s3dns

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

gobuster

Gobuster 💻 Introduction A fast and flexible brute-forcing tool written in Go Gobuster is a high-performance directory/file, DNS and virtual host brute-forcing tool written in Go. It's designed to be fast, reliable, and easy to use for security professionals and penetration testers. ✨ Features 🚀...

SubDomainizer

Buy Me A Coffee SubDomainizer SubDomainizer is a tool designed to find hidden subdomains and secrets present is either webpage, Github, and external javascripts present in the given URL. This tool also finds S3 buckets, cloudfront URL's and more from those JS files which could be interesting like...

S3Scanner

S3Scanner Features - Usage - Quick Start - Installation - Discuss A tool to find open S3 buckets in AWS or other cloud providers: AWS DigitalOcean DreamHost GCP Linode Scaleway Custom Features ⚡️ Multi-threaded scanning 🔭 Supports many built-in S3 storage providers or custom 🕵️‍♀️ Scans all...

dumper

About Dumper This is a CLI utility for creating backups databases of various types with flexible connection and storage settings. Opportunities: Multiple database systems can be managed. Support PostgreSQL , MySQL , MongoDB and etc. Work with SSH-Keys include passphrase. Custom dump name template...

DoodleCloud

DoodleCloud ☁️ Turn Instagram into your personal, infinite cloud storage. DoodleCloud is a Proof-of-Concept PoC tool that uses Instagram's internal API to store unlimited files for free. By converting files into "Visual Noise" images and uploading them as DM doodles, we can bypass file type...

CVE-2026-94204

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, a...

CVE-2026-96587

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries...

CVE-2026-96587

The Viidure Dashcam Android application contains a critical vulnerability where permanent, plaintext cloud storage credentials are embedded within its compiled code. This flaw allows unauthorized entities to gain full access to critical platform storage, enabling them to read, modify, or delete o...

EUVD-2026-89458

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries...

CVE-2026-94204

The Viidure Dashcam Android Application suffers from a critical misconfiguration where the central cloud storage backend is assigned public-read permissions . This flaw allows anyone on the internet unrestricted access to the shared storage bucket, exposing sensitive user records , live dashcam f...

lazywarden

安全、自动化、多云 Bitwarden 备份与导入系统 Lazywarden 是一个 Python 自动化工具，用于备份和恢复你的密码库数据，包括 Bitwarden 附件。它允许你将备份上传到多个云存储服务，并在多个平台上接收通知。它还提供 AES 加密备份，并使用 Argon2 进行密钥衍生，确保数据最高安全性。 功能 🔒 最高安全性： 使用 AES-256 加密和 Argon2 密钥衍生保护数据。 🔄 自动备份与导入： 保持 Bitwarden 密码库最新且安全。 ✅ 完整性验证： SHA-256 哈希确保每次备份的数据完整性。 ☁️ 多云支持： 将备份存储到...

restic

Introducción restic es un programa de copias de seguridad rápido, eficiente y seguro. Es compatible con los tres sistemas operativos principales Linux, macOS, Windows y algunos otros más pequeños FreeBSD, OpenBSD. Para instrucciones detalladas de uso e instalación, consulta la documentación. Pued...

covert-control

covert-control 通过将文件上传到 Google Drive、OneDrive、Youtube 或 Telegram 来远程控制系统，使用 Python 创建文件及监听器。支持创建文本文件、图像、音频或视频，命令可使用明文或 AES 加密。 covert-googledrive.py - 将文件上传至 Google Drive 的公共文件夹，控制系统。 covert-onedrive.py - 将文件上传至 OneDrive 的公共文件夹，控制系统。 covert-youtube.py - 将视频上传至 Youtube，控制系统（从 covert-tube 更新）。...

cve-2025-0364

CVE-2025-0364: BigAntSoft BigAnt Server Omisión de Registro de Cuenta a RCE por Subida de Archivos El BigAntSoft BigAnt Server, que proporciona un servidor de chat local alojado en Windows y orientado a casos de uso empresarial, es vulnerable a la ejecución remota de código sin autenticación...

CVE-2026-63373: Cross-Site Request Forgery (CSRF)

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. A...

s3dns v0.2.30

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

EUVD-2026-78210

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...

CVE-2026-91201 DocsGPT through 0.20.0 OAuth Token Disclosure via Wildcard postMessage

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to...