PacketSender

Introduction https://packetsender.com Read this in other languages:English, Español, Deutsch, Français, italiano 简体中文. Packet Sender is an open source utility to allow sending and receiving TCP, UDP, and SSL encrypted TCP packets as well as HTTP/HTTPS requests and panel generation. The mainline...

httprobe

httprobe Take a list of domains and probe for working http and https servers. Install root@kitploit: ▶ go install github.com/tomnomnom/httprobe@latest Basic Usage httprobe accepts line-delimited domains on stdin: root@kitploit: ▶ cat recon/example/domains.txt example.com example.edu example.net ▶...

Q-DDOS-GUI

Q-DDOS-GUI DDOS WRITTEN IN C TCP/HTTP/HTTPS ddos written in c . Attack on tcp, http and https protocol. Attack with ddos choosing a random TIMEOUT between a range of seconds or with a defined Timeout. Select the number of threads you want to use. check the stop all box to stop all threads and...

htrace.sh

Description htrace.sh is a shell script for http/https troubleshooting and profiling. It's also a simple wrapper around several open source security tools. For a more detailed understanding of htrace.sh, its parameters, functions and how it all works, run htrace.sh --examples or see the Wiki...

filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

wafpass

WAFPASS root@kitploit: ██╗ ██╗ █████╗ ███████╗██████╗ █████╗ ███████╗███████╗ ██║ ██║██╔══██╗██╔════╝██╔══██╗██╔══██╗██╔════╝██╔════╝ ██║ █╗ ██║███████║█████╗ ██████╔╝███████║███████╗███████╗ ██║███╗██║██╔══██║██╔══╝ ██╔═══╝ ██╔══██║╚════██║╚════██║ ╚███╔███╔╝██║ ██║██║ ██║ ██║ ██║███████║███████...

vuln-CVE-2022-41082

vuln-CVE-2022-41082 https & http FOR HTTP: nmap -p80 --script exchange-vuln-check.nse FOR HTTPS: nmap -p443 --script exchange-vuln-check.nse SAVE RESULTS IN A FILE nmap -p80 --script exchange-vuln-check.nse -oN results.txt...

cmty-ssl-heartbleed-CVE-2014-0160-HTTP-HTTPS

This check is for demostration only. cmty-ssl-heartbleed-CVE-2014-0160-HTTP-HTTPS Targets the OpenSSL product directly on discovered HTTP and HTTPS services. This does not check for OpenSSL 1.0.2-beta which is vulnerable. Also, OpenSSL is commonly packaged into other software and better targeted ...

cve-2021-38647

cve-2021-38647 A PoC exploit for CVE-2021-38647 RCE in OMI. Execute a single command using ExecuteShellCommand on the default HTTPS port: root@kitploit: python cve-2021-38647.py -s 10.10.10.10 shell id Execute a single command using ExecuteShellCommand on the default HTTP port: root@kitploit:...

GHSA-7WMF-PW8J-MC78 CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

Impact IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request. In affected deployments, an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may impact applications that rely on...

Open Redirect

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Open Redirect via improper handling of URLs in the navigateTo function. An attacker can execute arbitrary scripts or redirect users to malicious sites by supplying crafted URLs that exploit path normalization a...

CVE-2026-44308: Insufficient Verification of Data Authenticity

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support @NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping did n...

GHSA-375F-4R2H-F99J Bandit trusts client-supplied URI scheme on plaintext connections

Summary Bandit reflects the client-supplied URI scheme into conn.scheme without verifying the actual transport. Over a plaintext HTTP/1.1 connection or h2c, an unauthenticated attacker can send an absolute-form request target like GET https://victim/path HTTP/1.1 and the application observes...

CVE-2026-42404

Apache Neethi does not impose any restrictions on URIs when manually fetching remote policy references through the PolicyReference API. When an application explicitly calls the API to retrieve a policy from a remote URI, an outbound request is made for arbitrary protocols and internal IP...

DEBIAN-CVE-2026-40490

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. When redirect following is enabled followRedirecttrue, versions of AsyncHttpClient prior to 3.0.9 and 2.14.5 forward Authorization and Proxy-Authorization headers...

CVE-2026-34753: Server-Side Request Forgery (SSRF)

vLLM is an inference and serving engine for large language models LLMs. From 0.16.0 to before 0.19.0, a server-side request forgery SSRF vulnerability in downloadbytesfromurl allows any actor who can control batch input JSON to make the vLLM batch runner issue arbitrary HTTP/HTTPS requests from t...

Server-side Request Forgery (SSRF)

Overview ragas is an Evaluation framework for RAG and LLM applications Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of URLs in the retrievedcontexts parameter when processing multimodal inputs. An attacker can access arbitrary files,...

MiracleLinux 9 : squid-5.5-6.el9_3.2 (AXSA:2023-7053:06)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-7053:06 advisory. squid: DoS against HTTP and HTTPS CVE-2023-5824 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory. Note...

CVE-2025-14524

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host...

CVE-2025-67485: Protection Mechanism Failure

mad-proxy is a Python-based HTTP/HTTPS proxy server for detection and blocking of malicious web activity using custom security policies. Versions 0.3 and below allow attackers to bypass HTTP/HTTPS traffic interception rules, potentially exposing sensitive traffic. This issue does not have a fix a...