Parth

Parth 启发式脆弱参数扫描器 介绍 某些HTTP参数名称比其他参数更常与某一功能相关联。例如，参数?url=通常包含URL作为其值，因此常常成为文件包含、开放重定向和SSRF攻击的受害者。Parth可以遍历你的Burp历史记录、一个URL列表或它自己发现的URL，以找出这些参数名称及其常见的关联风险。Parth旨在通过帮助优先测试组件来辅助Web安全测试。 用法 安装： pip3 install parth 从文件导入目标 该选项适用于所有3种支持的导入类型：Burp Suite历史记录、换行分隔的文本文件或HTTP请求文本文件。 root@kitploit: parth -i...

ChopChop

ChopChop ChopChop 是一个用于Web应用程序动态应用程序安全测试的命令行工具，最初由米其林CERT编写。 其目标是扫描多个端点，识别通过Web根目录暴露的服务/文件/文件夹。检查/签名在配置文件中声明（默认：chopchop.yml），完全可配置，尤其适合开发者。 "Chop chop" 是一个源于粤语的短语。"Chop chop" 意为"赶快"，表示某事应该立即完成，刻不容缓 。 目录 构建 使用 可用标志 高级用法 创建新的检查/签名 外部库 演讲 许可证 作者 构建 我们尽量简化构建过程，希望以下步骤即可完成： root@kitploit: $ go mod...

sql-injection

sql-injection python tool that...

web-attack-payloads

Web Attack Payloads Collection !Cybersecurityhttps://img.s...

PT-2026-25586

Summary Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inserted as raw HTML into the generated report. This allowed JavaScript...

Plasma

Plasma !Pythonhttps://img.shields.io/badge/python-3.10%2B-...

SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity

Deep Reinforcement Learning DRL has achieved remarkable success in domains requiring sequential decision-making, motivating its application to cybersecurity problems. However, transitioning DRL from laboratory simulations to bespoke cyber environments can introduce numerous issues. This is furthe...

web-security-vulnerability-labs

web-security-vulnerability-labs This repository documents han...

Exploit for CVE-2015-1427

Penetration Testing Framework !License: MIThttps://img.sh...

pentest-automation-suite

Penetration Testing Automation Tools 🔴 Automated Penetratio...

Janusec-Application-Gateway

It is an offensive tool for web application security testing. The repository contains a tool for testing web application security, specifically for identifying vulnerabilities in web applications. The tool is designed to test for various types of vulnerabilities, including SQL injection, cross-si...

3DSecure 2.0 3DS Authorization Challenge Cross Site Scripting

Product: 3DSecure 2.0 Manufacturer: Redsys Affected Versions: 3DSecure 2.0 3DS Authorization Challenge Tested Versions: 3DSecure 2.0 3DS Authorization Challenge Vulnerability Type: Cross-Site Scripting XSS Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17...

3DSecure 2.0 3DS Method Authentication Cross Site Scripting

Product: 3DSecure 2.0 Manufacturer: Redsys Affected Versions: 3DSecure 2.0 3DS Method Authentication Tested Versions: 3DSecure 2.0 3DS Method Authentication Vulnerability Type: Cross-Site Scripting XSS Risk Level: Medium Solution Status: Not yet fixed Manufacturer Notification: 2024-01-17 Solutio...

vulhub

This is a collection of vulnerable web applications and tools for testing and learning about web application security. The repository contains a variety of applications, including CouchDB, FFmpeg, Git, and Jenkins, each with its own set of vulnerabilities. The applications are designed to be used...

vulhub

This is an open-source collection of pre-built vulnerable docker environments. It is an offensive tool for web application security testing. The primary vulnerability is not specified, but the repository contains various vulnerable environments, including ones for CouchDB, FFmpeg, Git, InfluxDB,...

Unspecified Vulnerability in HCL AppScan

HCL AppScan is a suite of dynamic analysis testing tools from HCL India. The tool is mainly used for web security testing. A security vulnerability exists in HCL AppScan Enterprise, which stems from the lack of HTTP Strict-Transport-Security header in the Management section of the Enterprise...

Unspecified Vulnerability in HCL AppScan (CNVD-2021-13713)

HCL AppScan is a suite of dynamic analysis testing tools from HCL India. The tool is mainly used for web security testing. A security vulnerability exists in HCL AppScan Enterprise that stems from the use of broken or risky encryption algorithms to store REST API user details. No detailed...

vulhub

It is an offensive tool for web application security training. The repository contains a collection of pre-built vulnerable docker environments, allowing users to practice web application security testing without requiring prior knowledge of docker. The tool is designed to be easy to use, with a...

HCL AppScan Cross-Site Scripting Vulnerability

HCL AppScan is a suite of dynamic analysis testing tools from HCL India, which is primarily used for web security testing. A cross-site scripting vulnerability exists in HCL AppScan Enterprise Edition version 10.0.0 and earlier. The vulnerability stems from the lack of proper validation of...

Unspecified Vulnerability in HCL AppScan Enterprise advisory API

HCL AppScan Enterprise is a suite of dynamic analysis and testing tools from HCL India, which is primarily used for web security testing. A security vulnerability exists in the Advisory API documentation in HCL AppScan Enterprise 10.0.0 and earlier versions. The vulnerability can be exploited by ...