CVE-2022-22947

CVE-2022-22947 Spring Cloud Gateway is an API gateway in Spring. Versions 3.1.0 and 3.0.6 inclusive and earlier have a SpEL expression injection vulnerability. If an attacker can access the Actuator API, they can exploit this vulnerability to execute arbitrary commands. Vulnerability Environment...

leonidas

Leonidas Este es el repositorio que contiene Leonidas, un framework para ejecutar acciones de atacante en la nube. Proporciona un formato basado en YAML para definir tácticas, técnicas y procedimientos TTPs de atacante en la nube y sus propiedades de detección asociadas. Estas definiciones pueden...

wp-secure-mcp

wp-secure-mcp In plain terms: this lets an AI agent read and lightly write to a WordPress site through a real WordPress Application Password — the same credential type wp-admin already issues — and nothing else. There is no sign-up form, no OAuth client registration, no token endpoint of any kind...

zuthaka

A collaborative free open-source Command & Control integration framework that allows developers to concentrate on the core function and goal of their C2. Explore the docs » · Report Bug · Request Feature · Table of Contents 1. About The Project Problem statement Solution Built With 2. Already...

KoodousFinder

KoodousFinder A simple tool to allows users to search for and analyze android apps for potential security threats and vulnerabilities Account and API Key Create a Koodous account and get your api key https://koodous.com/settings/developers Install $ pip install koodousfinder Arguments Param|...

Exploit for CVE-2026-105844

CVE-2026-105844 — Payload CMS import-export prototype pollutio...

Uchihash

Uchihash Uchihash es una pequeña herramienta que puede ahorrar tiempo a los analistas de malware al manejar valores hash incrustados utilizados para diversas cosas, como: Importación dinámica de APIs especialmente en shellcode Verificación de procesos en ejecución utilizados por analistas...

CVE-2025-0868

Penetration Testing Project Report: Exploiting CVE-2025-0868 DocsGPT RCE via JSON Eval 1. Introduction A critical Remote Code Execution RCE flaw CVE-2025-0868 was disclosed on February 20, 2025, in the open-source DocsGPT library, caused by unsafe use of eval when parsing JSON payloads. Key...

kiterunner

Kiterunner Introduction For the longest of times, content discovery has been focused on finding files and folders. While this approach is effective for legacy web servers that host static files or respond with 3xx’s upon a partial path, it is no longer effective for modern web applications,...

kiterunner

Kiterunner Introducción Durante mucho tiempo, el descubrimiento de contenido se ha centrado en encontrar archivos y carpetas. Si bien este enfoque es efectivo para servidores web heredados que alojan archivos estáticos o responden con 3xx ante una ruta parcial, ya no es efectivo para aplicaciones...

csf

ArmourBird CSF - Container Security Framework Note: The CSF Client is under active development and is getting converted into GoLang for better performace and architecture Table of Contents 1. About 2. Architecture Diagram 3. APIs-CSF Server 4. Installation/Usage 5. Building Docker Images 6. Sneak...

csf

ArmourBird CSF - Marco de Seguridad para Contenedores Nota: El Cliente CSF está en desarrollo activo y se está convirtiendo a GoLang para un mejor rendimiento y arquitectura Tabla de Contenidos 1. Acerca de 2. Diagrama de Arquitectura 3. APIs del Servidor CSF 4. Instalación/Uso 5. Construcción de...

Burp_Collector

Burp Collector Burp Collector es una herramienta multiproceso diseñada específicamente para ayudar a pentesters y cazadores de bugs en pruebas de aplicaciones web/móviles. Con sus potentes capacidades, agiliza el proceso de recopilación y extracción de información de archivos de Burp Suite,...

WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...

attackintel

UPDATE 26 Nov 2018 MITRE has deprecated the ATT&CK API functionality and will soon be phasing it out. They have moved to utilizing STIX. My code will be available for reference but you can check out my ATT&CK Intel webapp which is in the preliminary phases of development and offers the same info...

MSAPer

MSAPer | CVE-2023-3076 - MStore API Automatic Mass Tool for check and exploiting vulnerability in CVE-2023-3076 - MStore API install.sh sha1sum install.sh | grep 12345678 md5sum install.sh sha512sum install.sh bash install.sh How To Use Make sure you already install Parallel! Then do: git clone...

telegram-nearby-map

Telegram Nearby Map Telegram Nearby Map uses OpenStreetMap and the official Telegram library to find the position of nearby users. Please note: Telegram's API was updated a while ago to make nearby user distances less precise, preventing exact location calculations. Therefore, Telegram Nearby Map...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

CVE-2026-107221

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell slice from the last cell in XML document order and then re-scatters every cell by its explicit column reference. GetCellValue reaches workSheetReader and...

SearchOrg

SearchOrg Colocando el dominio de correo electrónico de una empresa se obtiene información usando el DNS, NMAP y Shodan Tener en cuenta En la maquina debe estar instalado NMAP para que pueda usar el comando Se debe tener una cuenta con Shodan y cargar el APIKey donde lo indica el script Configura...