keyhacks

KeyHacks는 버그 바운티 프로그램이나 침투 테스트에서 발견된 다양한 API 키를 검증하는 방법을 보여줍니다. @Gwen001가 전체 프로세스를 스크립트로 작성했으며, 여기에서 찾을 수 있습니다. 목차 ABTasty API 키 Algolia API 키 Amplitude API 키 Asana 액세스 토큰 AWS 액세스 키 ID 및 시크릿 Azure Application Insights 앱 ID 및 API 키 Bazaarvoice 패스키 Bing Maps API 키 Bit.ly 액세스 토큰 Branch.io 키 및 시크릿...

FOSKiller

███████╗ ██████╗ ███████╗██╗ ██╗██╗██╗ ██╗ ███████╗██████╗ ██╔════╝██╔═══██╗██╔════╝██║ ██╔╝██║██║ ██║ ██╔════╝██╔══██╗ █████╗ ██║ ██║███████╗█████╔╝ ██║██║ ██║ █████╗ ██████╔╝ ██╔══╝ ██║ ██║╚════██║██╔═██╗ ██║██║ ██║ ██╔══╝ ██╔══██╗ ██║ ╚██████╔╝███████║██║ ██╗██║███████╗███████╗███████╗██║ ██║...

sub.sh

🎯🕸📘 MultiprocessingParallelSubdomain Detect Script ✨ 🔺Sub.sh but without API key 🔻 https://github.com/cihanmehmet/sub.sh ‼️ jq , httprobe and parallel required 📌 📘 ✅ Used Services + https://crt.sh + http://web.archive.org + https://dns.bufferover.run + https://www.threatcrowd.org +...

bbrecon

This project is no longer maintained and I took the crawling infrastructure offline. The audience was not big enough to justify maintaining it. Bug Bounty Recon bbrecon is a free Recon-as-a-Service for bug bounty hunters and security researchers. The API aims to provide a continuously up-to-date...

git-hound

🐾 GitHound 패턴 매칭, 패치 공격, 일괄 포착 비밀 스내처. 개요 GitHound는 GitHub dork와 패턴 매칭, 컨텍스트 감지, 커밋 기록 분석을 결합하여 GitHub 전반에서 노출된 API 키, 비밀 및 자격 증명 을 사냥합니다. GitHub dork를 GitHound에 입력하면 쿼리와 일치하는 모든 파일과 리포지토리에서 비밀을 스캔합니다. 일반적인 스캐너와 달리 GitHound는 GitHub의 Code Search API 를 활용하여 소수의 타겟이 아닌 모든 공개 리포지토리에 대한 전체 가시성을 제공합니다...

CVE-2026-71204-PoC

CVE-2026-71204 — changedetection.io: Omitted Checkbox in /settings Save Silently Disables API Key Enforcement Product: dgtlmoon/changedetection.io — v0.55.7 Files: changedetectionio/blueprint/settings/init.py, changedetectionio/forms.py CWE: CWE-284 — Improper Access Control CVSS 3.1:...

EUVD-2026-92135

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

Pribado

🔐 Pribado Private API Key Management & Zero-Knowledge Infrastructure Pribado is a self-hostable, zero-knowledge platform for managing API keys, encrypted secrets, and private communications. Built on Oasis Sapphire for hardware-backed confidential computing. ✨ Features 🔑 Private API Proxy Store A...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2022-41544

CVE-2022-41544 Exploit Script This repository contains a script to exploit CVE-2022-41544 vulnerability in GetSimple CMS. The script performs several steps to check for vulnerabilities, leak API keys, set cookies, obtain CSRF tokens, upload a shell, and trigger the shell. Changes and Improvements...

secret-regex-list

Secret Regex List List of regex for scraping secret API keys and juicy information. You can directly copy this and put into your python code, some regexes might require three quotes or else it will break the code. "Cloudinary" : "cloudinary://.", "Firebase URL": ".firebaseio.com", "Slack Token":...

-CVE-2025-59528-PoC

CVE-2025-59528-PoC FOR EDUCATIONAL PURPOSES ONLY A simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool, that is also part of an HTB seasonal challenge, on which I tested it btw. If it's not working, make sure the comman...

pigeon

Pigeon Your agent spawned a sub-agent and handed it the same API key. That sub-agent can now deploy to production, read the payments database, and merge to main. Pigeon stops that. You hand the child a Pigeon Pass : a narrowed, signed credential for what it may do, not a copy of everything you ca...

SimpleHelp <= 5.5.7 - Privilege Escalation

SimpleHelp remote support software v5.5.7 and before contains a privilege escalation caused by insufficient access controls in API key creation, letting low-privileges technicians escalate privileges to server admin, exploit requires low-privileges technician access. id: CVE-2024-57726 info: name...

apkprobe

APKprobe APK decompiler and secrets scanner for Android security research. Automatically extract API keys , endpoints , tokens , and other leaked credentials from Android applications. Works with .apk, .xapk, .dex, .jar, .class, .smali, .zip, .aar, .arsc, .aab files. Perfect for apk2url extractio...

PT-2026-104656

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl verify peer to FALSE, which is passed to CURLOPT SSL VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service...

CVE-2025-44823

Authenticated API Key Exposure in Nagios Log Server 2024R1.3.1 ▶️ PoC Demo CVE ID: CVE-2025-44823 Date: 2025-04-02 Authors: Alex Tisdale, Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...