CVE-2023-22960

PoC for CVE-2023-22960 Details PoC for CVE-2023-22960 that I discovered. This vulnerability allows an attacker to bypass the credentials brute-force prevention mechanism of the Embedded Web Server interface of all Lexmark printer models that have a firmware version released before 01/2023. This...

linux-soft-exploit-suggester

linux-soft-exploit-suggester Script to find exploits for all vulnerable software on the system, targeting software packages rather than just kernel vulnerabilities. It uses the exploit database to assess the security of packages and search for exploits to help with privilege escalation. Usage...

reversemap

reversemap Analyse SQL injection attempts in web server logs The program can either be run in batch mode or interactive mode. In batch mode the program will accept Apache web server logs and will deobfuscate requested URLs from the logs. In interactive mode the program will prompt for user input...

domain_analyzer

Domain Analyzer v0.8.3 What Domain analyzer is a security analysis tool that automatically discovers and reports information about a given domain. Its main purpose is to analyze domains in an unattended way. It has many crazy features, such as getting more domains from DNS zones, automatic nmap,...

full-60-ddos-tools

Full 60 Ddos Tools Yoo, It's a collection of 60 most popular and powerful ddos tools now. Most powerful DDOS Tools need Python to run. This is a highly personal and optimized programming language. Widely used, easy to learn and simpler optimized syntax. Also used to write Tool DDOS Python to test...

social-engineer-toolkit

The Social-Engineer Toolkit SET The Social-Engineer Toolkit is an open-source penetration testing framework for authorized social-engineering assessments. SET provides guided attack vectors for security teams that need to test user awareness, validate controls, and run consent-based red-team...

pwndrop

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...

dirsearch

DirSearch This software is a Go implementation of the original dirsearch tool written by Mauro Soria. DirSearch is the very first tool I write in Go, mostly to play and experiment with Go's concurrency model, channels, and so forth : Purpose DirSearch takes an input URL -url parameter and a...

CVE-2026-73328

The Volmarg Personal Management System (through version 2.1.0 ) contains an unrestricted file upload vulnerability in the /upload/send/ endpoint. This flaw allows authenticated users to upload malicious PHP files by submitting base64 encoded content with a .php filename into the web root. Success...

BirDuster

BirDuster About BirDuster is a Python based knockoff of the original DirBuster. BirDuster is a multi threaded Python application designed to brute force directories and files names on web/application servers. Often is the case now of what looks like a web server in a state of default installation...

dirstalk

Dirstalk Dirstalk is a multi threaded application designed to brute force paths on web servers. The tool contains functionalities similar to the ones offered by dirbuster and dirb. Here you can see it in action: Contents How to use it Scan Useful resources Dictionary generator Download Developmen...

CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

CVE-2026-119742

Nagios XI versions prior to 2026R2 are vulnerable to an OS command injection flaw in the MIB upload feature. The root cause is located in the install_mib() function within mibs.php, which employs an incomplete character deny-list that fails to filter semicolons and pipes. An authenticated adminis...

EUVD-2026-115824

Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the installmib function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace characters before...

nikto

nikto Nikto web server scanner - https://cirt.net/Nikto2 Full documentation - https://github.com/sullo/nikto/wiki Run normally: git clone https://github.com/sullo/nikto Main script is in program/ cd nikto/program Run using the shebang interpreter ./nikto.pl -h http://www.example.com Run using per...

domhttpx

domhttpx is a google search engine dorker with HTTP toolkit built with python, can make it easier for you to find many URLs/IPs at once with fast time. List Install Usage Flags Basic Usage One Keyword Multiple Keyword Extract Title Page Extract Title Page from Real Path Extract Status Code Extrac...

CVE-2023-44487

CVE-2023-44487 Basic vulnerability scanning to see if web servers may be vulnerable to CVE-2023-44487 This tool checks to see if a website is vulnerable to CVE-2023-44487 completely non-invasively. 1. The tool checks if a web server accepts HTTP/2 requests without downgrading them 2. If the web...

spurt

Spurt Introduction Spurt is a powerful stress testing tool designed to simulate high volumes of traffic and evaluate the performance and resilience of web servers. It has been tested on Linux. Spurt first checks if the target URL is valid. A custom module is used to generate common "User-Agent" a...

angryFuzzer

AngryFuzz3r Status: Development About the AngryFuzz3r project AngryFuzz3r is a collection of tools for pentesting to gather information and discover vulnerabilities of the targets based on Fuzzedb https://github.com/fuzzdb-project/fuzzdb project UrlFuzz3r-AngryFuzz3r1 Discover hidden files and...

Neterbit NW-431F - Unauthenticated SMS Disclosure

Neterbit NW-431F 20250715 contains an information disclosure vulnerability caused by manipulation in /sms.json of the Embedded Web Server, letting remote attackers access sensitive information, exploit requires no special conditions. id: CVE-2026-108578 info: name: Neterbit NW-431F -...