sshconfig-lint

sshconfig-lint One engine for every place your SSH config changes. sshconfig-lint finds semantic mistakes in OpenSSH client configs: duplicate hosts, broken identity paths, unsafe options, weak algorithms, wildcard ordering, and tangled Include chains. Use the same rule codes locally, in Git hook...

rbuster

Rbuster yet another dirbuster Common Command line options -a - specify a user agent string to send in the request -c - use this to specify any cookies that you might need simulating auth. header. -f - force processing of a domain with wildcard results. -l - show the length of the response. -r...

@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Summary Mockoon's admin API commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as the user-defined mock routes, enabled by default in every shipped runtime commons-server, CLI, serverless, serves Access-Control-Allow-Origin: on every endpoint with all HTTP methods...

subfinder

Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • Library • Join Discord subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is...

dnsx

A fast and multi-purpose DNS toolkit designed for running DNS queries Features • Installation • Usage • Running dnsx • Wildcard • Notes • Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...

shuffledns

massDNS wrapper to bruteforce and resolve the subdomains with wildcard handling support Feature • Install • Run • Wildcard • License • Discord shuffleDNS is a wrapper around massdns, written in go, that allows you to enumerate valid subdomains using active bruteforce, as well as resolve subdomain...

knockpy

🔍 Knockpy Subdomain Scan v9.0 ✅ Fast & Async • 🔐 Recon + Brute • 🔧 Easy to Extend KnockPy is a modular Python 3 tool to enumerate subdomains via passive reconnaissance and bruteforce, now with async/await support , enhanced performance, and modern HTTP/TLS handling. 🚀 Features v9 ✅ Async scanning...

interactsh

An OOB interaction gathering server and client library Features • Usage • • • •...

CORStest

CORStest A simple CORS misconfiguration scanner Based on the research ofJames Kettle CORStest is a quick & dirty Python 3 tool to find Cross-Origin Resource Sharing CORS misconfigurations. It takes a text file as input which may contain a list of domain names or URLs. Currently, the following...

puredns

高速なドメインリゾルバーとサブドメインのブルートフォース攻撃、正確なワイルドカードフィルタリングを備えています はじめに » 使い方 · 仕組み · スポンサーシップ · FAQ 概要 puredns は、ワイルドカードサブドメインやDNSポイズニングエントリを正確にフィルタリングできる、高速なドメインリゾルバーおよびサブドメインブルートフォースツールです。...

sig_finder

SigFinder 允许在给定缓冲区中查找带有通配符的二进制签名。通配符由 ? 定义，可用于屏蔽一个半字节。有效签名示例： 23 56 12 68 55 0? 34 12 40 ?? 4? 8? e? 签名列表可以以 SIG 格式的文件形式提供： root@kitploit: 示例： root@kitploit: ASProtect v1.1 MTEc 9 90 60 E8 1B ?? ?? ?? E9 FC 另请参阅：SIG.txt...

EXPLOIT-CVE-2025-27515

CVE-2025-27515 概念実証 CVE-2025-27515 の実践的なデモンストレーション。Laravel Framework（≤ 12.0.0）におけるファイルアップロード検証バイパスの脆弱性です。 脆弱性の概要 CVE-2025-27515 は、Laravel アプリケーションがワイルドカード検証パターン（files.）を使用する際に、攻撃者がファイルアップロード制限を回避できるようにする検証バイパスです。この脆弱性は、Laravel が配列ベースのファイルアップロードを処理する際の弱点を悪用して、悪意のあるファイルのアップロードを可能にします。 重要度: 中/高 CWE:...

CVE-2018-11776

CVE-2018-11776 2018年8月23日、Apache Struts2は最新のセキュリティ勧告を発表し、Apache Struts2にリモートコード実行の高危険度の脆弱性が存在することを明らかにしました。この脆弱性はSemmle Security Research teamのセキュリティ研究者によって報告され、脆弱性番号はCVE-2018-11776（S2-057）です。Struts2のXML設定において、namespace値が設定されておらず、かつ（Action...

wildpwn

First things first! Read: https://www.exploit-db.com/papers/33930/ Basic usage It goes something like this: root@kitploit: usage: wildpwn.py -h --file FILE payload folder Tool to generate unix wildcard attacks positional arguments: payload Payload to use: combined | tar | rsync folder Where to...

CVE-2026-47839

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-47839 Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-47839

Cloud Foundry UAA and cf-deployment are vulnerable to a privilege-escalation flaw in federated OIDC authentication. When an OIDC identity provider is configured with groupMappingMode: AS_SCOPES and a wildcard externalGroupsWhitelist entry, users can obtain the uaa.admin scope despite operators in...

EUVD-2026-76026

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

subfinder

快速被动的子域枚举工具。 功能特性 • 安装 • 使用方法 • API 设置 • 库 • 加入 Discord subfinder 是一款子域发现工具，使用被动在线源返回网站的有效子域。它具有简单、模块化的架构，并针对速度进行了优化。subfinder 只专注于做一件事——被动子域枚举，而且做得非常好。 我们已使其符合所有使用的被动源许可证和使用限制。被动模式保证了速度和隐蔽性，渗透测试人员和漏洞赏金猎人同样可以利用这些优势。 功能特性 快速且强大的解析和通配符消除模块 精选 被动源以最大化结果 支持多种输出格式（JSON、文件、stdout） 针对速度优化且对资源轻量 STDIN/OU...

shuffledns

Wrapper de massDNS para realizar fuerza bruta y resolución de subdominios con soporte para manejo de comodines Características • Instalación • Ejecución • Comodín • Licencia • Discord shuffleDNS es un wrapper alrededor de massdns, escrito en Go, que permite enumerar subdominios válidos mediante...