redjoust

ᵔᴥᵔ RedJoust A quick and easy to use security reconnaissance webapp tool, does OSINT, analysis and red-teaming in both passive and active mode. Written in nodeJS and Electron. Join the community Join the community of Kawaiipantsu / THUGSred and participate in the dev talk around Redjoust or simpl...

CVE-2024-23739

CVE-2024-23739 An issue in Discord through 0.0.291 on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. There is a tool designed to automate the process of searching for vulnerabilities in electron:...

ElectronVulnerableVersion

Find Electron Apps Vulnerable to CVE-2023-4863 / CVE-2023-5129 This PowerShell script downloads Sysinternals Strings, recursively searches for strings within all .exe files across all drives, and compares the Electron version found with known patched versions below to determine vulnerability to...

Aurora-Incident-Response

Aurora Incident Response Incident Response Documentation made easy. Developed by Incident Responders for Incident Responders. Aurora brings "Spreadsheet of Doom" used in the SANS FOR508 class to the next level. Having led many cases and taught so many students how to do IR right, I realized, that...

Hermes-Proxy

Hermes Proxy Hermes Proxy is a desktop HTTP/HTTPS interception app built with Electron and Vite. It captures requests/responses, lets you replay requests, and export/import HAR files. Features Live traffic table with request/response details Replay requests with editable URL/headers Export all...

waf-tester

🛡️ WAF Tester Enterprise WAF Evaluation Tool — Real attack payloads. Real results. Compliance-ready reports. WAF Tester evaluates Web Application Firewalls by sending real attack payloads to a user-supplied URL and reporting whether they are blocked. Available as a Windows desktop app Electron and...

CVE-2020-1054

CVE-2020-1054 CVE-2020-1054 Learning Screenshot Reference https://0xeb-bp.github.io/blog/2020/06/15/cve-2020-1054-analysis.html steal Security token https://github.com/mwrlabs/CVE-2016-7255 leak function https://github.com/DreamoneOnly/CVE-2019-0808-32-64-exp...

jscythe

jscythe abuses the node.js inspector mechanism in order to force any node.js/electron/v8 based process to execute arbitrary javascript code, even if their debugging capabilities are disabled. Tested and working against Visual Studio Code, Discord, any Node.js application and more! How 1. Locate t...

electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

CVE-2023-49314

CVE-2023-49314 Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection against code injection through settings such as RunAsNode and enableNodeCliInspectArguments, and thus electroniz3r can be used to perform an attack. There is a tool...

ff-password-exporter

FF Password Exporter It can be difficult to export your passwords from Firefox. Since version 57 of Firefox Quantum existing password export addons no longer work. Mozilla provides no other official alternatives. FF Password Exporter makes it quick and easy to export all of your passwords from...

CVE-2024-23743

CVE-2024-23743 CVE-2024-23743 An issue in Notion for MacOS v.3.1.0 allows a remote, attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components There is a tool designed to automate the process of searching for vulnerabilities in electron:...

JS-Tap

JS-Tap v3.0.4 This tool is intended to be used on systems you are authorized to attack and for legal and educational purposes. Do not use this tool for illegal purposes, or I will be very angry in your general direction. Changelogs Major changes are documented in the project Announcements:...

Loki

🧙‍♂️ Loki Command & Control Loki is a stage-1 command and control C2 framework written in Node.js, built to script-jack vulnerable Electron apps MITRE ATT&CK T1218.015. Developed for red team operations, Loki enables evasion of security software and bypasses application controls by exploiting...

CVE-2024-23746

CVE-2024-23746 Miro Desktop 0.8.18 on macOS allows Electron code injection. PoC signature and version: tool used to explore the vulnerability: https://github.com/r3ggi/electroniz3r verify if is vulnerable: inject a Blind Shell: References...

CVE-2023-50643

CVE-2023-50643 CVE-2023-50643 An issue in Evernote for MacOS v.10.68.2 allows a remote, attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components There is a tool designed to automate the process of searching for vulnerabilities in electron:...

myNetwork

myNetwork Cross-platform LAN & port scanner with a Windows XP–style desktop GUI. Discovers hosts on your segment, resolves names, MAC and vendor, and reports open TCP + UDP ports — with live monitoring and export. Screenshot shows synthetic demo data. Download Direct download of the latest releas...

kraken

警告 私はKraken-Clientのコードをレビューしてきましたが、これは私の初めてのReactアプリであり、古くて使い勝手が悪く、大幅な改善が必要です（サーバー側も同様に手を加える必要があります）。今後数週間から数か月のうちに、最新のReactまたは別のフレームワークで書き直すよう努力します。現状のまま引き続きご利用いただいて構いません。問題があれば引き続きIssueを報告し、フィードバックをお寄せください。ありがとうございます！ Kraken: マルチプラットフォーム分散ブルートフォースパスワードクラックシステム Krakenとは...

kraken

Warning I have been reviewing the Kraken-Client code and since this was my first ever react app, its old, clunky and it needs major improvement the server needs some work too. In the next few weeks/months I will do my best to rewrite it in either updated React or in another framework. Please feel...

CVE-2023-33668

CVE-2023-33668 Summary DigiExam is a surveillance exam and proctoring software. The software is installed in schools' or students' computers. When the student joins an exam, DigiExam will: ensure it's not running in a Virtual Machine, terminate all applications, fullscreen itself, and prevent the...