15 matches found
CakeFuzzer
CakeFuzzer Latest release : 1.0 License : GNU GPL v3.0 Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives. Currently it is implemented to support the Cake...
DakshSCRA
Daksh SCRA Source Code Review Assist root@kitploit: Author: - Debasis Mohanty [email protected] - Twitter / X: @coffeensecurity - www.coffeeandsecurity.com About Daksh SCRA Daksh SCRA Source Code Review Assist is built to enhance the efficiency of the source code review process, providing a...
dns_amplification_scanner
DNS 放大 DDoS 检测与验证工具 该脚本旨在识别和验证可能被利用于 DNS 放大分布式拒绝服务（DDoS）攻击的潜在 DNS 服务器。它解决了 Nessus 等自动化漏洞扫描器的局限性，这些扫描器在使用插件 35450 检测此问题时可能会产生误报。 背景 DNS 放大攻击是一种基于反射的 DDoS 攻击，利用配置错误或开放的 DNS 解析器。攻击者发送带有伪造源 IP 地址的小型 DNS 查询，导致 DNS 服务器向受害者的 IP 地址发送大量响应。这会放大攻击流量，可能压垮目标的网络资源。 功能 该脚本执行以下关键功能： 1. 批量域名处理：高效分析多个域名以识别潜在漏洞。 2...
ESCepcion
🛡️ ESCepcion Active Directory 证书服务审计器 ESCepcion 是一款开源（Open Source）工具，用于审计和评估 Active Directory Certificate Services AD CS 基础设施中的漏洞。它旨在自动化检测特权提升路径 ESC，并严格聚焦于减少企业及混合环境中的误报。 与其他工具不同，ESCepcion 不会利用、修改或写入 Active Directory 中的任何对象 。其所有操作完全基于通过 LDAP 进行的只读查询，以及通过 MS-RRP 进行的可选注册表读取（使用 --deep-scan 时）。 🆚...
gokart
GoKart - Go セキュリティ静的解析 GoKart は Go の静的解析ツールであり、Go ソースコードの SSA（単一静的代入形式）を利用して脆弱性を検出します。変数や関数引数の発生元をトレースし、入力ソースが安全かどうかを判断できるため、他の Go セキュリティスキャナに比べて誤検知が少なくなります。例えば、変数と連結された SQL クエリは従来 SQL インジェクションとフラグが立てられることがありますが、GoKart はその変数が実際には定数または定数と同等であるかどうかを判断できるため、脆弱性がない場合は報告しません。 GoKart はまた、Praetorian...
nuclei v3.11.1
English • 中文 • Korean • Indonesia • Spanish • 日本語 • Portuguese • Türkçe...
Automation-Exploit-Legacy
Automation-Exploit Legacy Prototype This repository contain...
How Code Representation Shapes False-Positive Dynamics in Cross-Language LLM Vulnerability Detection
How code representation format shapes false positive behaviour in cross-language LLM vulnerability detection remains poorly understood. We systematically vary training intensity and code representation format, comparing raw source text with pruned Abstract Syntax Trees at both training time and...
AEGIS: From Clues to Verdicts -- Graph-Guided Deep Vulnerability Reasoning Via Dialectics and Meta-Auditing
Large Language Models LLMs are increasingly adopted for vulnerability detection, yet their reasoning remains fundamentally unsound. We identify a root cause shared by both major mitigation paradigms agent-based debate and retrieval augmentation: reasoning in an ungrounded deliberative space that...
aether
Aether - Adaptive Exploit & Threat Hunting Engine for EVM-base...
A Statistical Method for Attack-Agnostic Adversarial Attack Detection with Compressive Sensing Comparison
Adversarial attacks present a significant threat to modern machine learning systems. Yet, existing detection methods often lack the ability to detect unseen attacks or detect different attack types with a high level of accuracy. In this work, we propose a statistical approach that establishes a...
VulAgent: Hypothesis-Validation Based Multi-Agent Vulnerability Detection
The application of language models to project-level vulnerability detection remains challenging, owing to the dual requirement of accurately localizing security-sensitive code and correctly correlating and reasoning over complex program context. We present VulAgent, a multi-agent vulnerability...
UPDATE: OWASP Dependency-Check 3.0.0
PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP Dependency-Check 3.0.0! This release comes with Java 9...
UPDATE: OWASP Dependency-Check 2.1.0!
PenTestIT RSS Feed My first post about this open source OWASP project was about an older version. This post discusses the changes made to the open source software composition analysis utility in the latest release yesterday. This is the OWASP Dependency-Check 2.1.0! What I like about this release...
