CVE-2021-3831

PHP Exploit CVE-2021-3831 Script Overview This PHP script is designed to interact with a target website by generating specific MD5 hashes and making HTTP requests to exploit potential vulnerabilities. It is intended for educational purposes and should only be used in environments where you have...

dnstwist

See what sort of trouble users can get in trying to type your domain name. Find lookalike domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud, and brand impersonation. Useful as an additional source of targeted threat intelligence. DNS fuzzing is an...

PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware

Threat actors have been observed unsuccessfully attempting to exploit the newly disclosed PHP2Shell vulnerabilities to rope infected systems into a Mirai botnet variant called Potassium, as it emerges that weaponizing the flaws may be harder than previously thought. The attacks aim to exploit...

ReverseHttp

ReverseHttp Python backdoor that uses http post/get requests to communicate Requirement Python 2.7 Cherrypy pip install cherrypy Requests pip install requests Usage: Fireup the listener script then the controller then send the backdoor file and wait for connections Screenshot...

CVE-2026-50522

CVE-2026-50522 Microsoft SharePoint CVE-2026-50522 payloads and analysis. HTTP requests request| src| user-agent| encoding| unique id| payload ---|---|---|---|---|--- 816978882| 45.63.58.216| Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36| '|...

w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

cloud_enum

cloudenum Future of cloudenum I built this tool in 2019 for a pentest involving Azure, as no other enumeration tools supported it at the time. It grew from there, and I learned a lot while adding features. Building tools is fun, but maintaining tools is hard. I haven't actively used this tool...

cdb

Pown CDB Pown CDB is a Chrome Debug Protocol utility. The main goal of the tool is to automate common tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses. This is particularly useful during penetration tests and other types of...

Re2Pcap

Re2Pcap: Create PCAP file from raw HTTP request or response in seconds Re2Pcap is abbreviation for Request2Pcap and Response2Pcap. Community users can quickly create PCAP file using Re2Pcap and test them against Snort rules. Re2Pcap allow you to quickly create PCAP file for raw HTTP request shown...

turbo-intruder

Turbo Intruder Turbo Intruder is a Burp Suite extension for sending large numbers of HTTP requests and analyzing the results. It's intended to complement Burp Intruder by handling attacks that require exceptional speed, duration, or complexity. The following features set it apart: Fast - Turbo...

phpstress

phpstress Night Lion Security proof of concept denial of service / stress tester for PHP websites running with Apache and NGINX systems PHP-FPM and PHP-CGI Using a standard cable/DSL connection, this attack can flood a Linux web server’s CPU and RAM using standard HTTP requests. This attack effec...

jsfinder

Features | Installation | Usage | Demo | TODOs| Contact jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the UR...

hfinger

Hfinger - fingerprinting malware HTTP requests Tool for fingerprinting HTTP requests of malware. Based on Tshark and written in Python3. Working prototype stage :- Its main objective is to provide unique representations fingerprints of malware requests, which help in their identification. Unique...

odat

Quentin HARDY --- [email protected] [email protected] ODAT ODAT Oracle Database Attacking Tool is an open source penetration testing tool that tests the security of Oracle Databases remotely. Usage examples of ODAT: You have an Oracle database listening remotely and want to find valid...

requests-racer

Requests-Racer Requests-Racer is a small Python library that lets you use the Requests library to submit multiple requests that will be processed by their destination servers at approximately the same time, even if the requests have different destinations or have payloads of different sizes. This...

xcat

XCat XCat is a command line tool to exploit and investigate blind XPath injection vulnerabilities. For a complete reference read the documentation here: https://xcat.readthedocs.io/en/latest/ It supports an large number of features: Auto-selects injections run xcat injections for a list Detects t...

wotop

Web-On-Top-Of-Protocol WOTOP ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introduction WOTOP is a tool meant to...

Multimodal-web-attack-Dataset

MWAD: A Multimodal Web Attack Dataset for AI-Driven SQL Injection Detection Overview The Multimodal Web Attack Dataset MWAD is a novel labelled cybersecurity dataset developed as part of the author's research in cybersecurity at La Trobe University, Australia. The dataset generation methodology,...

doser.go

doser.go DoS tool for HTTP requests inspired by hulk but has more functionalities written in Go: How to use? 1. Compile it go build doser.go 2. Use it For example: 999 threads sends GET requests. P.S: Do not really attack my website pls ./doser -t 999 -g 'https://stylish-bear.ru' Usage Usage of...

EUVD-2026-108507

The A2A server component in Amazon Strands Agents SDK for Python before 1.43.0 and Amazon Strands Agents SDK for TypeScript before 1.5.0 does not properly isolate conversation state between callers. An authenticated remote user could read other tenants' conversation history and add persistent...