log4shell-scanner

log4shell-scanner A dependency-free, defensive scanner for Log4Shell — finds vulnerable log4j-core jars and JNDI exploit patterns in logs and config. Why this project During my CERT-In rotation I worked on threat identification, containment, remediation and threat hunting — exactly the workflow...

cve-2026-42945-nginx32-lab

CVE-2026-42945 nginx 32-bit Exploit Lab This repository is a reproducible Docker lab for studying CVE-2026-42945 in nginx 1.30.0. It contains a vulnerable 32-bit target, a primitive trigger, a lab-assisted known-address RCE validator, and a no-introspection brute-force driver. The proof boundary...

retire.js

Retire.js What you require you must also retire There is a vast ecosystem of JavaScript libraries available for both web and Node.js applications. While these libraries significantly accelerate development, they also require ongoing maintenance to ensure security vulnerabilities are addressed...

Supply-Chain

Software Supply Chain Security A comprehensive three-book series on software supply chain security, covering threats, defenses, and governance. This open-source manuscript provides security professionals, developers, and organizational leaders with practical guidance for securing modern software...

dependency-track

OWASP Dependency-Track Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials SBO...

waidps

waidps Wireless Auditing, Intrusion Detection & Prevention System Depends on PyCrypto, run pip install pycrypto to install. Removed - Encryption feature Youtube Video Playlist - https://www.youtube.com/watch?v=aGTQAWoeujA&index=1&list=PLrekpjW7JwW-T0CeXP8GwudtJmTJ6KZ8O Blog -...

lunasec

LunaTrace LunaTrace is an Open Source supply chain security and auditing tool. At its heart is a web console the tracks your projects and their dependencies, looking for vulnerabilities and other issues. This console is provided as a SAAS available here for free or you can deploy it and manage it...

boot-jackson-cve

Reproduction of CVE-2020-36518 in Spring Boot 2.5.10 Execute: ./mvnw clean verify It will fail with: ERROR Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check default on project jackson-demo: ERROR ERROR One or more dependencies were identified with vulnerabilities that have a CVS...

PeekABoo

PeekABoo PeekABoo tool can be used during internal penetration testing when a user needs to enable Remote Desktop on the targeted machine. It uses PowerShell remoting to perform this task. The tool only works if WinRM is enabled. Since Windows Server 2012 WinRM is enabled by default on all Window...

CVE-2011-1475

CVE-2011-1475 Check dependency vulnerabilities using Maven on CVE-2011-1475 This project is to test Maven with Travis CI...

CVE-2022-22965

CVE-2022-22965 Spring4Shell CVE-2022-22965 Usage 1. show info ❯ go run main.go -s INF VulnInfo: "Name": "CVE-2022-22965", "VulID": "nil", "Version": "1.0", "Author": "", "VulDate": "2022-03-30", "References": "https://nosec.org/home/detail/4983.html" , "AppName": "Spring Core", "AppPowerLink":...

halite

Halite Halite is a high-level cryptography interface that relies on libsodium for all of its underlying cryptography operations. Halite was created by Paragon Initiative Enterprises as a result of our continued efforts to improve the ecosystem and make cryptography in PHP safer and easier to...

Metaforge

Metaforge "An OSINT tool that analyzes metadata and creates dynamic reports" https://chriswmorris.github.io/Metaforge/ Senior Design Project 2019 - By Chris Morris and Collin Mockbee A Python3 Application for Unix-based Operating Systems Note: Metaforge requires at least python version 3.5 to wor...

confused

Confused A tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python pypi requirements.txt, JavaScript npm package.json, PHP composer composer.json or MVN maven pom.xml. What is this all about? On 9th of February 2021, a security...

ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root

Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...

uDork

uDork - Google Hacking Tool Author: M3n0sD0n4ld Twitter: @DavidUton News 11/06/2022 I have some bad news to give, last week Facebook withdrew the service by which the tool made the requests, unfortunately the tool no longer works. Sorry, thank you very much to all the users who have been using it...

heisenberg-ssc-gha

Heisenberg Dependency Health Check GitHub Action A lightweight PR guardrail for dependency updates. It scans new or changed dependencies only from your lock/manifest, pulls health and risk signals deps.dev + heuristics, flags fresh publishes, comments a report on the PR, optionally labels it for...

Diggy

Diggy Diggy can extract endpoints/URLs from apk files. It saves the result into a txt file for further processing. Dependencies apktool Usage ./diggy.sh /path/to/apk/file.apk You can also install it for easier access by running install.sh After that, you will be able to run Diggy as follows: digg...

venom

Venom C2 Venom C2 is a dependency‑free Python3 Command & Control framework for redteam persistence, built to run on systems without installing packages. It comprises a Flask team server, an Electron operator GUI, and a single‑file Python agent that communicates over HTTP/HTTPS using configurable...

NanoMQ-Memory-Leak-Research

CVE-2026-36590: Denial of Service in EMQ NanoMQ v0.24.9 This repository contains the public advisory and technical analysis for CVE-2026-36590, a denial-of-service vulnerability affecting EMQ NanoMQ v0.24.9. Review Note This repository is public to provide an accessible technical reference for CV...