subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

wesng

Windows Exploit Suggester - Next Generation WES-NG WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 11, includin...

hijackthis

Download Latest build v3.x - Release Stable build v2 outdated - not updated anymore this is beta-version - major changes are in progress; although it is definitely safe to use HiJackThis+ HiJackThis+ Plus previously called: HiJackThis Fork v3 is a fork and a continuation of the original Trend Mic...

confused

Confused A tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python pypi requirements.txt, JavaScript npm package.json, PHP composer composer.json or MVN maven pom.xml. What is this all about? On 9th of February 2021, a security...

apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...

rapidscan

🟥 RapidScan v1.2 - The Multi-Tool Web Vulnerability Scanner RapidScan has been ported to Python3 i.e. v1.2. The Python2.7 codebase is available on v1.1 releases section. Download and use it if you still haven't upgraded to Python 3. Kindly note that the v1.1 Python2.7 will not be enhanced further...

rayhunter

Rayhunter Rayhunter は、IMSIキャッチャー（セルサイトシミュレーターまたはスティングレイとも呼ばれます）を検出するためのプロジェクトです。当初は Orbic RC400L と呼ばれる安価なモバイルホットスポットで動作するように設計されましたが、コミュニティの尽力により、他のいくつかのデバイスにも対応しています。 また、技術スキルのレベルに関係なく、できるだけ簡単にインストールおよび使用でき、誤検知を最小限に抑えるようにも設計されています。 → インストールガイドをチェックして、始めましょう。 →...

pocsploit

pocsploit 中文 README pocsploit is a lightweight, flexible and novel open source poc verification framework Pain points of the POC framework in the market 1. There are too many params, I don't know how to get started, but only some of them are commonly used. 2. YAML poc frameworklike nuclei & xray ...

slowql

SlowQL 最速のオフラインSQL静的解析ツール。Rustで構築され、誤検知ゼロを実現。 SQLインジェクション、パフォーマンス低下、インデックス欠落、無制限クエリ、コンプライアンス違反など、282以上の問題を本番環境に到達する前に検出。データベース接続は不要です。 SlowQLの機能 SlowQLはSQLファイルとアプリケーションソースコードをスキャンし、セキュリティ脆弱性、パフォーマンス低下、信頼性リスク、コスト非効率、コンプライアンス違反、コード品質の問題を検出します。データベースに接続せずにオフラインで動作します。 主な特性 実証済みモードで誤検知ゼロ。...

waf-bypass

WAF 우회 도구 WAF Bypass Tool은 사전 정의된 사용자 정의 가능한 페이로드를 사용하여 모든 WAF의 False Positive 및 False Negative에 대한 보안을 분석하는 오픈 소스 도구입니다. 공격자가 하기 전에 WAF를 확인하세요. WAF Bypass Tool은 커뮤니티의 참여로 Nemesida WAF 팀이 개발했습니다. 불법적인 행위 금지 불법적인 목적으로 사용하는 것을 금지합니다. 법을 위반하지 마십시오. 이 소프트웨어 사용과 관련된 가능한 위험에 대해 당사는 책임을 지지 않습니다. 실행 방법...

waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

wpgarlic

wpgarlic 거의 3천만 개 사이트에 설치된 WordPress 플러그인에서 300개 이상의 취약점을 발견하게 한 개념 증명proof-of-concept WordPress 플러그인 퍼저입니다. 사용된 기술은 https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html 에 설명되어 있습니다. 연구를 계속하고 싶다면 덜 인기 있는 플러그인부터 시작하세요. 만약 플러그인이 2021년 10월과 2024년 1월 사이에 최소 10,000회의 활성 설치를 달성했다면, 제가 이미 퍼저 보고서를...

cq

cq Code Query は、汎用的なコードセキュリティスキャンツールです。 CQ は、セキュリティに重点を置いたコードレビュアーにとって関心のある、セキュリティ脆弱性およびその他の項目についてコードをスキャンします。 検出された問題への参照を含むテキストファイルを出力ディレクトリに書き出します。これらの出力ファイルは、後でレビューしたり、 grep などの Unix コマンドラインツールでフィルタリングしたり、指定された file:line 参照でコードベースに「ジャンプ」する手段として使用したりできます。...

Analysis

탐지 엔지니어링 노트 및 분석 이 저장소는 실험실 테스트, 로그 분석 및 실제 SOC 워크플로에 기반한 실무 탐지 연구를 문서화합니다. 초점은 공격자 기술이 로그에 실제로 어떻게 나타나는지, 어떤 탐지 로직이 실제로 작동하는지, 무엇이 실패하는지, 그리고 오탐이 발생하는 위치에 맞춰져 있습니다. 모든 콘텐츠는 분석가와 탐지 엔지니어를 위한 방어적 관점에서 작성되었습니다. 이는 공격 도구나 익스플로잇 개발이 아닙니다. 이 저장소에 포함된 내용 DLL 하이재킹 및 사이드 로딩 Windows 시스템에서의 DLL 하이재킹 및 사이드 ...

shellshock_crawler

前提条件 1. sudo pip install shell 2. google python search をインストールする。 https://github.com/MarioVilas/google 実行 Google を使って最初の1000サイトを検索し、/etc/passwd を取得しようとします。 テストの結果、root化できるホストが非常に多く存在することがわかりました!!!! ちなみに、これはプロトタイプであり、誤検出が含まれています。 出力例： 2番目のフィールドが !!! の場合、シェルを取得できます！ root@kitploit: $ python...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: kernfs: The constraint in the draining guard has been relaxed. The active reference lifecycle provides a mechanism for breaking and unbreaking references, but the active reference is not truly active after being unbroken—callers ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fixed RELEASELOCKOWNER The test on socount in nfsd4releaselockowner is pointless and harmful. revert to using checkforlocks, and change it to not sleep. Firstly, it’s harmful. As documented in the kdoc comment for...

perl: Perl: Incorrect regular expression processing via large regular expressions

A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not...

perl: Perl: Incorrect regular expression processing via large regular expressions

A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not...

CVE-2026-13221

A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not...