burpgpt

!ВАЖНО Объявляем о запуске BurpGPT Pro — редакции, специально разработанной для удовлетворения потребностей профессионалов и кибер-бутиков. Откройте для себя множество мощных функций и удобный интерфейс, который расширяет ваши возможности и обеспечивает оптимальный пользовательский опыт. Чтобы...

EKFiddle

EKFiddle v.1.2.6 Расширение/правила для веб-отладчика Fiddler Classic для анализа вредоносного веб-трафика. Fiddler Classic Установка Загрузите и установите Fiddler отсюда: https://www.telerik.com/fiddler Загрузите и запустите EKFiddleExtension.exe В качестве альтернативы загрузите EKFiddle.dll и...

betwixt

Betwixt поможет вам анализировать веб-трафик вне браузера, используя знакомый интерфейс Chrome DevTools. Установка Скачайте последний релиз для вашей операционной системы, создайте свой собственный пакет или запустите Betwixt из исходного кода. Настройка Чтобы захватывать трафик, вам нужно...

web-traffic-generator

web-traffic-generator 一个简单粗暴的 HTTP/S “自然”流量生成器。 关于 只是一个简单（写得不太好）的 Python 脚本，它会从预定义的 ROOTURLS 开始，随机“点击”页面上的链接，漫无目的地“浏览”互联网，直到达到预定义的 MAXDEPTH。 我创建这个工具是作为噪声生成器，用于事件响应/网络防御模拟。唯一的问题是，我的模拟环境使用了多台 IDS/IPS/NGFW 设备，它们不会放行并记录针对预置流量的简单 TCP 重放。我需要流量尽可能自然，基本上模拟真实用户浏览网页。 已在 Ubuntu 14.04 和 16.04 minimal...

web-traffic-generator

web-traffic-generator Un generatore di traffico HTTP/S "organico" rapido e sporco. Informazioni Solo un semplice script Python scritto male che "naviga" senza scopo su Internet partendo da ROOTURLS predefiniti e "cliccando" casualmente link sulle pagine fino a raggiungere il MAXDEPTH predefinito...

CVE-2026-18753

CVE-2026-18753 concerns GV-AS1620 Controller Firmware (GV-ASManager). The firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. Exposure of this private key allows attackers to decrypt HTTPS traffic and spoof the server, compromising confidenti...

CVE-2026-16504

The CVE-2026-16504 entry concerns VPS.org’s one-click Zulip template. It vulnerable component: the Zulip deployment template ships with a hardcoded application signing key (secret_key: changeme), a default database password (zulip), and DISABLE_HTTPS=True. Reported impact: authentication bypass a...

EUVD-2026-46858

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content:...

EUVD-2026-46804

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database component: Kubernetes Operator. The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen...

CVE-2026-53727

Summary: Multiple sources confirm a vulnerability in css_parser prior to 3.0.0 where CssParser::Parser#read_remote_file, Parser#load_uri!, and Parser#add_block! follow HTTP(S) redirects and even service file:// URIs without proper host/scheme filtering, enabling SSRF to internal hosts and potenti...

MAL-2026-10165 Malicious code in @injectivelabs/sdk-ts (npm)

@injectivelabs/[email protected] published 2026-07-08 20:59 UTC contains a wallet-credential stealer disguised as "key derivation telemetry". A file packages/sdk-ts/src/utils/key-derivation-telemetry.ts plus a hook added to packages/sdk-ts/src/core/accounts/PrivateKey.ts capture wallet secrets durin...

PYSEC-2026-1596 HTTP/HTTPS Traffic Interception Bypass in mad-proxy

A vulnerability in mad-proxy versions = 0.3 allows attackers to bypass HTTP/HTTPS traffic interception rules, potentially exposing sensitive traffic...

CVE-2026-10763

PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support from 3rd party Digipede server...

CVE-2026-48491

Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection SNICheck that allows an unauthenticated client to bypass mutual TLS enforced through wildcard router TLSOptions. When a router uses a wildcard...

samba: group policy certificate enrollment uses http:// without validation

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability t...

Web-Attack-Detection-Lab

!Kali Linuxhttps://img.shields.io/badge/KaliLinux-557C94?sty...

PT-2026-48667

A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic...

CVE-2026-45433

This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device firmware. A remote attacker could exploit this vulnerability by extracting the cryptographic private key from the firmware, which could lead to decryption of HTTPS traffic and...

EUVD-2026-34168

Version 3.0.7 of the Securly Chrome Extension downloads config.json over HTTP and compiles server-provided patterns as JavaScript regular expressions via new RegExp without complexity validation. An on-path attacker can inject specific patterns to cause catastrophic backtracking, resulting in...

CVE-2026-25599 Missing authentication and clear‑text data transmission affecting Orca heat pumps

Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregated data, can lead to stored XSS that enables theft of cookies from the pump’s web control interface. Older Orca heat pump devices...