Hermes-Proxy

Hermes Proxy Hermes Proxy is a desktop HTTP/HTTPS interception app built with Electron and Vite. It captures requests/responses, lets you replay requests, and export/import HAR files. Features Live traffic table with request/response details Replay requests with editable URL/headers Export all...

imaginaryC2

Imaginary C2 author: Felix Weyne website Twitter Imaginary C2 is a python tool which aims to help in the behavioral network analysis of malware. Imaginary C2 hosts a HTTP server which captures HTTP requests towards selectively chosen domains/IPs. Additionally, the tool aims to make it easy to...

Arkhota

Arkhota, a web brute forcer for Android What? Arkhota is a web HTTP/S brute forcer for Android OS. Why? A web brute forcer is always in a hacker's computer, for obvious reasons. Sometimes attacks require to be quick or/and with minimal device preparation. Also a phone takes less attention rather...

pentest-mcp

Pentest MCP Professional penetration-testing MCP server with modern transport/auth support and expanded recon tooling. What Changed in 0.9.0 Upgraded MCP SDK to @modelcontextprotocol/sdk@^1.26.0 Kept MCP Inspector at the latest release @modelcontextprotocol/inspector@^0.20.0 with bundled launcher...

domdig

DOMDig DOMDig is a DOM XSS scanner that runs inside the Chromium web browser and it can scan single page applications SPA recursively. Unlike other scanners, DOMDig can crawl any webapplication including gmail by keeping track of DOM modifications and XHR/fetch/websocket requests and it can...

agartha

Agartha Payload Injection LFI, RCE, SQLi, with optional BCheck, Auth Issues Access Matrix, HTTP 403, Copy as JavaScript, and Bambdas Agartha, specializes in advance payload generation and access control assessment. It adeptly identifies vulnerabilities related to injection attacks, and...

pwndrop

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...

pwndrop

pwndrop هي خدمة استضافة ملفات ذاتية النشر لإرسال حمولات الفرق الحمراء أو مشاركة ملفاتك الخاصة بشكل آمن عبر HTTP و WebDAV. إذا كنت يومًا بحاجة إلى إعداد خادم nginx/apache بسرعة لاستضافة ملفاتك، ولم تكن راضيًا عن قيود python -m SimpleHTTPServer، فإن pwndrop هي الخيار الأمثل لك! مع pwndrop يمكنك: رف...

OptionsBleed-POC-Scanner

OptionsBleed-POC-Scanner OptionsBleed CVE-2017-9798 PoC / Scanner More information coming soon... Disclaimer This software has been created purely for the purposes of academic research and for the development of effective defensive techniques, and is not intended to be used to attack systems exce...

CVE-2025-8671

CVE-2025-8671 - PoC DoS lighttpd HTTP/2 Author : @abiyeenzo ⚠️ Warning This project is provided for educational purposes only. Running the PoC against third-party servers may constitute an illegal cyberattack and lead to criminal prosecution. Only use this script on your test environments or local...

dsiem

Dsiem Dsiem is a security event correlation engine for ELK stack, allowing the platform to be used as a dedicated and full-featured SIEM system. Dsiem provides OSSIM-style correlation for normalized logs/events, perform lookup/query to threat intelligence and vulnerability information sources, an...

HellPot

Summary HellPot is an endless honeypot based on Heffalump that sends unruly HTTP bots to hell. Notably it implements a toml configuration file, has JSON logging, and comes with significant performance gains. Grave Consequences Clients hopefully bots that disregard robots.txt and connect to your...

CTF_WRITEUPS-TryHackMe-CVE-2021-41773-

CTFWRITEUPS-TryHackMe-CVE-2021-41773- CTFWRITEUPS/TryHackMe /CVE-2021-41773/ CVE-2021-41773/42013 شرح صغير لثغرة تجاوز المسار في Apache وإصلاح غير مكتمل المهمة 1: القليل من الخلفية... تاريخ مختصر في الخامس من أكتوبر 2021، تم نشر ثغرة CVE تفصّل هجوم تجاوز المسار على خادم Apache HTTP Server الإصدار...

ferret

Ferret The collaborative MITM proxy for security testers. Capture HTTP traffic, annotate requests with AI, run hunt sessions, replay traffic, and track findings from one interface. Quick start · Features · Screenshots · Configuration · Security · Contributing Quick start Install git clone...

HoneyProxy

هذا المشروع قد انتقل. HoneyProxy هو الآن جزء من mitmproxy: http://docs.mitmproxy.org/en/stable/mitmweb.html HoneyProxy HoneyProxy هو وكيل وسيط خفيف يساعدك على تحليل تدفقات حركة HTTPS. وهو مصمم خصيصًا لاحتياجات باحثي الأمن، ويتيح التحليل في الوقت الفعلي وكذلك تحليل السجلات. نظرًا لتوافقه مع...

rejetto-http-file-server-2.3.x-RCE-exploit-CVE-2014-6287

rejetto-http-file-server-2.3.x-RCE-exploit-CVE-2014-6287 يحتوي هذا المستودع على شرح مفصّل وPoC عملي لثغرة تنفيذ الأوامر عن بُعد Remote Command Execution في خادم الملفات Rejetto HTTP File Server HFS 2.3.x. الإعداد: أنشئ مستمعًا عبر netcat. nc -lnvp 1234 غيّر عنوان IP الخاص بالمهاجم إلى عنوان IP...

CVE-2024-28995

SolarWinds Serv-U ثغرة اجتياز المسار POC cat targets.txt | nuclei -duc -t CVE-2024-28995.yaml image التحليل https://t.co/JPCd6Y4v1g استعلامات Shodan product:"Rhinosoft Serv-U httpd,rhinosoft serv-u httpd"...

url-status-checker

Status Checker URL Status Checker v2.1 Status Checker is a Python script that checks the status of one or multiple URLs/domains and categorizes them based on their HTTP status codes. Version 2.1.0 Features Check the status of single or multiple URLs/domains. Asynchronous HTTP requests for improve...

evil-ssdp

Overview This tool responds to SSDP multicast discover requests, posing as a generic UPNP device. Your spoofed device will magically appear in Windows Explorer on machines in your local network. Users who are tempted to open the device are shown a configurable phishing page. This page can load a...

openpcc

OpenPCC OpenPCC is an open-source framework for provably private AI inference, inspired by Apple’s Private Cloud Compute but fully open, auditable, and deployable on your own infrastructure. It allows anyone to run open or custom AI models without exposing prompts, outputs, or logs - enforcing...