GHunt

🌐 GHunt Online version : https://osint.industries 🐍 Now Python 3.13 compatible ! 😊 Description GHunt v2 is an offensive Google framework, designed to evolve efficiently. It's currently focused on OSINT, but any use related with Google is possible. Features : CLI usage and modules Python library...

evilginx

Evilginx v.1.1.0 THIS VERSION IS OBSOLETE. PLEASE USE THE LATEST VERSION! EVILGINX 2:https://github.com/kgretzky/evilginx2 Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

ghauri

Like Ghauri, consider supporting the developer Ghauri An advanced cross-platform tool that automates the process of detecting and exploiting SQL injection security flaws. Requirements Python 3 Python pip3 Installation cd to ghauri directory. install requirements: python3 -m pip install --upgrade ...

chromecookiestealer

Chrome Cookie Stealer and injector Attaches to Chrome using its Remote DevTools protocol and steals/injects/clears/deletes cookies. Heavily inspired by WhiteChocolateMacademiaNut. Cookies are dumped as JSON objects using Chrome's own format. The same format is used for cookies to be loaded. For...

chlonium

Chlonium Chlonium is an application designed for cloning Chromium Cookies. From Chromium 80 and upwards, cookies are encrypted using AES-256 GCM, with a state key which is stored in the Local State file. This state key is encrypted using DPAPI. This is a change from older versions, which used DPA...

authz0

Authz0 is an automated authorization test tool. Unauthorized access can be identified based on URLs and Roles & Credentials. URLs and Roles are managed as YAML-based templates, which can be automatically created and added through authz0. You can also test based on multiple authentication headers...

EUVD-2026-90973

Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path...

cookie-monster

Cookie-Monster-BOF Steal browser cookies for edge, chrome and firefox through a BOF! Cookie Monster BOF will extract the WebKit Master Key and the App Bound Encryption Key for both Edge and Chrome, locate a browser process with a handle to the Cookies and Login Data files, copy the handles and th...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

evilginx2

Evilginx 3.0 Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows to bypass 2-factor authentication protection. This tool is a successor to Evilginx, released in 2017, which used a custom version of nginx HTTP server...

cookie_crimes

Chrome Cookie Extraction Without Root This will print out a user's Chrome cookies. You don't need to have their password or be root to use it. nice nice nice nice nice. If you are not the kind of person who regularly gets the ability to execute code on other people's computers, you probably don't...

CVE-2024-42658

CVE-2024-42658 CVE-2024-42658 wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0의 문제로, 원격 공격자가 cookies 매개변수를 통해 민감한 정보를 획득할 수 있습니다. CVE-2024-42658: 요약: wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0의 취약점으로 인해 인증되지 않은 원격 공격자가 쿠키 조작을 통해 민감한 정보를 획득할 수 있습니다. 이 문제는 쿠키에 대한 보안 조치가 충분하지 않아 발생하며, 민감한 정보...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

wafpass

WAFPASS ██╗ ██╗ █████╗ ███████╗██████╗ █████╗ ███████╗███████╗ ██║ ██║██╔══██╗██╔════╝██╔══██╗██╔══██╗██╔════╝██╔════╝ ██║ █╗ ██║███████║█████╗ ██████╔╝███████║███████╗███████╗ ██║███╗██║██╔══██║██╔══╝ ██╔═══╝ ██╔══██║╚════██║╚════██║ ╚███╔███╔╝██║ ██║██║ ██║ ██║ ██║███████║███████║ ╚══╝╚══╝ ╚═╝...

CVE-2025-51529

CVE-2025-51529: WordPress Cookies and Content Security Policy 플러그인 DoS 취약점 wpajaxnoprivcacspinsertconsentdata 엔드포인트로의 무제한 데이터베이스 쓰기 작업을 통해 jonkastonka Cookies and Content Security Policy 플러그인 버전 2.29까지의 AJAX 엔드포인트 기능 내 잘못된 접근 제어로 인해 원격 공격자가 서비스 거부데이터베이스 서버 리소스 고갈를 일으킬 수 있습니다. 취약점은...

filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

rbuster

Rbuster yet another dirbuster Common Command line options -a - specify a user agent string to send in the request -c - use this to specify any cookies that you might need simulating auth. header. -f - force processing of a domain with wildcard results. -l - show the length of the response. -r...

SetCookieAnalysisInBrowsers

브라우저에서의 쿠키 설정 분석 라이선스 AGPL 라이선스로 배포됩니다자세한 내용은 LICENSE 참조. 설명 자세한 내용은 다음 블로그 게시물을 참조하세요: https://www.nccgroup.com/en/blog/2015/01/analysis-of-setting-cookies-for-third-party-websites-in-different-browsers/ 사용법 "victimsite" 디렉터리는 ASPX를 지원하는 서버에 복사해야 합니다cookiemanager.aspx가 PHP로 다시 작성되지 않은 경우. 이 URL은...

badsecrets

badsecrets 알려져 있거나 매우 약한 암호화 비밀을 다양한 플랫폼에서 식별하기 위한 순수 파이썬 라이브러리입니다. 이 프로젝트는 다양한 "알려진 비밀"예: 튜토리얼 예제에서 발견된 ASP.NET 머신 키의 저장소 역할을 하면서, 이를 식별하기 위한 언어에 구애받지 않는 추상화 계층을 제공하도록 설계되었습니다. '잘못된 비밀'이 사용되었는지 알 수 있는 방법은 일반적으로 해당 비밀이 사용된 암호화 결과물예: 키 해시 알고리즘으로 서명된 쿠키을 검사하는 것입니다. 각 플랫폼이 제공하는 개별 구현 특이점을 깊이 파고들면 복잡...