vulnrepro-benchmark

VulnRepro A benchmark that checks if an AI model can actually review vulnerable code, or if it just sounds confident. Most security benchmarks ask one question: can the model find the bug? That is only half the job. The other half, the part that actually wears you down in real review work, is not...

jsonorg-fp3

json.org CVE-2022-45688 false positive The project contains a json.org dependency with CVE-2022-45688. It does invoke the vulnerable class, but the input data is sanitised with a simple method of counting characters, therefore estimating the max depth of the DOM tree to be generated, and enforcin...

DakshSCRA

Daksh SCRA Source Code Review Assist root@kitploit: Author: - Debasis Mohanty [email protected] - Twitter / X: @coffeensecurity - www.coffeeandsecurity.com About Daksh SCRA Daksh SCRA Source Code Review Assist is built to enhance the efficiency of the source code review process, providing a...

EagleEye

EagleEye: With the addition of the -ss option in HTTPX by Project Discovery, it is now possible to create a list of potentially vulnerable URLs with gf xss and qsreplace with the XSS payload, such as alerthacked. HTTPX will then visit all the URLs and take screenshots of them, which are stored in...

dns_amplification_scanner

DNS Amplification DDoS Detection and Verification Tool This script is designed to identify and verify potential DNS servers vulnerable to exploitation in DNS amplification distributed denial-of-service DDoS attacks. It addresses the limitations of automated vulnerability scanners like Nessus, whi...

MinimalReproducer

After significant efforts, stripped it down to a minimal replicator. This is just an empty project to demonstrate the issue with dependency-check-maven usage I am forced on doing by my company rules. Do check the pom.xml and do verify: mvn org.owasp:dependency-check-maven:RELEASE:aggregate Or if...

msgpack-CVE-2021-23410-test

Test for https://snyk.io/vuln/SNYK-JS-MSGPACK-1296122 This looks like not vulerbility. root@kitploit: var assert = require'assert'; var msgpack = require'msgpack'; function sleepms return new Promiseresolve = setTimeoutresolve, ms; ; async function init var normal = "a": 1, "b": 2, "c": 1, 2, 3 ;...

HostileSubBruteforcer

HostileSubBruteforcer This app will bruteforce for exisiting subdomains and provide the following information: IP address Host if the 3rd party host has been properly setup. for example if site.example.com is poiting to a nonexisiting Heroku subdomain, it'll alert you - Currently only works with...

jackhammer

Jackhammer: One Security vulnerability assessment/management tool to solve all the security team problems. What is Jackhammer? Jackhammer is a collaboration tool built with an aim of bridging the gap between Security team vs dev team, QA team and being a facilitator for TPM to understand and trac...

CakeFuzzer

CakeFuzzer Latest release : 1.0 License : GNU GPL v3.0 Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives. Currently it is implemented to support the Cake...

ffufPostprocessing

Ffuf: Post-traitement Malheureusement - malgré son option "-ac", ffuf a tendance à produire beaucoup d'entrées non pertinentes. C'est pourquoi j'ai créé un outil de post-traitement pour filtrer ces entrées. De plus, j'ai vu beaucoup d'entrées pertinentes supprimées lorsque "-ac" était utilisé -...

ESCepcion

🛡️ ESCepcion Auditeur des services de certificats Active Directory ESCepcion est un outil open source pour l'audit et l'évaluation des vulnérabilités dans les infrastructures Active Directory Certificate Services AD CS. Il est conçu pour automatiser la détection des chemins d'élévation de...

phantom-playbooks

Ceci est le dépôt Corelight des playbooks communautaires développés pour Splunk Phantom. Ceux-ci fournissent quelques exemples pour vous aider à créer vos propres playbooks. Playbook Corelight d'investigation des alertes DNS Ce playbook prend une recherche enregistrée ou un mécanisme d'alerte pou...

apidetector

APIDetector هي أداة قوية وفعالة مصممة لاختبار نقاط نهاية Swagger المكشوفة في نطاقات فرعية متعددة، مع قدرات ذكية فريدة لاكتشاف النتائج الإيجابية الكاذبة. وهي مفيدة بشكل خاص لمحترفي الأمان والمطورين المشاركين في اختبار API وفحص الثغرات الأمنية. تم تقديمها في BlackHat Arsenal 2024 الرابط تاريخ...

gokart

GoKart - تحليل أمان ثابت للغة Go GoKart هي أداة تحليل ثابتة للغة Go تكتشف الثغرات الأمنية باستخدام شكل SSA التعيين الثابت الفردي لشفرة مصدر Go. وهي قادرة على تتبع مصدر المتغيرات ووسائط الدوال لتحديد ما إذا كانت مصادر الإدخال آمنة، مما يقلل من عدد النتائج الإيجابية الكاذبة مقارنة بأدوات فحص أمان G...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

CVE-2026-51302-PoC

CVE-2026-51302 : Incohérences techniques désolé pour le nom de dépôt putaclick mais cette CVE est un ramassis d'hallucinations LLM, franchement triste de voir une CNA accepter ça vu à quel point les affirmations sont incohérentes 💔 Conclusion La CVE-2026-51302 n'est pas réelle 😱 Le SQL publié ne...

kernel: fanotify: fix false positive on permission events

A flaw was found in the Linux kernel's fanotify subsystem. This vulnerability allows for a bypass of permission checks because the fsnotifygetmarksafe function may incorrectly return false for marks on unrelated groups. This could enable an attacker to perform unauthorized actions by circumventin...

l4j-fp1

faux positif log4shell Ceci est un projet web simple avec une vulnérabilité log4shell assainie. Pour une version non assainie, voir https://github.com/scabench/l4j-tp1/. Le projet définit un service get simple scabench.HelloWorldService renvoyant une chaîne de texte brut hello world. Le service...

jsonorg-fp2

json.org CVE-2022-45688 false positive The project contains a json.org dependency with CVE-2022-45688. It does invoke the vulnerable class, but the input data is hardcoded and not suitable to trigger a DoS attack. The vulnerability can therefore not be exploited for a DoS attack. Both...