cygor

Cygor General Overview Cygor is a modular asset discovery framework that brings scanning, parsing, and service enumeration together in one workflow. It replaces the patchwork of separate tools with an automated process that handles discovery, enrichment, and targeted enumeration seamlessly —...

CVE-2022-44149

CVE-2022-44149 This tool helps identify the CVE-2022-44149 vulnerability in routers, allowing researchers and security professionals to test their systems. It includes authentication header generation, payload delivery, and detailed logging for analysis. EN This tool is designed to test the...

linkedin2username

linkedin2username OSINT 도구: LinkedIn에서 회사별 사용자 이름 목록 생성. 이는 순수 웹 스크래퍼이며, API 키가 필요하지 않습니다. 유효한 LinkedIn 사용자 이름과 비밀번호로 로그인하면, 지정한 회사의 모든 직원에 대해 여러 가지 가능한 사용자 이름 형식의 목록을 생성합니다. 다음과 같은 결과를 얻을 수 있습니다: first.last.txt: Joe.Schmoe 형식의 사용자 이름 f.last.txt: J.Schmoe 형식의 사용자 이름 flast.txt: JSchmoe 형식의 사용자 이름...

CVE-2020-1947

CVE-2020-1947 Apache ShardingSphere UI YAML Parsing Remote Code Execution Vulnerability Reproduction and Analysis Overview ShardingSphere is an open-source ecosystem under Apache, a set of distributed database middleware solutions composed of three independent frameworks: Sharding-JDBC,...

darknet-mcp-server

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी AIエージェントのためのダークウェブ＆脅威インテリジェンス。 HIBP、ThreatFox、ランサムウェア追跡、Tor...

domain-to-webapp

domain-to-webapp A simple bash script for finding web application hosted within a domain Requirements curl Subfinder docker image Usage $./webAppChecker businesssolutions.com ./ouputdir ./scope.txt | \ | | \ \ / /| | / \ | | | |/ | ' \ / | | ' \ | / \ \ \ /\ / / \ ' \ / \ | ' | ' \ | || | | | | |...

CVE-2022-24637

CVE-2022-24637 Unauthenticated RCE in Open Web Analytics version / newPassword YourIp YourPort It might be possible that you need to run it a few times to get a shell. The script can be improved...

CVE-2018-13379

🛡️ CVE-2018-13379 - Fortinet SSL VPN Vulnerability 🔍 Overview CVE-2018-13379 is a critical path traversal vulnerability in Fortinet FortiOS SSL VPN. It allows attackers to download VPN web session files and extract sensitive information. Impact: Information disclosure usernames, session tokens...

hackersh

======== Hackersh Hackersh "Hacker Shell" is a shell command interpreter written in Python with Pythonect-like syntax, builtin security commands, and out of the box wrappers for various security tools. Hello, world Here is the canonical "Hello, world" example program in Hackersh::...

owasp-threat-dragon-desktop

OWASP Threat Dragon Threat Dragon is a free, open-source, cross-platform threat modeling application including system diagramming and a rule engine to auto-generate threats/mitigations. It is an OWASP Incubator Project. The focus of the project is on great UX, a powerful rule engine and integrati...

psc

PortShellCrypter -- PSC This project - as well as its sister project crash - belongs to my anti-censorship tool-set that allows to setup fully working encrypted shells and TCP/UDP forwarding in hostile censoring environments. It is also useful for forensics to dump data from devices via UART or...

CVE-2024-50379

Manual exploitation is troublesome, so I whipped up an exp.. Usage: shell.jsp is the shell file, ggsl.jsp is the name/path saved to the target server. ./CVE-2024-50379 -u http://192.168.2.245:8080 -f shell.jsp -p ggsl.jsp Disclaimer This tool is only intended for legally authorized enterprise...

Web-Cache-Vulnerability-Scanner

Web Cache Vulnerability Scanner WCVS is a fast and versatile CLI scanner for web cache poisoning and web cache deception developed by Hackmanit and Maximilian Hildebrand. The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify...

octohook

octohook C2를 위한 Git 웹 후크 터널 설치 apt-get update && apt-get upgrade -y apt-get install python3-pip git -y pip install --upgrade pip pip install virtualenv virtualenv -p python venv . venv/bin/activate git clone https://github.com/dsnezhkov/octohook pip install prompttoolkit PyGithub bottle pygments...

mcp-atlassian < 0.17.0 - Server-Side Request Forgery

MCP Atlassian 0.17.0 contains a server-side request forgery caused by improper validation of custom HTTP headers in the HTTP middleware, letting unauthenticated attackers force outbound requests to arbitrary URLs, exploit requires access to the mcp-atlassian HTTP endpoint. id: CVE-2026-27826 info...

Yamcs <=5.11.12 - Arbitrary File Read

Yamcs through 5.11.12 serves static web resources through a handler that resolves the requested path against the configured web root without rejecting absolute paths. A request path that begins with a double slash is resolved as an absolute filesystem path, discarding the web root, and the handle...

phpIPAM - 1.6 - Cross-Site Scripting

phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

modoboa 2.0.4 - Admin TakeOver

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...

Honeywell PM43 Printers - Command Injection

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM Printer web page modules allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 e.g. P10.19.050006 id:...

LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...