mitm-proxy

Go MITM Proxy A lightweight, developer-friendly Man‑in‑the‑Middle MITM HTTP/HTTPS proxy written in Go. It supports HTTP/1.1 and HTTP/2, CONNECT tunneling, WebSocket tunneling ws/wss, on‑disk response caching with flexible filters, and live config reloading. Badges Admin Dashboard Preview Overview...

slither-mcp

Slither MCP Server A Model Context Protocol MCP server that provides static analysis capabilities for Solidity smart contracts using Slither. Overview This MCP server wraps Slither static analysis functionality, making it accessible through the Model Context Protocol. It can analyze Solidity...

galah

TL;DR: Galah /ɡəˈlɑː/ - pronunciado ‘guh-laa’ es un honeypot web basado en LLM diseñado para imitar diversas aplicaciones y responder dinámicamente a peticiones HTTP arbitrarias. Galah es compatible con los principales proveedores de LLM, incluyendo OpenAI, GoogleAI, Vertex AI de GCP, Anthropic,...

proxy

git-pkgs proxy A caching proxy for package registries. Speeds up package downloads by caching artifacts locally, reducing bandwidth usage and improving reliability. Version Cooldown Most supply chain attacks rely on speed: a malicious version gets published and consumed by automated pipelines...

thethe

El Entorno de Caza de Amenazas Eres un Cazador de Amenazas. Mientras investigas, ¿te has encontrado con más de 20 pestañas abiertas en tu navegador, archivos .txt dispersos con datos y algunas terminales mostrándose en segundo plano? theTHE centraliza toda la información de una investigación en u...

ExtendedMacro

ExtendedMacro ExtendedMacro es un complemento para el proxy de BurpSuite. Proporciona una funcionalidad similar pero extendida de la función de Macro de BurpSuite. La funcionalidad principal es que puedes activar una o más solicitudes antes de cada solicitud activada desde Intruder, Repeater,...

WordPress Varnish/Nginx Proxy Caching <= 1.8.3 - Information Exposure

Razvan Stanga Varnish/Nginx Proxy Caching = 1.8.3 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve sensitive information, exploit requires crafted requests. id: CVE-2025-62126 info: name:...

staekka

Stækka Metasploit - Extendiendo Metasploit Este plugin Msf extiende Metasploit con algunas características y módulos faltantes, permitiendo la interacción con otros exploits/formas de obtener acceso a la shell. El enfoque actual está en el soporte para Linux/Unix. Características principales...

Heartbleed

El servidor de pruebas Heartbleed. Con almacenamiento en caché de Mozilla. Instala el archivo SAMPLE.aws-config.json como /.aws-config.json o /etc/aws-config.json, o en una ruta especificada por la variable de entorno GODYNAMOCONFFILE. root@kitploit: Usage: HBserver --redir-host= --listen=...

CVE-2016-2569

Hola, Gracias por leer mi primera entrada en el blog. Hoy vamos a crear un exploit para una de las herramientas de código abierto, el servidor proxy de caché Squid. ¿Qué es Squido? Squid es un proxy de caché para la Web que soporta HTTP, HTTPS, FTP y más. Reduce el ancho de banda y mejora los...

CVE-2017-7529-POC

CVE-2017-7529-POC Descripción de la vulnerabilidad Esta vulnerabilidad afecta a todas las versiones de Nginx entre la 0.5.6 y la 1.13.2 que tengan activado el módulo de configuración por defecto. Basta con que el servidor tenga habilitado el almacenamiento en caché para que un atacante pueda envi...

jwt-reauth

JWT Re-auth Burp plugin to cache authentication tokens from an "auth" URL, and then add them as headers on all requests going to a certain scope. Features The plugin allows settings to be sent to it via context menus from various menus. This includes using an entire captured request to acquire ne...

wa-tunnel

wa-tunnel - TCP Tunneling through Whatsapp This is a Baileys based piece of code that lets you tunnel TCP data through two Whatsapp accounts. This can be usable in different situations, for example network carriers that give unlimited whatsapp data or airplanes where you also get unlimited social...

wa-tunnel

wa-tunnel - Whatsapp를 통한 TCP 터널링 이는 Baileys를 기반으로 한 코드로, 두 개의 Whatsapp 계정을 통해 TCP 데이터를 터널링할 수 있습니다. 이것은 다양한 상황에서 사용할 수 있습니다. 예를 들어, 무제한 Whatsapp 데이터를 제공하는 네트워크 통신사나 무제한 소셜 네트워크 데이터를 제공하는 비행기 등에서 사용할 수 있습니다. WS 기반 멀티 디바이스 Whatsapp 라이브러리인 Baileys를 사용하므로, 예를 들어 Termux를 사용하여 향후 안드로이드에서도 사용할 수 있습니다...

qpid-proton-j: Apache Qpid Proton-J: Denial of Service via unbounded symbol value caching

A flaw was found in Apache Qpid Proton-J. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service DoS. A denial ...

Remote-Desktop-Caching-

Remote-Desktop-Caching- Esta herramienta permite recuperar información de sesiones RDP mstsc antiguas en forma de archivos PNG rotos. Estos archivos PNG permiten a los miembros del Red Team extraer información jugosa como contraseñas de LAPS o cualquier información sensible en la pantalla. Los...

CVE-2017-7529

Nginx Integer Overflow Vulnerability CVE-2017-7529 Vulnerability Information When using the nginx standard module, an attacker can obtain cache file header information in the response by sending a header request containing a maliciously crafted range field. In certain configurations, the cache fi...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CVE-2026-14666

A flaw in PostgreSQL allows users to bypass row-level security RLS due to incomplete tracking of user role and database ownership changes. Active sessions may continue using cached, outdated security policies, enabling unauthorized read or write access to data. Exploitation requires the attacker ...

dompdf-rce

dompdf용 RCE 익스플로잇 이 저장소는 dompdf 1.2.0을 사용하는 취약한 데모 애플리케이션과 ttf+php 폴리글롯 파일을 통한 원격 코드 실행을 달성하는 익스플로잇을 포함하고 있습니다. 자세한 내용은 https://positive.security/blog/dompdf-rce를 방문하세요. 지침 1. 데모 애플리케이션 실행 root@kitploit: $ cd application $ php -S localhost:9000 2. 익스플로잇 서버 실행 root@kitploit: $ cd exploit $ php -S...