acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

noir

Caza cada endpoint en tu código, expone APIs ocultas, mapea la Superficie de Ataque. Documentación • Instalación • Uso • Contribuir • Registro de cambios Noir es una herramienta SAST que lee código fuente y extrae los endpoints que expone una aplicación — rutas, métodos, parámetros, cabeceras,...

zdr

Retención Cero de Datos ZDR para Proveedores de LLM Última actualización: abril de 2026 Una guía práctica para mantener tus datos privados al usar APIs de LLM. Cubre endpoints de retención cero, auto-alojamiento, requisitos de cumplimiento y patrones de protección de datos para ingenieros en...

apicheck

APICheck - El conjunto de herramientas DevSecOps para APIs REST .. image:: https://img.shields.io/badge/License-Apache%202.0-blue.svg :target: https://github.com/BBVA/apicheck/blob/master/LICENSE :alt: Licencia .. image:: https://readthedocs.org/projects/apicheck/badge/?version=latest :target:...

mitmproxy2swagger

mitmproxy2swagger https://user-images.githubusercontent.com/5400940/168086818-c48f60ab-3f95-42eb-b435-c8b1a6326b81.mp4 A tool for automatically converting mitmproxy captures to OpenAPI 3.0 specifications. This means that you can automatically reverse-engineer REST APIs by just running the apps an...

Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restore APIs RCE Poc CVE-2023-50386 Referencias homenaje a los grandes: Blog del autor de la vulnerabilidad CVE-2023-50386 Técnicas de evasión de Java Security Manager Evasión de la protección de reflexión en JDK 17 JNI para evadir RASP Principi...

CVE-2023-2732

CVE-2023-2732 Mstore WordPress APIs Vulnerable Scanner es una herramienta potente y fácil de usar diseñada para identificar posibles vulnerabilidades en sitios de WordPress inspeccionando sus endpoints de API. El escáner tiene como objetivo ayudar a propietarios de sitios web, desarrolladores y...

loupe

Loupe Loupe es una aplicación para iOS y iPadOS que te ofrece un recorrido práctico por la superficie de huellas digitales del dispositivo. Lee valores reales de las API públicas de iOS, las mismas que cualquier aplicación de terceros puede llamar, y te los muestra en crudo. La idea es simple: ve...

uncover

使用多个搜索引擎快速发现互联网上暴露的主机。 功能 • 安装 • 用法 • 配置 • 运行 Uncover • 加入 Discord uncover 是一个 Go 语言封装的工具，利用知名搜索引擎的 API 快速发现互联网上暴露的主机。它专为自动化而设计，因此你可以查询它并将其结果与现有的管道工具一起使用。 功能 同时查询多个搜索引擎 支持的搜索引擎 Shodan Censys FOFA Hunter Quake ZoomEye Netlas CriminalIP PublicWWW HunterHow Google Onyphe Driftnet DayDayMap NerdyData...

uptux

uptux Specialized privilege escalation checks for Linux systems. Implemented so far: Writable systemd paths, services, timers, and socket units Disassembles systemd unit files looking for: References to executables that are writable References to broken symlinks pointing to writeable directories...

sysflow

SysFlow: Cloud-native system telemetry pipeline This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of...

mzap

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...

N-able N-central - Authentication Bypass

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal-only APIs. id: CVE-2026-86207 info: name: N-able N-central - Authentication Bypass author: rapid7,DhiyaneshDk severity: critical description: | An authentication bypass in N-central 2026.3 HF 3 leads to...

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

Vanna - SQL injection

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...

jaeles-signatures

This project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine This repo only contain Default Signatures for Jaeles project. Pull requests or any ideas are welcome. Please read the Official Documentation here for writing your own signature. Installation jaeles config...

netlas-cookbook

Netlas CookBook The goal of this guide is to teach anyone interested in cybersecurity, regardless of their knowledge level, how to make the most of Netlas Search Tools. This is a long read. We have collected as many simple use cases as possible and demonstrated how to automate them. ⭐️ Give us a...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

graphql-cop

GraphQL Cop - Security Audit Utility for GraphQL About GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL. GraphQL Cop allows you ...

proposal-symbol-proto

Mitigación de la contaminación de prototipos / Symbol.proto Autores : Santiago Díaz Google Champion : Shu-yu Guo Google Etapa : 1 Índice Descripción del problema Acción fantasmagórica a distancia Ataques solo de datos Problemas con freeze, seal y preventExtensions El error de sobrescritura...