Exchange2domain

Exchange2domain Herramientas todo en uno de privexchange. Solo necesitas abrir el puerto del servidor web, por lo que no se requieren privilegios elevados. ¡Gran artículo! Abusando de Exchange: una sola llamada a la API te separa de Domain Admin. Requisitos Estas herramientas requieren impacket...

reposcanner

Reposcanner Reposcanner is a python script to search through the commit history of Git repositories looking for interesting strings such as API keys, inspired by truffleHog. Installation The python Git module is required python3-git on Debian. Docker docker build -t reposcanner . docker run -it...

CVE-2014-0160-Chrome-Plugin

Heartbleed chrome plugin OBSOLETO Plugin de Chrome que verifica si el sitio actual y todos los subdominios llamados son vulnerables a CVE-2014-0160. La verificación de vulnerabilidad se realiza mediante un servicio API que ahora está muerto ¡no lo estaba en 2014!. Quizás el código pueda ser útil...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105849

The Payload headless content management system is vulnerable to API key disclosure in versions 3.0.0 to 3.90.0 and canary versions before 4.0.0-canary.34 . If an authentication collection has useAPIKey enabled, users with ordinary read access to other authentication documents can obtain active AP...

EUVD-2026-93492

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2026-105849 Payload: API key disclosure through ordinary document reads

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

CVE-2021-22214

CVE-2021-22214 Vulnerabilidad SSRF no autorizada en Gitlab CI Lint API CVE-2021-22214 Este artículo y la herramienta son solo para compartir conocimientos técnicos. Está estrictamente prohibido su uso con fines ilegales. Cualquier consecuencia derivada de dicho uso es responsabilidad exclusiva de...

snapchat-map-scraper

Snapchat Story Downloader This program can search Snapchat's public Snap Map at multiple locations and download all stories for later investigation and categorization. A lot is unknown about how Snapchat decides which videos show up at which "point" on the map, so the scraper can also randomize t...

h8mail

h8mail is an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent. 📖 Table of Content Table of Content Features APIs Usage Usage examples Thanks & Credits Related...

cve-2026-9082

CVE-2026-9082 Tipo : Inyección SQL CWE-89 Producto afectado : Drupal Core API de abstracción de base de datos Aviso de Drupal : SA-CORE-2026-004 Publicado : 20 de mayo de 2026 Gravedad : Altamente crítica Drupal 20/25 | NVD CVSS 6.5 ¿Qué es? CVE-2026-9082 es una vulnerabilidad de inyección SQL en...

USN-8887-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-oracle, linux-realtime vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table RMP checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory...

USN-8886-1: Linux kernel (NVIDIA Tegra) vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - NVDIMM Non-Volatile Memory Device drivers; - Handshake API; - ARM32 architecture; - ARM64 architecture; - MIPS...

WPForce

WPForce - Suite de Ataque a WordPress ACERCA DE: WPForce es un conjunto de herramientas de ataque a WordPress. Actualmente contiene 2 scripts: WPForce, que fuerza bruta inicios de sesión a través de la API, y Yertle, que sube shells una vez que se han encontrado credenciales de administrador...

CVE-2023-23752

CVE-2023-23752 Exploit para CVE-2023-23752 4.0.0 GET /api/index.php/v1/config/application?public=true HTTP/1.1 Host: 10.9.49.205 User-Agent: curl/7.68.0 Accept: / Mark bundle as not supporting multiuse HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 15:14:05 GMT Server: Apache/2.4.41 Ubuntu x-frame-option...

kubebot

Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...

EUVD-2026-93469

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

SlackPirate

SlackPirate - Herramienta de Enumeración y Extracción de Slack Esta es una herramienta desarrollada en Python que utiliza las APIs nativas de Slack para extraer información 'interesante' de un espacio de trabajo de Slack dado un token de acceso. Desde mayo de 2018, Slack tiene más de 8 millones d...

C2-Hunter

C2-Hunter C2-Hunter es un programa diseñado para analistas de malware para extraer tráfico de Comando y Control C2 de malwares en tiempo real. El programa utiliza un enfoque único al engancharse en las API de conexiones win32. Con C2-Hunter, los analistas de malware ahora pueden interceptar y...

xed

Codificador-Decodificador X86 de Intel® Intel® XED Manual de la API Doxygen y manual de compilación del código fuente: https://intelxed.github.io Errores: https://github.com/intelxed/xed/issues/new Instrucciones abreviadas de compilación desde GITHUB : git clone https://github.com/intelxed/xed.gi...