mzap

mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...

jaeles

!IMPORTANT This repository has been archived and is no longer maintained. Check out github.com/vigolium/vigolium — a brand new scanner that I made that's better in every way. Jaeles is a powerful, flexible and easily extensible framework written in Go for building your own Web Application Scanner...

graphql-cop

GraphQL Cop - Security Audit Utility for GraphQL About GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL. GraphQL Cop allows you ...

uptux

uptux Specialized privilege escalation checks for Linux systems. Implemented so far: Writable systemd paths, services, timers, and socket units Disassembles systemd unit files looking for: References to executables that are writable References to broken symlinks pointing to writeable directories...

sysflow

SysFlow: Cloud-native system telemetry pipeline This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of...

mitmproxy2swagger

mitmproxy2swagger https://user-images.githubusercontent.com/5400940/168086818-c48f60ab-3f95-42eb-b435-c8b1a6326b81.mp4 A tool for automatically converting mitmproxy captures to OpenAPI 3.0 specifications. This means that you can automatically reverse-engineer REST APIs by just running the apps an...

netlas-cookbook

Netlas CookBook The goal of this guide is to teach anyone interested in cybersecurity, regardless of their knowledge level, how to make the most of Netlas Search Tools. This is a long read. We have collected as many simple use cases as possible and demonstrated how to automate them. ⭐️ Give us a...

uncover

Быстрое обнаружение открытых хостов в интернете с помощью нескольких поисковых систем. Возможности • Установка • Использование • Конфигурация • Запуск Uncover • Присоединиться в Discord uncover — это обёртка на Go, использующая API известных поисковых систем для быстрого обнаружения открытых хост...

apicheck

APICheck - Набор инструментов DevSecOps для REST API .. image:: https://img.shields.io/badge/License-Apache%202.0-blue.svg :target: https://github.com/BBVA/apicheck/blob/master/LICENSE :alt: License .. image:: https://readthedocs.org/projects/apicheck/badge/?version=latest :target:...

loupe

Loupe Loupe는 기기 지문 수집 표면fingerprinting surface을 직접 체험해 볼 수 있는 iOS 및 iPadOS 앱입니다. 공개 iOS API타사 앱이라면 누구나 호출할 수 있는 API에서 실제 값을 읽어 원시 상태 그대로 보여줍니다. 핵심은 간단합니다. iPhone이 조용히 노출하는 정보를 확인하고, 각 값이 왜 앱이 사용자를 다시 알아보는 데 도움이 되는지 이해하는 것입니다. 트래커는 온라인에서 사용자를 알아보기 위해 이름, 이메일, 위치 정보가 필요하지 않습니다. 각 값 자체는 반드시 고유하지 않을 ...

acheron

About Acheron is a library inspired by SysWhisper3/FreshyCalls/RecycledGate, with most of the functionality implemented in Go assembly. acheron package can be used to add indirect syscall capabilities to your Golang tradecraft, to bypass AV/EDRs that makes use of usermode hooks and instrumentatio...

Apache-Solr-RCE_CVE-2023-50386_POC

Apache-Solr-RCECVE-2023-50386POC Apache Solr Backup/Restore APIs RCE Poc CVE-2023-50386 Ссылки с уважением к dalao: Блог автора уязвимости CVE-2023-50386 Методы обхода Java Security Manager Обход защиты рефлексии в JDK 17 JNI обход RASP Принцип эксплуатации и размышления:...

noir

Охотьтесь за каждой конечной точкой в вашем коде, обнаруживайте теневые API, картирование поверхности атаки. Документация • Установка • Использование • Вклад • История изменений Noir — это инструмент SAST, который читает исходный код и извлекает конечные точки, которые приложение предоставляет —...

CVE-2023-2732

CVE-2023-2732 Mstore WordPress APIs Vulnerable Scanner — это мощный и удобный инструмент, предназначенный для выявления потенциальных уязвимостей на сайтах WordPress путем проверки их API-конечных точек. Сканер предназначен для помощи владельцам сайтов, разработчикам и специалистам по безопасност...

zdr

Нулевое удержание данных ZDR для LLM-провайдеров Последнее обновление: Апрель 2026 года Практическое руководство по сохранению конфиденциальности ваших данных при использовании LLM API. Охватывает точки без сохранения данных, самостоятельное развертывание, требования соответствия и шаблоны защиты...

printix-CVE-2022-29552

CVE-2022-29552 Простой выпуск | Версия для печати Уязвимость "Incorrect Use of Privileged APIs" в PrintixService.exe, в "Printix Secure Cloud Print Management" от Kofax Printix, версии 1.3.1156.0 и ниже, позволяет локальному или удаленному злоумышленнику изменять любые значения в...

CyberPower - Missing Authentication

An issue regarding missing authentication for certain utilities exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32735 info: name: CyberPower - Missing Authentication author: DhiyaneshDK severity: critical description: | An issue regarding missing authentication for certai...

N-able N-central - Authentication Bypass

An authentication bypass in N-central 2026.3 HF 3 leads to authentication bypass in internal-only APIs. id: CVE-2026-86207 info: name: N-able N-central - Authentication Bypass author: rapid7,DhiyaneshDk severity: critical description: | An authentication bypass in N-central 2026.3 HF 3 leads to...

Vanna - SQL injection

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...

proposal-symbol-proto

프로토타입 오염 완화 / Symbol.proto 작성자 : Santiago Díaz Google 챔피언 : Shu-yu Guo Google 단계 : 1 목차 문제 설명 유령 같은 원격 작용 데이터 전용 공격 freeze, seal, preventExtensions의 문제점 오버라이드 실수 거친 세분성 동결 시점 애플리케이션 유형 제안 해결책 리플렉션 API 제공 옵트인 기능 자동 리팩터링 삭제란 무엇을 의미하는가? 호환되지 않는 코드베이스 부록 constructor 오염은 어떨까? 축소된 JS에서의 계산된 접근...