htrace.sh

Description htrace.sh is a shell script for http/https troubleshooting and profiling. It's also a simple wrapper around several open source security tools. For a more detailed understanding of htrace.sh, its parameters, functions and how it all works, run htrace.sh --examples or see the Wiki...

ctfr

CTFR Do you miss AXFR technique? This tool allows to get the subdomains from a HTTPS website in a few seconds. How it works? CTFR does not use neither dictionary attack nor brute-force, it just abuses of Certificate Transparency logs. For more information about CT logs, check...

heartbleedscanner

Heartbleed Scanner Network Scanner for OpenSSL Memory Leak CVE-2014-0160 -t parameter to optimize the timeout in seconds. -f parameter to log the memleak of vulnerable systems. -n parameter to scan entire network. -i parameter to scan from a list file. Useful if you already have targets. -r...

typodetect

TypoDetect This tool gives blue teams, SOC's, researchers and companies the ability to detect the active mutations of their domains, thus preventing the use of these domains in fraudulent activities, such as phishing and smishing. For this, Typodetect allows the use of the latest available versio...

heimdall_webserver

注意，该项目处于测试版本，存在大量错误和问题。如果你想帮助该项目，请在实验室环境中使用，而非你的真实环境。 不，尚未实现 HTTPS，它将在下一个升级版本中加入。 Heimdall 它是一个用于集中管理 nix 服务器中易受攻击软件包的工具。 开始之前 你需要安装 Python pip，请使用以下命令检查 which pip 如果已安装 pip，只需运行 pip install -U pip 如果没有安装 pip，请通过以下链接安装 https://pip.pypa.io/en/stable/installing/ 如何安装 git clone...

qu1ckdr0p2

About Rapidly host payloads and post-exploitation bins over HTTP or HTTPS. Designed to be used on exams like OSCP / PNPT or CTFs HTB / etc. Pull requests and issues welcome. As are any contributions. Qu1ckdr0p2 comes with an alias and search feature. The tools are located in the qu1ckdr0p2-tools...

hyperfox

Hyperfox Hyperfox 是一款安全审计工具，用于代理并记录两个端点之间的 HTTP 和 HTTPS 流量。 安装 您可以通过以下命令将 Hyperfox 的最新版本安装到 /usr/local/bin（需要管理员权限）： curl -sL 'https://raw.githubusercontent.com/malfunkt/hyperfox/master/install.sh' | sh 如果您不放心直接运行此脚本，也可以从我们的发布页面获取预编译版本并手动安装。 从源码构建 hyperfox 要从源码构建 hyperfox，您需要安装 Go 和 C 编译器： 使用 go...

httprobe

httprobe Take a list of domains and probe for working http and https servers. Install ▶ go install github.com/tomnomnom/httprobe@latest Basic Usage httprobe accepts line-delimited domains on stdin: ▶ cat recon/example/domains.txt example.com example.edu example.net ▶ cat recon/example/domains.txt...

Cisco ASA Stack-based Buffer Overflow (CVE-2021-40118)

A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to trigger a denial of service DoS condition. This vulnerability is due to improper input validation when...

Cisco ASA Improper Input Validation (CVE-2022-20745)

A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. This vulnerability is due to...

RockyLinux 9 : bind9.18 (RLSA-2026:75578)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:75578 advisory. bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records CVE-2026-81736 bind9: bind: BIND 9: Denial of Service via 16-bit length...

godoh

🕳 godoh 一个基于DNS-over-HTTPS的命令与控制概念验证 介绍 godoh 是一个概念验证的命令与控制框架，使用Golang编写，利用DNS-over-HTTPS作为传输媒介。目前支持的提供商包括Google、Cloudflare，同时也支持使用传统DNS。 安装 您只需要 godoh 二进制文件本身。二进制文件可从发布页面的标签版本中下载。 要从源码构建 godoh，请遵循以下步骤： 确保您已安装Go 1.13+ 使用 git clone https://github.com/sensepost/goDoH.git 克隆此仓库 运行 make key...

CVE-2026-105766

The Chainguard Academy (edu) website is vulnerable to an HTTPS to HTTP downgrade attack due to the use of the backend-facing $scheme variable in the nginx.conf trailing-slash directory redirect. This issue exists in versions from commit 0b75ff98057f69b044a3e7194e428066ac5ad0d4 before commit 93dc0...

mallory

mallory 基于SSH的HTTP/HTTPS代理。 安装 本机：go install github.com/justmao945/mallory/cmd/mallory@latest 远程服务器：需要我们的老朋友 sshd 配置 配置文件 默认路径为 $HOME/.config/mallory.json，可在启动程序时设置 mallory -config path/to/config.json 内容： idrsa 是我们的私钥文件路径，可通过 ssh-keygen 生成 localsmart 是提供HTTP代理的本地地址，支持对目标主机进行智能检测 localnormal 类似于...

cve-2021-38647

cve-2021-38647 Un exploit PoC para CVE-2021-38647 RCE en OMI. Ejecuta un solo comando usando ExecuteShellCommand en el puerto HTTPS predeterminado: python cve-2021-38647.py -s 10.10.10.10 shell id Ejecuta un solo comando usando ExecuteShellCommand en el puerto HTTP predeterminado: python...

http-vuln-CVE-2022-41082

LA VERSIÓN ACTUALIZADA TAMBIÉN PERMITE LA VERIFICACIÓN HTTPS exchange-vuln-check.nse PARA HTTP: nmap -p80 --script exchange-vuln-check.nse PARA HTTPS: nmap -p443 --script exchange-vuln-check.nse GUARDAR RESULTADOS EN UN ARCHIVO nmap -p80 --script exchange-vuln-check.nse -oN results.txt...

Important: Red Hat Security Advisory: bind9.18 security update

An update for bind9.18 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

bind: BIND 9: Remote Denial of Service via cached SVCB/HTTPS AliasMode records

A flaw was found in BIND 9. A remote attacker can exploit this vulnerability by querying a BIND resolver for the root of a specially crafted, cached tree of SVCB/HTTPS AliasMode records. This action causes the resolver to spend a disproportionate amount of CPU time constructing the response,...

bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing

A flaw was found in the BIND resolver. A remote attacker could exploit a vulnerability in the processing of SVCB/HTTPS AliasMode records that reference numerous ServiceMode records. This could lead to the resolver failing to properly release internal resources, causing resource exhaustion. Repeat...

bind: BIND resolver: Denial of Service due to resource exhaustion in SVCB/HTTPS AliasMode processing

A flaw was found in the BIND resolver. A remote attacker could exploit a vulnerability in the processing of SVCB/HTTPS AliasMode records that reference numerous ServiceMode records. This could lead to the resolver failing to properly release internal resources, causing resource exhaustion. Repeat...