apidetector

APIDetector is a powerful and efficient tool designed for testing exposed Swagger endpoints in various subdomains with unique smart capabilities to detect false-positives. It's particularly useful for security professionals and developers who are engaged in API testing and vulnerability scanning...

Analysis

Detection Engineering Notes and Analysis This repository documents hands on detection research based on lab testing, log analysis, and real SOC workflows. The focus is on how attacker techniques actually appear in logs, what detection logic works in practice, what fails, and where false positives...

wesng

Windows Exploit Suggester - Next Generation WES-NG WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of vulnerabilities the OS is vulnerable to, including any exploits for these vulnerabilities. Every Windows OS between Windows XP and Windows 11, includin...

confused

Confused A tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python pypi requirements.txt, JavaScript npm package.json, PHP composer composer.json or MVN maven pom.xml. What is this all about? On 9th of February 2021, a security...

slowql

SlowQL The fastest offline SQL static analyzer. Built in Rust for zero false positives. Catch SQL injection, performance regressions, missing indexes, unbounded queries, compliance violations, and 282+ more issues before they reach production. No database connection required. What SlowQL Does...

hijackthis

Download Latest build v3.x - Release Stable build v2 outdated - not updated anymore this is beta-version - major changes are in progress; although it is definitely safe to use HiJackThis+ HiJackThis+ Plus previously called: HiJackThis Fork v3 is a fork and a continuation of the original Trend Mic...

waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

subjack

subjack DNS Takeover Scanner Subjack is a DNS takeover scanner written in Go designed to scan a list of domains concurrently and identify ones that are able to be hijacked. With Go's speed and efficiency, this tool really stands out when it comes to mass-testing. Always double check the results...

cq

cq Code Query，一个通用的代码安全扫描工具。 CQ 扫描代码中的安全漏洞以及安全导向的代码审查人员感兴趣的其他项目。 它将包含所发现问题引用的文本文件输出到一个输出目录。这些输出文件随后可以被审查， 通过 unix 命令行工具（如 grep）进行过滤，或者作为一种“跳转”到代码库中指定 file:line 引用的手段。 一种流行的用法是将输出文件视为“待办事项”列表：在审查过程中删除那些被认为是误报的引用， 或者将引用复制到某个报告文件中，以便详细审查或作为 bug 报告的基础。 该工具极其基础，主要依靠手动操作，并假定使用者对应用程序安全漏洞和代码审查有深入了解。...

pocsploit

pocsploit 中文 README pocsploit is a lightweight, flexible and novel open source poc verification framework Pain points of the POC framework in the market 1. There are too many params, I don't know how to get started, but only some of them are commonly used. 2. YAML poc frameworklike nuclei & xray ...

waf-bypass

WAFバイパスツール WAF Bypass Toolは、定義済みおよびカスタマイズ可能なペイロードを使用して、WAFのFalse Positives（誤検知）およびFalse Negatives（見逃し）を分析するためのオープンソースツールです。攻撃者が行う前にWAFをチェックしましょう。WAF Bypass Toolは、Nemesida WAFチームがコミュニティの参加のもとで開発しました。 違法行為は行わないでください 違法または不正な目的での使用は禁止されています。法律を破らないでください。このソフトウェアの使用に関連する可能性のあるリスクについて、当社は一切責任を負いません。...

rapidscan

🟥 RapidScan v1.2 - The Multi-Tool Web Vulnerability Scanner RapidScan has been ported to Python3 i.e. v1.2. The Python2.7 codebase is available on v1.1 releases section. Download and use it if you still haven't upgraded to Python 3. Kindly note that the v1.1 Python2.7 will not be enhanced further...

rayhunter

Rayhunter Rayhunter は、IMSIキャッチャー（セルサイトシミュレーターまたはスティングレイとも呼ばれます）を検出するためのプロジェクトです。当初は Orbic RC400L と呼ばれる安価なモバイルホットスポットで動作するように設計されましたが、コミュニティの尽力により、他のいくつかのデバイスにも対応しています。 また、技術スキルのレベルに関係なく、できるだけ簡単にインストールおよび使用でき、誤検知を最小限に抑えるようにも設計されています。 → インストールガイドをチェックして、始めましょう。 →...

wpgarlic

wpgarlic WordPressプラグインの概念実証ファザーであり、300以上の脆弱性の発見につながりました。これらの脆弱性は、約3000万サイトにインストールされているWordPressプラグインに存在していました。 使用された手法は https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html で説明されています。...

shellshock_crawler

Prerequisite 1. sudo pip install shell 2. install google python search. https://github.com/MarioVilas/google Run I use google to search first 1000 sites and try to get the /etc/passwd After tesing, there are many many many host that can be rooted!!!! By the way, this is only a proto, it has false...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: fixed RELEASELOCKOWNER The test on socount in nfsd4releaselockowner is pointless and harmful. revert to using checkforlocks, and change it to not sleep. Firstly, it’s harmful. As documented in the kdoc comment for...

perl: Perl: Incorrect regular expression processing via large regular expressions

A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not...

perl: Perl: Incorrect regular expression processing via large regular expressions

A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not...

CVE-2026-13221

A flaw was found in Perl. When the Perl regular expression engine processes patterns with a very large number of alternative fixed strings, an internal data field can overflow. This leads to silently incorrect regular expression matches, causing the engine to either match strings it should not...

What SecureIQLab Cloud WAAP 5.0 means for your application security

You cannot verify a vendor’s security claims from their own datasheet, including ours. That is why independent validation matters. In our recent guide to the best WAAP solutions Best WAAP Solutions 2026: Enterprise Buyer Guide, we argued that every serious shortlist should include independent...