wuzz

wuzz Interactive cli tool for HTTP inspection. Wuzz command line arguments are similar to cURL's arguments, so it can be used to inspect/modify requests copied from the browser's network inspector with the "copy as cURL" feature. Installation and usage GO $ go get github.com/asciimoo/wuzz $...

DHEater

DHEater DHEater is the proof-of-concept implementation of the DHEat attack CVE-2002-20001. It saturates a server's CPU by enforcing Diffie-Hellman ephemeral DHE or elliptic-curve Diffie-Hellman ephemeral ECDHE key exchange over both TLS and SSH. For further information about the attack visit the...

CVE-2024-4040

CVE-2024-4040 Introduction Recently, I came across this vulnerability and found it quite interesting. I read the following articles and wrote a brief exploit. https://y4tacker.github.io/2023/12/10/year/2023/12/CrushFTP-Unauthenticated-Remote-Code-Execution-CVE-2023-43177/...

wildpwn

First things first! Read: https://www.exploit-db.com/papers/33930/ Basic usage It goes something like this: usage: wildpwn.py -h --file FILE payload folder Tool to generate unix wildcard attacks positional arguments: payload Payload to use: combined | tar | rsync folder Where to write the payload...

supply-chain-monitor

Supply Chain Monitor Automated monitoring of the top PyPI and npm packages for supply chain compromise. Polls both registries for new releases, diffs each release against its predecessor, and uses an LLM via Cursor Agent CLI to classify diffs as benign or malicious. Malicious findings trigger a...

PyShell

PyShell PyShell is Multiplatform Python WebShell. This tool helps you to obtain a shell-like interface on a web server to be remotely accessed. Unlike other webshells, the main goal of the tool is to use as little code as possible on the server side, regardless of the language used or the operati...

RemoteKeyStrokes

RemoteKeyStrokes A script to automate keystrokes through an active remote desktop session that assists offensive operators in combination with living off the land techniques. All credits goes to nopernik for making it possible so I took it upon myself to improve it. I wanted something that helps...

LazyOwn

LazyOwn — RedTeam Framework with AI agents, Linux BOF beacon, YARA+Nuclei marketplace 837 CLI commands. Multi-operator C2. 153 MCP tools for AI agents. The only OSS C2 with Linux native c BOF support + built-in YARA/Nuclei marketplaces. Install in one command curl -fsSL...

noia

Noia Noia is a web-based tool whose main aim is to ease the process of browsing mobile applications sandbox and directly previewing SQLite databases, images, and more. Powered by frida.re. Please note that I'm not a programmer, but I'm probably above the median in code-savyness. Try it out, open ...

polytracker

PolyTracker PolyTracker is a tool originally created for the Automated Lexical Annotation and Navigation of Parsers , a backronym devised solely for the purpose of referring to it as The ALAN Parsers Project. However, it has evolved into a general purpose tool for efficiently performing data-flow...

ache

ACHE Focused Crawler ACHE is a focused web crawler. It collects web pages that satisfy some specific criteria, e.g., pages that belong to a given domain or that contain a user-specified pattern. ACHE differs from generic crawlers in sense that it uses page classifiers to distinguish between...

ivanti-CVE-2024-21887

ivanti-CVE-2024-21887 POC Checker for ivanti CVE-2024-21887 Command injcetion...

unomi_exploit

Disclaimer The vulnerability detection methods, files, and other content provided here are strictly limited to use by security professionals under legal authorization, for the purpose of testing the security of authorized servers. Security professionals must comply with legal regulations and are...

ApacheTomcatScanner

A python script to scan for Apache Tomcat server vulnerabilities. Features Multithreaded workers to search for Apache tomcat servers. Multiple target sources accepted: Retrieving list of computers from a Windows domain through an LDAP query to use them as a list of targets. Reading targets line b...

packman

packman A documentation and tracking project with the goal of making package management systems more secure. See issues for a very rough list of a few of the related issues we have seen. Table Of Package Management Systems Language| Name| Tier| Controls| Packman Lead| Packman Page...

CVE-2024-6386

CVE-2024-6386 - RCE via Twig SSTI in WPML PoC PoC on Python+Selenium Detailed research in Russian: CVE-2024-6386 CVSS Base Score: 9.9 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Summary In WPML you are available to use specific WordPress Shortcodes that allows you to create macroses and...

personal-security-checklist

Personal Security Checklist The ultimate list of tips to secure your digital life 🌐digital-defense.io 👉 Read the Checklist 👈 Contents The Checklist The Website The API Contributing Credits License The Checklist You can read the full checklist in CHECKLIST.md. To view/edit the raw data, see...

wappalyzer-next

Wappalyzer Next This project is a command line tool and python library that uses the Wappalyzer browser extension and its fingerprints to detect technologies. Other projects that emerged after the discontinuation of the official open-source project are using outdated fingerprints and lack accurac...

CVE-2024-1071-PoC-Script

CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof of Concept POC is made for educational and ethical testing purposes only. Usage of this tool for attacking targets without prior mutual consent is illegal. It is the end user’s responsibility to obey all applicable local, state, and federal...

Pyison

Pyison Pyison is a tarpit for AI webcrawlers Introduction Like all web crawlers, AI bots request pages from webservers, and then follow links on the page to other pages. By doing this, they can build an index of an entire website. Unlike other web crawlers, though, AI bots present some unique...