CVE-2024-9326-PoC

CVE-2024-9326 PoC Exploit Script This PoC script is designed to verify the presence of CVE-2024-9326, a high SQL Injection vulnerability in PHPGurukul Online Shopping Portal v2.0. It automates the exploitation process to determine if the target web application is vulnerable, allowing security...

WannaRace

🚀 WannaRace WebApp intentionally made vulnerable to Race Condition 🤖 Description Race Condition vulnerability can be practiced in the developed WebApp. Task is to buy a Mega Box using race condition that costs more than available vouchers. Two challenges are made for practice. Challenge B is to b...

GetDataReport

ABOUT Script in PHP+JS for get information of target through a web application, use $SERVER functions and JS functions for get information of our client. Plugin WEBApps in some web applications need to collect information from the client to perform tasks with this plugin will be easier to work wi...

dawnscanner

Dawnscanner - The raising security scanner for ruby web applications dawn is a source code scanner designed to review your web applications for security issues. The tool is able to scan web applications written in Ruby and it supports all major MVC Model View Controller frameworks, out of the box...

CyberChef

CyberChef The Cyber Swiss Army Knife CyberChef is a simple, intuitive web app for carrying out all manner of "cyber" operations within a web browser. These operations include simple encoding like XOR and Base64, more complex encryption like AES, DES and Blowfish, creating binary and hexdumps,...

carina

About Carina Carina is a web application used to store webshell, Virtual Private Server VPS and cPanel data. Carina is made so that we don't need to store webshell, VPS or cPanel data in "strange places". Install Carina 1. $ git clone https://github.com/c0delatte/carina && cd carina 2. Run compos...

urlbrute

URLBrute Tool for brute-force directories/DNS on websites Avaliable Modes Directory/File brute-force DNS brute-force Installation Building from Source Install dependencies go get Build executable go build If you want to install in the $GOPATH/bin folder go install Using go get go get...

CVE-2018-14667

CVE-2018-14667 After spending many time to understand and correctly exploit this CVE, I decided to build a repo on the RichFaces 3.X RCE bug and share the HOWTOs step by step with the community. 0x00 : Introduction on RichFaces 3.X bug On Monday, November 19, Joao F M Figueiredo published a well...

PayloadsAllTheThings

Payloads All The Things A list of useful payloads and bypasses for Web Application Security. Feel free to improve with your payloads and techniques! You can also contribute with a 🍻 IRL, or using the sponsor button. An alternative display version is available at PayloadsAllTheThingsWeb. 📖...

Ratpack-1

What is Ratpack? Ratpack is a simple, capable, toolkit for creating high performance web applications. Ratpack is built on Java and the Netty event-driven networking engine. The API is optimized for Groovy and Java 8. Optional Google Guice integration provides a foundation for scaling your...

tachyon

Tachyon Tachyon is a fast web application security reconnaissance tool. It is specifically meant to crawl a web application and look for left over or non-indexed files with the addition of reporting pages or scripts leaking internal data. User Requirements Linux Python 3.6+ User Installation...

DVWA

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Application DVWA is a PHP/MariaDB web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of...

See-SURF

See-SURF Security scanner now powered with AI 🤖 to find potential Server Side Request Forgery SSRF parameters in your web application. See-SURF not only helps you detect potential SSRF parameters but also helps you validate it, protecting your application with system and user data compromise. 🎓...

akca

AKCA Advanced Web Security Scanner Discover endpoints. Test web applications. Inspect the evidence. Installation · Usage · Workflow · Profiles · Coverage · Reports · Support · Features · Changelog AKCA is an open-source, evidence-oriented Dynamic Application Security Testing DAST scanner written ...

Honeypot-Project

OWASP Honeypot-Project The goal of the OWASP Honeypot Project is to identify emerging attacks against web applications and report them to the community, in order to facilitate protection against such targeted attacks. Based around the earlier OWASP/WASC Distributed Web Honeypots Project...

OpenHunterAI

OpenHunterAI Your local AI red team. Attacker-style reasoning for web, API, and LLM application security. Quick start · Agent skill · Assessment model · Architecture · Docs · Star history OpenHunterAI brings scope, scan activity, findings, and remediation into one local workspace. Start without a...

CVE-2022-3689

CVE-2022-3689 Analysis Report Overview CVE-2022-3689 is an SQL injection vulnerability found in a specific WordPress plugin, which allows an attacker to exploit security vulnerabilities in web applications to insert malicious SQL code into the database. This can lead to serious security issues su...

SafeLine

SafeLine - Make your web apps secure 🏠 Website | 📖 Docs | 🔍 Live Demo | 🙋‍♂️ Discord | 中文版 🏆 Achievements 👋 INTRODUCTION SafeLine is a self-hosted WAFWeb Application Firewall to protect your web apps from attacks and exploits. A web application firewall helps protect web apps by filtering and...

snare

SNARE Super Next generation Advanced Reactive honEypot About SNARE is a web application honeypot sensor attracting all sort of maliciousness from the Internet. Documentation The documentation can be found here. Basic Concepts Surface first. Focus on the attack surface generation. Sensors and...

NGWAF

N3XT-G3N Web App Firewall NGWAF NGWAF is created by@yupengfei, @zhangbosen, @matthewng and @elizabethlim. Special shoutout to@ruinahkoh for her contributions to the initial stages of NGWAF. NGWAF is an experimental proof of concept and not ready for production use in its current form. Contents 1...