struts2_cve-2017-5638

struts2cve-2017-5638 This is a sort of Java porting of the Python exploit at: https://www.exploit-db.com/exploits/41570/. This software is written to have no external dependencies. DISCLAIMER This tool is intended for security engineers and appsec guys for security assessments. Please use this to...

SqliSniper

Features • Installation • Usage • Running SqliSniper • Contributing • SqliSniper is a robust Python tool designed to detect time-based blind SQL injections in HTTP request headers. It enhances the security assessment process by rapidly scanning and identifying potential vulnerabilities using...

CVE-2019-5418

CVE-2019-5418 - File Content Disclosure on Rails EDIT : this CVE can lead to a Remote Code Execution, more info: https://github.com/mpgn/Rails-doubletap-RCE There is a possible file content disclosure vulnerability in Action View. Specially crafted accept headers in combination with calls to rend...

EyeWitness

EyeWitness - Web Screenshot Tool EyeWitness is designed to take screenshots of websites, provide server header info, and identify default credentials if known. Now powered by Chromium browser for better reliability and easier installation. 🚀 Key Features Cross-platform support - Windows, Linux,...

NullSection

NullSection NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes. Install root@kitploit: git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection Advantage When running...

dezlock-dump

dezlock-dump Extracts everything from a running Source 2 game Deadlock, CS2, Dota 2 and generates a patch-proof C++ SDK that resolves offsets at runtime. No hardcoded values, no manual updates when the game patches. Quick Start 1. Download from Releases or build from source 2. Launch your game —...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server untrusted @ header → internal metadata spoof CVSS 10.0 Critical · CWE-20 · GHSA-jrh6-9hgv-mqm7 Summary Apache Traffic Server reserves @-prefixed headers @Ats-Internal, @ICAP-Status, @TCPInfo, ... for internal metadata : they live in the in-memory header...

zappzarapp-php-security

⚡ zappzarapp/security Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event...

peanalyzer

peanalyzer Advanced Portable Executable File Analyzer Python 3.5.2 : Tested Working Usage python peanalyzer.py --file file.exe --show all|file-path|general|dos-header|file-header|optional-header|data-directory|section-headers|imports python peanalyzer.py --file file.exe --disassemble all...

http2-bomb

HTTP/2 Bomb — CVE-2026-49975 HTTP/2 Stream Amplification PoC · Docker · Web Console Vulnerability HTTP/2 allows multiplexing multiple streams over a single TCP connection. This PoC crafts specially formed HEADERS frames containing a large number of internal references, forcing the server to...

GHSA-V25G-MVWR-F5FP webhookd: Unrestricted HTTP Header to Shell Variable Injection

Description Before 1.22, if the Basic Auth htpasswd middleware was not configured, all incoming HTTP headers were blindly forwarded to the webhook script execution environment as shell variables. While the Basic Auth middleware correctly strips the authentication header X-WebAuthn-User from the...

webhookd: Unrestricted HTTP Header to Shell Variable Injection

Description Before 1.22, if the Basic Auth htpasswd middleware was not configured, all incoming HTTP headers were blindly forwarded to the webhook script execution environment as shell variables. While the Basic Auth middleware correctly strips the authentication header X-WebAuthn-User from the...

EasyScan

EasyScan EasyScan is a Python script that analyzes the security of a given website by inspecting its HTTP headers, DNS records, and other configurations. The script generates a security report with a score, grade, and recommendations for addressing potential vulnerabilities. Features & Test Cases...

graphicator

Graphicator Graphicator is a GraphQL "scraper" / extractor. The tool iterates over the introspection document returned by the targeted GraphQL endpoint, and then re-structures the schema in an internal form so it can re-create the supported queries. When such queries are created is using them to...

httpdoom

HttpDoom - HTTP Attack surface analyser Validate large HTTP-based attack surfaces in a very fast and reliable way. Inspired by Aquatone. Installing You must have dotnet SDK at version 6+: root@kitploit: $ dotnet pack -c Release -o nupkg $ dotnet tool install --global --add-source .\nupkg...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

wonitor

Monitor web Monitor de cambios de endpoints web rápido y sin configuración. Para comparar respuestas, una lista seleccionada de encabezados HTTP y el cuerpo completo de la respuesta se almacenan en un archivo local de almacenamiento clave/valor. No se necesita configuración. para aumentar el...

wonitor

web monitor fast, zero config web endpoint change monitor. for comparing responses, a selected list of http headers and the full response body is stored on a local key/value store file. no configuration needed. to increase network throughput, a --worker flag allows to set the concurrency when...

CVE-2017-12542-Exploit

HP iLO Authentication Bypass CVE-2017-12542 This repository contains a proof-of-concept exploit for CVE-2017-12542 , an authentication bypass vulnerability affecting certain versions of HP Integrated Lights-Out iLO firmware. The vulnerability allows unauthenticated access to the iLO REST API, whi...

wphunter

WPHunter Tool ☣ WPHunter A Wordpress Vulnerability Scanner You can use this tool on your wordpress website to check the security of your website by finding the vulnerability in your website. Over 75 million websites run on WordPress. which is now powers 26% of the Web. Remarkably enough thousands...