Seth

Seth Seth is a tool written in Python and Bash to MitM RDP connections by attempting to downgrade the connection in order to extract clear text credentials. It was developed to raise awareness and educate about the importance of properly configured RDP connections in the context of pentests,...

Awesome-WAF

Awesome WAF Everything about web application firewalls WAFs from a security perspective. 🔥 Foreword: This was originally my own collection on WAFs. I am open-sourcing it in the hope that it will be useful for pentesters and researchers out there.As the saying goes, "the community just learns from...

titus

Titus: High-Performance Secrets Scanner Titus is a high-performance secrets scanner that detects credentials, API keys, and tokens in source code, files, and git history. It ships with 487 detection rules covering hundreds of services and credential types, drawn from NoseyParker and Kingfisher...

jeremylong__DependencyCheck_CVE-2018-12036_3-1-2

Dependency-Check Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration CPE identifier for a given dependency. If found, it will generate a report linking...

ToolShell-Honeypot

ToolShell-Honeypot SharePoint Zero-Day A Docker-based honeypot focused on detecting and logging exploitation attempts against Microsoft SharePoint zero-day vulnerabilities. This honeypot is designed for early detection and threat intelligence, not for simulating a full SharePoint environment or...

CVE-2025-24659

CVE-2025-24659 1️⃣ Component type WordPress plugin 2️⃣ Component details Component name Premium Packages – Sell Digital Products Securely Vulnerable version Since the Premium Packages plugin is an addon...

mitm-proxy

Go MITM Proxy A lightweight, developer-friendly Man‑in‑the‑Middle MITM HTTP/HTTPS proxy written in Go. It supports HTTP/1.1 and HTTP/2, CONNECT tunneling, WebSocket tunneling ws/wss, on‑disk response caching with flexible filters, and live config reloading. Badges Admin Dashboard Preview Overview...

waf-tester

🛡️ WAF Tester Enterprise WAF Evaluation Tool — Real attack payloads. Real results. Compliance-ready reports. WAF Tester evaluates Web Application Firewalls by sending real attack payloads to a user-supplied URL and reporting whether they are blocked. Available as a Windows desktop app Electron and...

CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - SQL Injection in Institute of Current Students Summary The loginlinkfaculty endpoint in the Institute-of-Current-Students application is vulnerable to SQL Injection via the fid POST parameter. The parameter is not properly sanitized before being used in a SQL query, allowing remo...

bitbang-cli

BitBang CLI bitbang is a single static binary remote-access multitool. From any browser: an interactive shell and file browser access to the remote machine. You can also reach web apps on that machine's network. Beyond the browser, it does TCP port forwarding, file copy, and terminal sharing. It...

Recon

👑 Recon 👑 The step of recognizing a target in both Bug Bounties and Pentest can be very time-consuming. Thinking about it, I decided to create my own recognition script with all the tools I use most in this step. All construction of this framework is based on the methodologies of @ofjaaah and...

CVE-2023-27035

CVE-2023-27035 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Vulnerability type: Incorrect Access Control Description: An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the...

CVE-2026-43499-armv7

CVE-2026-43499 GhostLock — ARM32 Huawei Watch 4 Pro Linux kernel privilege escalation exploit attempt based on CVE-2026-43499 GhostLock — Huawei Watch 4 Pro MDS-AL00, armv7l Project Overview This project is a GhostLock kernel vulnerability exploit attempt targeting the Huawei Watch 4 Pro MDS-AL00...

alterx

AlterX Features • Installation • Usage • Running AlterX • Join Discord Fast and customizable subdomain wordlist generator using DSL. Features Fast and Customizable Automatic word enrichment Pre-defined variables Configurable Patterns Pattern Mining - Automatically discover subdomain patterns Go...

apache__rocketmq_CVE-2023-37582_4-9-6

Apache RocketMQ Developer Guide This guide helps developers to understand and use Apache RocketMQ quickly. 1. Concepts & Features Concept：introduce basic concepts in RocketMQ. Feature：introduce functional features of RocketMQ's implementations. 2. Architecture Design Architecture：introduce...

ctf-party

ctf-party What it is A CLI tool & library to enhance and speed up script/exploit writing for CTF players or security researchers, bug bounty hunters, pentesters but mostly focused on CTF by patching the String class to add a short syntax of usual code patterns. The philosophy is also to keep the...

nuguard

NuGuard Open Source NuGuard is an open source AI application security toolkit. Its goal is to provide the most extensive redteaming and behavioral validation of Agentic AI applications. With NuGuard, AI developers can focus on building their applications while NuGuard continuously tests and...

CVE-2022-0492

CVE-2022-0492 Container Escape Analysis toc Vulnerability Overview Vulnerability ID: CVE-2022-0492 Vulnerable Product: linux kernel - cgroup Affected Versions: linux kernel 5.17-rc3 Vulnerability Impact: When a container does not have additional security measures enabled, an attacker with root...

IPBan

IPBan - Free software to block out attackers quickly and easily on Linux and Windows Helpful Links Get a discount on IPBan Pro by visiting https://ipban.com/upgrade-to-ipban-pro/. Integrate IPBan with IPThreat, a 100% free to use website and service of community submitted bad ip addresses. Help...

EUVD-2026-94651

The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...