CVE-2022-26134

CVE-2022-26134 1. Primeiro execute os scripts do shodan para capturar todos os IPs python3 shodanscript.py -API yourapi -L limit -D "http.favicon.hash:-305179312 200" log.txt exemplo: python3 shodanscript.py -API xxxxxxx -L 10 -D "http.favicon.hash:-305179312 200" log.txt 2. Para todos os IPs...

MurMurHash

MurMurHash Questo piccolo strumento serve per calcolare un valore MurmurHash di un favicon per cacciare siti di phishing sulla piattaforma Shodan. Cos'è MurMurHash? MurmurHash è una funzione di hash non crittografica adatta per la ricerca generale basata su hash. Il nome deriva da due operazioni ...

C2

C2 tramite favicon generato da Python, letto con PowerShell...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra Contributing License Future Plans/Under Development Credits Disclaimer FAQ Detailed insight about Vajra can b...

fav-up

Fav-up Ricerca per IP reale partendo dall'icona favicon e utilizzando Shodan. Installazione pip3 install -r requirements.txt Chiave API Shodan non quella gratuita Utilizzo CLI Prima definisci come passare la chiave API: -k o --key per passare la chiave allo stdin -kf o --key-file per passare il...

FavFreak

FavFreak - Armare favicon.ico per BugBounties, OSINT e quant'altro Una descrizione dettagliata è disponibile qui: Leggi il blog qui: https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139 Introduzione Ho creato questo strumento per rendere il mio lavo...

CVE-2020-5902

CVE-2020-5902 Shodan root@kitploit: http.favicon.hash:-335242539 "3992"...

Searpy

🥀 Searpy 🔧 Strumento di ricerca batch, utilizzabile per raccolta e tracciamento Supporta Python 2 e Python 3 1. Install root@kitploit: git clone https://github.com/j3ers3/Searpy pip install -r requirements.txt 配置API及账号 ./config.py python Searpy -h 2. Help root@kitploit: Searpy Engine Tookit...

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

fav-up

Fav-up Lookups for real IP starting from the favicon icon and using Shodan. Installation pip3 install -r requirements.txt Shodan API key not the free one Usage CLI First define how you pass the API key: -k or --key to pass the key to the stdin -kf or --key-file to pass the filename which get the...

httpdoom

HttpDoom - HTTP Attack surface analyser Validate large HTTP-based attack surfaces in a very fast and reliable way. Inspired by Aquatone. Installing You must have dotnet SDK at version 6+: root@kitploit: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg...

CVE-2026-73210

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-73210

CVE-2026-73210 identifies a server-side request forgery in Lookyloo’s PlaywrightCapture when the only_global_lookup option is enabled. Favicons embedded in processed pages could be resolved and fetched directly via an aiohttp.ClientSession, bypassing browser request-routing protections and potent...

CVE-2026-73210 Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-73210 Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

CVE-2026-73210

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

EUVD-2026-56151

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the onlygloballookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retrieval...

PT-2026-70210

A Server-Side Request Forgery SSRF vulnerability existed in Lookyloo's PlaywrightCapture when the only global lookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public network resources. However, favicon retriev...

SUSE CVE-2026-17859

Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17859

Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...