589 matches found
aura
This repository has moved to a new location: https://github.com/SourceCode-AI/aura Security Auditing and code introspection About the problem The current trend in the development is to use a lot of packages in the development phase, even if they provide only trivial functionality and consist of 1...
GraphCrawler
GraphCrawler GraphQL 自动化测试工具包 Graph Crawler 是用于任何 GraphQL 端点的最强大的自动化测试工具包。 版本 1.2 已发布!! 新增：可使用 Escape Technology 强大的 Graphinder 工具自动搜索端点。只需指向一个域名并添加 -e 选项，Graphinder 将执行子域名枚举并搜索常见目录以寻找 GraphQL 端点。之后 GraphCrawler 将接管并逐一处理每个发现。如果无法内省模式，可以通过 -s 选项以 JSON 文件形式提供。...
graphicator
Graphicator Graphicator is a GraphQL "scraper" / extractor. The tool iterates over the introspection document returned by the targeted GraphQL endpoint, and then re-structures the schema in an internal form so it can re-create the supported queries. When such queries are created is using them to...
graphicator
Graphicator Graphicator 是一个 GraphQL "抓取器" / 提取器。该工具会遍历目标 GraphQL 端点返回的内省文档，然后重新构建内部形式的 schema，以便重新创建支持的查询。当这些查询创建完成后，工具会使用它们向端点发送请求，并将返回的响应保存到文件中。 错误的响应不会被保存。默认情况下，工具会缓存正确的响应以及错误信息，因此重新运行工具时不会重复执行相同的查询。 请明智地使用它，并且仅在你拥有权限的目标上进行操作。 我们希望该工具能帮助你作为渗透测试人员自动化自己的测试，同时也能推动那些尚未进行 GraphQL 测试的人开始行动。 了解如何对...
CVE-2024-28397
CVE-2024-28397 Exploit per l'Escape dalla Sandbox di js2py - CodePartTwo - HTB Un codice exploit in Python per CVE-2024-28397 , una vulnerabilità critica in js2py = 0.74 che consente l'escape dalla sandbox e l'esecuzione remota di codice. 🚨 Dettagli della Vulnerabilità ID CVE : CVE-2024-28397...
icebox
IceBox Icebox is a Virtual Machine Introspection solution that enable you to stealthily trace and debug any process kernel or user. It's based on project Winbagility. Files which might be helpful: INSTALL.md: how to install icebox. BUILD.md: how to build icebox. Demo Project Organisation fdp: Fas...
icebox
IceBox Icebox è una soluzione di Virtual Machine Introspection che ti consente di tracciare e fare debug furtivamente di qualsiasi processo kernel o utente. Si basa sul progetto Winbagility. File che potrebbero essere utili: INSTALL.md: come installare icebox. BUILD.md: come compilare icebox. Dem...
CVE-2025-27407
CVE-2025-27407 GitLab Podman लैब GitLab Direct Transfer HTTP पथ कमज़ोर graphql-ruby introspection स्कीमा लोडर तक पहुँचता है, इसे साबित करने के लिए यह एक न्यूनतम केवल-स्थानीय लैब है। यह लैब एक कमज़ोर GitLab CE कंटेनर चलाती है; PoC स्क्रिप्ट परीक्षण के दौरान केवल प्रक्रिया-में in-process अपना नकली...
SuiteCRM Unauthenticated Graphql Introspection
Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...
js2py-Sandbox-Escape-CVE-2024-28397-RCE
CVE-2024-28397 Exploit di Escape della Sandbox js2py Una raccolta di script di exploit che mirano alla vulnerabilità di escape della sandbox js2py CVE-2024-28397 che consente l'esecuzione arbitraria di codice tramite introspezione di oggetti Python. 🔍 Panoramica della Vulnerabilità La libreria...
applepie
applepie, un'implementazione di hypervisor per Bochs Ciao! Benvenuto in applepie! Questo è uno strumento progettato per fuzzing, introspezione e ricerca di bug! È un hypervisor che utilizza l'API Windows Hypervisor Platform presente nelle versioni recenti di Windows in particolare è stato...
batchql
BatchQL BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet,...
pe-sieve
Intro PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches...
CVE-2024-40094
CVE-2024-40094 ENF ExecutableNormalizedFields Denial-of-Service-Exploit Dieses Skript nutzt die Schwachstelle CVE-2024-40094 in graphql-java aus, indem es einen ExecutableNormalizedFields ENF -basierten Denial-of-Service auslöst. Es erstellt eine manipulierte GraphQL-Introspection-Abfrage mit tie...
BIT-KEYCLOAK-2026-37979 Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass
A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect OIDC token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credentials can retrieve sensitive token claims intended for other...
graphql-threat-matrix
GraphQL Threat Matrix Why graphql-threat-matrix? graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities across multiple GraphQL implementations. The differences in how GraphQL implementations interpret and conform to the...
graphql-cop
GraphQL Cop - Security Audit Utility for GraphQL About GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL. GraphQL Cop allows you ...
Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to IBM WebSphere Application Server Liberty (CVE-2024-40094)
Summary IBM WebSphere Application Server Liberty is vulnerable to denial of service attack. These vulnerabilities affect IBM Spectrum Control Vulnerability Details CVEID:CVE-2024-40094 DESCRIPTION: GraphQL Java aka graphql-java before 21.5 does not properly consider ExecutableNormalizedFields ENF...
Authentication Bypass
org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...
