JSpector

JSpector JSpector is a Burp Suite extension that passively crawls JavaScript files and automatically creates issues with URLs, endpoints and dangerous methods found on the JS files. Prerequisites Before installing JSpector, you need to have Jython installed on Burp Suite. Installation 1. Download...

CVE-2026-67340_exploit

CVE-2026-67340 — ArcadeDB JAVASCRIPT Trigger-Script RCE post-auth Post-authentication remote code execution in ArcadeDB a Java multi-model database via a JAVASCRIPT trigger that reaches host classes. A trigger's GraalVM polyglot engine is built with a host-class allow-list that includes java.lang...

CVE-2026-67595

CVE-2026-67595 — VaahCMS에 내장된 악성 JavaScript CVE-2026-67595 에 대한 보안 권고: VaahCMS의 공식 릴리스에 포함되어 배포된 난독화된 JavaScript 스파이웨어 페이로드공급망/내장 악성 코드 문제로, Ilhomjon Rustamov가 독자적으로 발견하여 보고했습니다. 요약 | ---|--- CVE ID| CVE-2026-67595 공급업체 추적| PT-2026-65916 Positive Technologies 제품| VaahCMS — Webreinvent 영향받는 버전|...

CVE-2026-10702

CVE-2026-10702 JavaScript Engine의 JIT 구성 요소에서 JIT 컴파일 오류miscompilation가 발생했습니다. 이 취약점은 Firefox 151.0.3에서 수정되었습니다. 후원 PayPal 또는 아래 QR 코드를 스캔하여 이 프로젝트의 유지보수를 지원해 주세요. ⚡ 간단한 사용법 다음과 같은 안전하고 승인된 환경에서만 이 프로젝트를 사용하세요: 로컬 가상 머신 Docker 컨테이너 격리된 실습 환경 승인된 침투 테스트 환경 예시 설정: git clone cd 예시 사용법: Replace the...

datadome-vm

DataDome VM Analysis Summary This repository documents the first public version of DataDome's in-browser JavaScript virtual machine VM used in their CAPTCHA/interstitial flow. This analysis covers: Bytecode loading and decoding mechanisms VM memory layout and architecture A proof-of-concept...

GetDataReport

ABOUT Script in PHP+JS for get information of target through a web application, use $SERVER functions and JS functions for get information of our client. Plugin WEBApps in some web applications need to collect information from the client to perform tasks with this plugin will be easier to work wi...

awesome-ctf

Awesome CTF A curated list of Capture The Flag CTF frameworks, libraries, resources, softwares and tutorials. This list aims to help starters as well as seasoned CTF players to find everything related to CTFs at one place. Contributing Please take a quick look at the contribution guidelines first...

injectify

Injectify Perform advanced MiTM attacks on websites with ease. ✨ Support development on Patreon or one-time via Paypal Test it out | Installation | Docs | Trello | Discord View what's on the victims screen Ability to interact and click buttons Scrolling is synced two-way Data recording Database a...

-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server

-CVE-2024-21683-RCE-in-Confluence-Data-Center-and-Server This vulnerability could allow an attacker to take complete control of a vulnerable Confluence server. This could allow the attacker to steal data, modify data, or disrupt the availability of the server. Poc Create a JavaScript file and giv...

CVE-2023-29489

CVE-2023-29489 The security vulnerability is recorded in the Common Vulnerabilities and Exposures CVE system. Specifically, this vulnerability is related to cPanel, a popular hosting management software. This flaw allows for cross-site scripting XSS attacks through specially crafted requests."...

mqxss

mqxss v0.2 mqxss acts as a client to communicate with hooked browsers over MQTT The benefit to using this over beef or xsshunter is that besides hosting the js payload there is no infra setup, you can use a public broker however currently uses obfuscation, encryption is in the works. Hooked...

CVE-2021-34371.jar

CVE-2021-34371.jar CVE-2021-34371.jar from https://github.com/vulhub/vulhub/tree/master/neo4j/CVE-2021-34371/rhinogadget USE EXP...

CVE-2013-4710-WebView-RCE-Vulnerability

CVE-2013-4710-WebView-RCE-Vulnerability Vulnerability Description A lot of the time we use WebView to display a Webpage,for example many applications in order to achieve the server control, many results page is Webpage, rather than the local implementation, which has many advantages, such as...

JS-Secret-Hunter

JS Secret Hunter V2 🕵️‍♂️ JS Secret Hunter is an advanced Python tool designed for security researchers to automate the detection of hardcoded secrets in client-side JavaScript. Unlike simple scanners, V2 includes a dynamic crawler that parses the HTML of the target website to extract all loaded...

CVE-2026-13258

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended...

ZeroRAT

ZeroRAT Introduction A remote control tool for Windows. The client only needs to execute a single command, utilizing native Windows programs for execution without writing files to disk, providing inherent AV evasion. It becomes ineffective after reboot. In the program, download and upload are fro...

hakrawler

Hakrawler 빠른 golang 웹 크롤러로, URL과 JavaScript 파일 위치를 수집합니다. 기본적으로 뛰어난 Gocolly 라이브러리의 간단한 구현입니다. 사용 예시 단일 URL: echo https://google.com | hakrawler 여러 URL: cat urls.txt | hakrawler 표준 입력의 각 줄에 대해 5초 후 타임아웃: cat urls.txt | hakrawler -timeout 5 모든 요청을 프록시를 통해 전송: cat urls.txt | hakrawler -proxy...

morty

Morty 웹 콘텐츠 살균 프록시 서비스 Morty는 악성 HTML 태그와 속성을 제거하도록 웹 페이지를 재작성합니다. 또한 타사 정보 유출을 방지하기 위해 외부 리소스 참조를 대체합니다. Morty의 주요 목표는 searx에 대한 결과 프록시를 제공하는 것이지만, 독립형 살균 서비스로도 사용할 수 있습니다. 기능: HTML 살균 HTML/CSS 외부 참조를 로컬로 재작성 JavaScript 차단 쿠키 전달 안 함 리퍼러 전송 안 함 캐싱/Etag 없음 GET/POST 양식 및 IFrame 지원 서비스 남용 방지를 위한 선택적...

morty

Morty Web content sanitizer proxy as a service Morty rewrites web pages to exclude malicious HTML tags and attributes. It also replaces external resource references to prevent third party information leaks. The main goal of morty is to provide a result proxy for searx, but it can be used as a...

CVE-2025-57389

CVE-2025-57389 - Reflected XSS in OpenWRT 18.06.2 Description A reflected cross-site scripting XSS vulnerability was identified in EOL Luci OpenWRT v18.06.2 on /cgi-bin/luci/admin/system/packages endpoint. Proof of Concept 1. While proxying the traffic to Burp, navigate to...