリーンショット例 参考文献:...

erebus

EREBUS Web application security assessment framework. For...

xss

CSS Style Sheet Mutation alert"This is a test" alert"...

RedTrace

RedTrace v3.0 — Web Vulnerability Scanner Professional-grad...

Exploit for Deserialization of Untrusted Data in Facebook React

Chain Reaction High-Performance Rust Scanner for React Serv...

Server-Side Request Forgery (SSRF)

Astro is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insecure and unsanitized use of the x-forwarded-proto and x-forwarded-port headers when constructing URLs, which allows an attacker to manipulate these headers to bypass protected routes, poison caches, trigger...

SMTP2GO BBP: Origin IP found, WAF Cloudflare Bypass

Description: I have discovered that the http://172.105.190.180/login/ site exposed it's IP which could allow bypassing of anti-DDoS mechanisms i.e you are using Cloudflare for protection. For Originate IP address which I found from https://search.censys.io/ By using these IP address as a resolver...

Stopping Active Attacks with Penalty Box

A web application firewall WAF is most often used by organizations for external security controls to detect and block individual attack attempts against target web application assets. Open Web Application Security Project OWASP risk rating methodology Unfortunately, today's sophisticated web...

FAST or Burp or both?

By @aLLy , Wallarm Research Hello guys, time to talk details about Wallarm FAST Framework for Application Security Testing. It’s a new automatic web vulnerability scanning and fuzzing detection tool by Wallarm Inc. It is well suited for security researchers in enterprise Red Teams as well as for...