gitleaks

Gitleaks ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ root@kitploit: !WARNING Gitleaks 功能已完整。我不会在 Gitleaks 中合并新功能。未来版本仅包含安全补丁。我的工作重点已转向 Betterleaks license: https://raw.githubusercontent.com/gitleaks/gitleaks/HEAD/LICENSE badge-license: https://img.shields.io/github/license/gitleaks/gitleaks.svg...

CVE-2018-20555

CVE-2018-20555 El plugin de WordPress llamado Social Network Tabs, creado por la empresa Design Chemical, está filtrando dos veces el accesstoken, accesstokensecret, consumerkey y consumersecret de Twitter de sus usuarios, lo que conduce a una toma de control de su cuenta de Twitter. Esto es...

slicer

Slicer A tool to automate the recon process on an APK file. Slicer accepts a path to an extracted APK file and then returns all the activities, receivers, and services which are exported and have null permissions and can be externally provoked. Note : The APK has to be extracted via jadx or...

should-i-trust

should-i-trust Summary should-i-trust is a tool to evaluate OSINT signals for a domain. Requirements should-i-trust requires API keys from the following sources: Censys.io - Free for for first 250/quries/month VirusTotal - Free GrayHatWarFare - Free with limited results Use Case You're part of a...

inquisitor

Inquisitor Notice This project is only partially complete and I have yet to implement many of the features described in the following blog post I made: https://penafieljlm.com/2017/07/14/inquisitor/. Inquisitor is a simple tool for gathering information on companies and organizations through the...

fileintel

fileintel This is a tool used to collect various intelligence sources for a given file. Fileintel is written in a modular fashion so new intelligence sources can be easily added. Files are identified by file hash MD5, SHA1, SHA256. The output is in CSV format and sent to STDOUT so the data can be...

CVE-2022-1442

CVE-2022-1442 WordPress Plugin Metform = 2.1.3 - Control de Acceso Inadecuado que Permite la Divulgación No Autenticada de Información Sensible Descripción Es vulnerable a la divulgación de información sensible debido a un control de acceso inadecuado en el archivo /core/forms/action.php, que pue...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

twebit

Bitcoin analysis with machine learning How it works? 1- Get tweets from twitter 2- Filter tweets 3- Tweet classification with naive bayes algorithm Positive,negative and neut Installation root@kitploit: git clone https://github.com/omergunal/twebit cd twebit pip3 install -r requirements.txt Updat...

SecretFinder

acerca de SecretFinder SecretFinder es un script de Python basado en LinkFinder, escrito para descubrir datos sensibles como apikeys, accesstoken, autorizaciones, jwt, etc. en archivos JavaScript. Lo hace usando jsbeautifier para Python en combinación con una expresión regular bastante grande. La...

GitSecure

GitSecure Acerca de GitSecure GitSecure es una acción de GitHub que se puede utilizar para alertar a los equipos de seguridad sobre cualquier clave API expuesta en solicitudes push y pull. Cuando se añaden o modifican archivos en un repositorio de GitHub, esta acción se iniciará y comenzará a...

Chuanhu Chat - Directory Traversal

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

Adlisting Classified Ads 2.14.0 - Information Disclosure

Information disclosure issue in the redirect responses, When accessing any page on the website, Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects. id: CVE-2023-4168 info: name: Adlisting Classified Ads 2.14.0 - Information Disclosure autho...

WordPress Metform <=2.1.3 - Information Disclosure

WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the /core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA...

Control Web Panel (CWP) - File Inclusion

In CWP Control Web Panel, previously CentOS Web Panel before version 0.9.8.1107, an unauthenticated attacker can abuse null byte %00 injection with the "scripts" parameter in the /user/loader.php or /user/login.php endpoints to register arbitrary API keys or access sensitive files. This can be...

GitLeaks

GitLeaks GitLab CI 组件 一个用于 Gitleaks 的 GitLab CI 组件 —— 一款用于检测和防止硬编码秘密（如密码、API 密钥和令牌）被提交到 git 仓库的 SAST 工具。 功能特性 秘密检测 ：扫描仓库中的硬编码秘密和敏感信息 全面规则集 ：包含大量内置规则，用于检测各类秘密 自定义配置 ：支持本地和远程配置文件 多种输出格式 ：支持 JSON、SARIF 及其他报告格式 灵活参数 ：可直接向 Gitleaks 传递附加标志 远程配置 ：从远程 URL 下载并使用配置文件 可配置作业设置 ：可自定义作业名称、阶段和容器镜像 使用方法 基本用法...

kyubisweep

🦊 KyubiSweep Hunt exposed secrets with the cunning of a fox! A lightweight, cross-platform CLI tool that scans your filesystem to detect exposed secrets, API keys, and tokens. Built with Go for maximum performance and zero dependencies. ✨ Features 🔍 30+ Secret Patterns - Detects AWS, Stripe,...

aquatone

AQUATONE Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. Installation 1. Install Google Chrome or Chromium browser -- Note: Google Chrome is currently giving unreliable results when...

socialhunter

socialhunter !IMPORTANT This tool is no longer working, and we won't be able to fix it as it has become difficult to bypass social media protections. Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attack...

bug-bounty-tools

Bug-Bounty-Skript Ein BASH-Skript zur Automatisierung der Installation der beliebtesten Bug-Bounty-Tools; der Hauptzweck dieses Skripts besteht darin, es auf temporären/wegwerfbaren virtuellen Maschinen in der Cloud auszuführen. Verwendete Tools Nuclei httpx Naabu Subfinder DNSx Nmap Katana Recox...