BFuzz

BFuzz root@kitploit: BFuzz is currently in beta. BFuzz es una herramienta de fuzzing basada en entrada que toma un .html como entrada, abre tu navegador con una nueva instancia y pasa múltiples casos de prueba generados por domato que se encuentran en la carpeta recurve de BFuzz. Además, BFuzz es...

Firefox-Security-Toolkit

Firefox Security Toolkit Una herramienta que transforma los navegadores Firefox en un conjunto de pruebas de penetración ¿Cómo? Descarga las extensiones más importantes y las instala en tu navegador. Las extensiones utilizadas han sido seleccionadas mediante una encuesta entre la comunidad de...

libretto

Libretto Libretto es un conjunto de herramientas para construir integraciones web robustas. Le proporciona a tu agente de codificación un navegador en vivo y una CLI eficiente en tokens para: Inspeccionar páginas en vivo con mínimo overhead de contexto Capturar tráfico de red para realizar...

firefox-devtools-mcp

Firefox DevTools MCP Model Context Protocol server for automating Firefox via WebDriver BiDi through Selenium WebDriver. Works with Claude Code, Claude Desktop, Cursor, Cline and other MCP clients. Repository: https://github.com/mozilla/firefox-devtools-mcp Note : This MCP server requires a local...

ai-captcha-bypass

AI-Powered CAPTCHA Solver This project is a Python-based command-line tool that uses large multimodal models LMMs like OpenAI's GPT-4o and Google's Gemini to automatically solve various types of CAPTCHAs. It leverages Selenium for web browser automation to interact with web pages and solve CAPTCH...

yappy

Yappy 🐶 Asistente de participación en LinkedIn impulsado por IA. Descubre automáticamente publicaciones de LinkedIn y deja comentarios reflexivos, únicos y generados por IA que realmente suenan como tú. Yappy es una potente herramienta de terminal que utiliza Google's Gemini AI y la automatizació...

EasySpider

EasySpider: Rastreador Web Visual sin Código Un software de automatización de navegador, recolección de datos/rastreador web completamente gratuito incluyendo uso comercial y desarrollo secundario que permite diseñar y ejecutar tareas de forma visual sin código. Solo necesita seleccionar el...

uncaptcha

uncaptcha Defeating Google's audio reCaptcha system with 85% accuracy. Disclaimer unCaptcha is intended to be a proof of concept. As of the time of our paper, we found it to successfully solve reCaptcha's audio challenges with 85% success. Since that time, reCaptcha appears to include some...

ReelPhish

Instrucciones para ReelPhish: Esta herramienta ha sido publicada junto con una publicación en el blog de FireEye. La publicación se puede encontrar en el siguiente enlace: https://www.fireeye.com/blog/threat-research/2018/02/reelphish-real-time-two-factor-phishing-tool.html Pasos de instalación 1...

skyvern

🐉 Automate Browser-based workflows using LLMs and Computer Vision 🐉...

skyvern

🐉 Automatiza flujos de trabajo basados en navegador usando LLMs y Visión por Computadora 🐉...

nodriver

NODRIVER nodriver ofrece una biblioteca de automatización de navegador y webscraping asíncrona de siguiente nivel para python, con una interfaz fácil que simplemente tiene sentido ™ Este es el sucesor oficial del Undetected-Chromedriver paquete de python. No más webdriver, no más selenium para...

Dorkwright

Dorkwright - Google Dorking Tool Dorkwright is a powerful Python-based Google dorking utility that automates the extraction of file links from Google search results and optionally downloads them. It uses Playwright for browser automation and includes CAPTCHA handling, progress indicators, and a...

rebrowser-patches

🪄 Patches for undetectable browser automation This repo contains patches to enhance popular web automation libraries. Specifically, it targets the puppeteer and playwright packages. Some aspects of automation libraries or browser behavior cannot be adjusted through settings or command-line...

PYSEC-2026-3886 PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summarypraisonai/browser/server.py validates incoming WebSocket connections using a Chromeextension Origin check. The regex chrome-extension://a-z0-932 is applied withre.match, which only anchors at the start of the string, not the end. Any Originheader with more than 32 alphanumeric characters...

patchright v1.63.0

🎭 Patchright Patchright is a patched and undetected version of the Playwright Testing and Automation Framework. It can be used as a drop-in replacement for Playwright. !NOTE This repository serves the Patchright Driver. To use Patchright, check out the Python Package, the NodeJS Package or the...

PraisonAI has a Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

Summary praisonai/browser/server.py validates incoming WebSocket connections using a Chrome extension Origin check. The regex chrome-extension://a-z0-932 is applied with re.match, which only anchors at the start of the string, not the end. Any Origin header with more than 32 alphanumeric characte...

CVE-2026-55536 Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, Browser Server handleconnection checks Chrome extension origins with re.match and the unanchored expression chrome-extension://a-z0-932. Extra trailing characters pass before websocket.accept, allowing startsession commands and...

PT-2026-81347

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The Browser Server contains an authentication bypass in the handle connection function. The server validates incoming WebSocket connections by checking the Chrome extension origin using re.match...