255 matches found
paskto
Paskto - Passive Web Scanner Paskto will passively scan the web using the Common Crawl internet index either by downloading the indexes on request or parsing data from your local system. URLs are then processed through Nikto and known URL lists to identify interesting content. Hash signatures are...
xurlfind3r
xurlfind3r xurlfind3r is a command-line utility designed to discover URLs for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly...
urx
Extracts URLs from OSINT Archives for Security Insights. Urx is a command-line tool designed for collecting URLs from OSINT archives, such as the Wayback Machine and Common Crawl. Built with Rust for efficiency, it leverages asynchronous processing to rapidly query multiple data sources. This too...
katana
A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...
cariddi
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more Coded with 💙 by edoardottt Share on Twitter! Install • Usage • Get Started • Changelog • Contributing • License Installation 📡 Homebrew root@kitploit: brew install cariddi Snap...
domdig
DOMDig DOMDig는 Chromium 웹 브라우저 내에서 실행되는 DOM XSS 스캐너이며, 단일 페이지 애플리케이션SPA을 재귀적으로 스캔할 수 있습니다. 다른 스캐너와 달리, DOMDig는 DOM 수정 및 XHR/fetch/websocket 요청을 추적하여 모든 웹 애플리케이션gmail 포함을 크롤링할 수 있으며, 이벤트를 발생시켜 실제 사용자 상호작용을 시뮬레이션할 수 있습니다. 이 과정에서 XSS 페이로드가 입력 필드에 입력되고 실행이 추적되어 주입 지점과 관련 URL 변경 사항을 찾습니다. htcrawl 기반으로...
jshole
jshole A simple JavaScript components vulnrability scanner, based on RetireJS. Why use JShole instead of RetireJS? By default, RetireJS only searches one page, but JShole tries to crawl all pages. Get Started Requirements requests Install git clone https://github.com/callforpapers-source/jshole.g...
gau
getallurls gau getallurls gau는 주어진 도메인에 대해 AlienVault의 Open Threat Exchange, Wayback Machine, Common Crawl 및 URLScan에서 알려진 URL을 가져옵니다. Tomnomnom의 waybackurls에서 영감을 받았습니다. 리소스 사용법 설치 ohmyzsh 참고 사용법: 예시: root@kitploit: $ printf example.com | gau $ cat domains.txt | gau --threads 5 $ gau example.com...
warcannon
WARCannon - Catastrophically powerful parallel WARC processing WARCannon was built to simplify and cheapify the process of 'grepping the internet'. With WARCannon, you can: Build and test regex patterns against real Common Crawl data Easily load Common Crawl datasets for parallel processing Scale...
warcannon
WARCannon - 엄청나게 강력한 병렬 WARC 처리 WARCannon은 '인터넷을 grep하는' 과정을 단순화하고 저렴화하기 위해 만들어졌습니다. WARCannon을 사용하면 다음을 수행할 수 있습니다: 실제 Common Crawl 데이터에 대해 정규식 패턴을 구축하고 테스트 병렬 처리를 위해 Common Crawl 데이터셋을 쉽게 로드 사실상 비현실적인 용량으로 비동기적으로 WARCs를 처리하도록 컴퓨팅 기능 확장 결과 저장 및 쉬운 검색 작동 방식 WARCannon은 AWS 기술을 영리하게 활용하여 수평적으로 모든...
galer
galer root@kitploit: /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 A fast tool to fetch URLs from HTML attributes by crawl-in. Inspired by the @omespino Tweet, which is possible to extract src, href, url and action values by evaluating JavaScript through Chrome DevTools Protocol...
paskto
Paskto - 수동 웹 스캐너 Paskto는 Common Crawl 인터넷 인덱스를 사용하여 웹을 수동으로 스캔합니다. 인덱스를 요청 시 다운로드하거나 로컬 시스템에서 데이터를 파싱하는 방식으로 작동합니다. URL은 Nikto 및 알려진 URL 목록을 통해 처리되어 흥미로운 콘텐츠를 식별합니다. 해시 시그니처는 일부 IoT 장치나 웹 애플리케이션의 알려진 기본 콘텐츠를 식별하는 데에도 사용됩니다. root@kitploit: Options -d, --dir-input directory Directory with common...
skipfish
=========================================== skipfish - web application security scanner http://code.google.com/p/skipfish/ 作成・メンテナンス: Michal Zalewski [email protected] Niels Heinen [email protected] Sebastian Roschke [email protected] Copyright 2009 - 2012 Google Inc, 無断複製禁止。 Apach...
CVE-2026-82286-gpt-crawler-Arbitrary-File-Write
CVE-2026-82286 — gpt-crawler 認証なし任意ファイル書き込み BuilderIO/gpt-crawler（約22k ★）における、POST /crawl API エンドポイントの outputFileName パラメータを介した認証なし任意ファイル書き込み の概念実証です。...
EUVD-2026-67817
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...
CVE-2026-82286
gpt-crawler through version 1.5.1 (BuilderIO) is vulnerable to an arbitrary file write via the outputFileName parameter in the POST /crawl endpoint. The root cause is a failure to validate this parameter, allowing unauthenticated attackers to supply absolute paths or parent-directory segments and...
CVE-2026-82286 gpt-crawler Arbitrary File Write via outputFileName Parameter
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...
CVE-2026-82286 gpt-crawler Arbitrary File Write via outputFileName Parameter
gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourc...