laravel-threat-detection

Laravel Threat Detection 面向 Laravel 的安全监控与攻击日志记录。检测并记录 SQL 注入、 XSS、RCE、目录遍历、机器人扫描器以及/wp-admin 风格的侦察探测—— 每个恶意请求都会连同完整的应用上下文记录到你的数据库中。 它是 IDS，不是 WAF：它从不拦截、过滤或修改请求。 你是因为看到类似这样的东西才来到这里的吗？ GET /wp-admin/setup-config.php 404 — on a site that isn't WordPress GET /.env 404 — someone wants your database...

phantomstars

phantomstars Detección y seguimiento automatizado de interacciones falsas en GitHub Un proyecto de JS Labs — parte de la iniciativa AI Slop Intelligence. Se ejecuta cada día. Puntúa cada cuenta sospechosa. Detecta campañas coordinadas de bots. Abre issues directamente en repositorios comprometido...

px-vm

PerimeterX Auditor VM 分析 摘要 本仓库记录了 PerimeterX 的 auditor.js 的反向工程结果，该文件是一个字节码虚拟机，用作 PX 机器人检测管道中的二级指纹识别层。本分析涵盖以下内容： 字节码提取与五层解密管道 操作码表重建（107 个基本操作码 + 40 个蜜罐操作码 + 24 个填充操作码 + 16 个超级指令组） 常量池解密（1230 个条目，1095 个加密字符串） 基于 CFG 的反汇编器，支持超级指令子分派解析 堆栈模拟清理器，生成可读的伪代码 反分析技术：蜜罐操作码、重叠指令、代码完整性哈希 注意： 本仓库仅涵盖一个（静态）VM...

noapi-google-search-mcp

noapi-google-search-mcp [email protected] Si quieres apoyar noapi-google-mcp o gpt-oss-20B/120B-Vision y otros modelos de código abierto en desarrollo, por favor contribuye a mi fondo de cómputo en GPU: se necesitan alrededor de $3000. Si encuentras esto útil, considera apoyar el desarrollo...

invisible_playwright

Playwright gets caught by anti-bots and captchas. This one runs on an anti-detect Firefox with an undetected fingerprint, compatible with your existing Playwright code. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the answers. invisibleplaywrigh...

pstf2

pstf^2 被动安全工具指纹识别框架 你是否曾想要一种简单、轻松且隐秘的方法来绕过多种安全产品？pstf^2（读作 pstf-square）是一个基于 HTTP 服务器的被动浏览器指纹识别实现——它可能正是你寻找的工具。 当攻击者试图通过互联网传递有效载荷时，他们需要克服多种能够扫描传入链接的工具。邮件过滤器、扫描引擎，甚至通过 URL 提交到沙箱——一旦 pstf2 以被动方式检测到它们，所有这些都可以被绕过。检测到后，该工具可以区分安全服务与潜在受害者，并传递恶意或良性响应。 该工具已在 2020 年欧洲黑帽大会上发布：...

fortress

One browser engine to rule them all Stealth Chromium engine...

uncaptcha

uncaptcha 以 85% 的准确率击败 Google 的音频 reCaptcha 系统。 免责声明 unCaptcha 旨在成为一个概念验证 。截至我们的论文发表时，我们发现它成功解决了 reCaptcha 音频挑战的 85%。自那以后，reCaptcha 似乎加入了一些额外的保护措施，限制了 unCaptcha 的成功率。 我们不会维护此代码以使其成为对 reCaptcha 的有效攻击。 例如，Google 也改进了其浏览器自动化检测。这意味着在当前状态下，Selenium 无法用于从 Google 获取验证码。这可能导致 Google...

nodriver

NODRIVER nodriver ofrece una biblioteca de automatización de navegador y webscraping asíncrona de siguiente nivel para python, con una interfaz fácil que simplemente tiene sentido ™ Este es el sucesor oficial del Undetected-Chromedriver paquete de python. No más webdriver, no más selenium para...

impersonate-proxy

impersonate-proxy English | 日本語 | 简体中文 A local MITM proxy that lets you control TLS fingerprints JA3/JA4, HTTP/2 fingerprints, HTTP header order, User-Agent, and source IP headers — all from a single YAML config file. A Chrome extension is included for toggling the proxy and switching fingerprint...

vi-bot

BotDetect v2 — 生产环境机器人检测库 客户端机器人与自动化检测库，具备加权评分、行为分析、浏览器指纹识别及可配置阈值。可检测无头浏览器、Selenium、Puppeteer、Playwright、基于CDP的工具以及隐身自动化框架。 v2.1.0 — 反检测蜜罐、GPU稳定的Canvas指纹识别、增强的行为分析、惰性初始化、服务端篡改检测、请求指纹绑定及速率限制。 目录 功能特性 架构 快速开始 客户端 API 服务端集成 检测模块 配置 生产环境检查清单 测试 功能特性 28 个检测模块 ，覆盖自动化框架、无头浏览器、指纹识别、行为分析、蜜罐及堆栈跟踪陷阱 加权评分系统 ...

CVE-2026-93984: Improper Authentication

OpenPanel tracking API through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypas...

invisible_playwright v0.20.0

Playwright gets caught by anti-bots and captchas. This one runs on an anti-detect Firefox with an undetected fingerprint, compatible with your existing Playwright code. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the answers. invisibleplaywrigh...

invisible_playwright v0.7.2

Playwright gets caught by anti-bots and captchas. This one runs on an anti-detect Firefox with an undetected fingerprint, compatible with your existing Playwright code. How it works Anti-bots ask two questions, and reCAPTCHA, hCaptcha and Cloudflare Turnstile score the answers. invisibleplaywrigh...

EUVD-2026-68230

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

PT-2026-83570

WWBN AVideo current e01e41ecc and earlier contains a brute-force rate limiting bypass in enforceRateLimit, which protects login.json.php and 13 other endpoints. The function stores its attempt counter via a cache layer ObjectYPT::setCacheGlobal that silently discards writes for any client...

TCGuard

TCGuard — Universal Crash, Exploit, Packet & Anti-Bot Protecti...

Optimal Transport-Guided Adversarial Attacks on Graph Neural Network-Based Bot Detection

The rise of bot accounts on social media poses significant risks to public discourse. To address this threat, modern bot detectors increasingly rely on Graph Neural Networks GNNs. However, the effectiveness of these GNN-based detectors in real-world settings remains poorly understood. In practice...

Why Legitimate Bot Traffic Is a Growing Security Blind Spot

Security teams have spent years improving their ability to detect and block malicious bots. That effort remains critical.…...

CAHICHA: Computer Automated Hardware Interaction Test to Tell Computer and Humans Apart

As automation bot technology and Artificial Intelligence is evolving rapidly, conventional human verification techniques like voice CAPTCHAs and knowledge-based authentication are becoming less effective. Bots and scrapers with Artificial Intelligence AI capabilities can now detect and solve visu...