Follina-CVE-2022-30190-Sample

Follina-CVE-2022-30190-Sample-by-ethical-blue Educational Follina Tool Version history v1.1 — JavaScript payload obfuscation v1.0 — Initial release Features .RTF payload generator Simple HTTP Server for payload Mitigation tips Configuration extractor Easy to use for learning Exploit Executed...

LinkFinder

About LinkFinder LinkFinder is a python script written to discover endpoints and their parameters in JavaScript files. This way penetration testers and bug hunters are able to gather new, hidden endpoints on the websites they are testing. Resulting in new testing ground, possibility containing ne...

cumulus

Application Weakness Monitoring Software What's Cumulus Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It's very simple and powerful. Key features Just install SDK to web front, can be found security weakness on...

CVE-2021-40444_EXP_JS

This repository does not have a README...

zap-hud

ZAP 헤즈업 디스플레이 HUD는 더 이상 활발히 개발되지 않습니다 안타깝게도 HUD는 더 이상 활발히 개발되지 않습니다. 아무도 이에 집중하지 않기 때문입니다. HUD는 독특하고 혁신적인 인터페이스로, 일부 사람들이 좋아한다는 것을 알고 있습니다. 그러나 상당한 유지보수가 필요하며 현재 이를 유지할 충분한 자원봉사자가 없습니다. 참여를 원하시면 ZAP HUD 그룹을 통해 연락해 주세요. HUD를 계속 유지하기 위해 실제로 Java 경험이 있는 사람은 필요하지 않습니다. 그 부분은 이미 충당되어 있습니다. 좋은 JavaScri...

rev-dep

Rev-dep Capabilities • Installation • Documentation • Exploratory Toolkit • Newsletter Dependency analysis and optimization toolkit for modern JavaScript and TypeScript codebases. Enforce dependency graph hygiene and remove unused code with a very fast CLI. About 📣 As codebases scale, maintaining...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 Reflected SVG XSS Reflected Cross-Site Scripting XSS via SVG Rendering in FuguHub https://vulners.com/cve/CVE-2025-65790 This repository documents a Reflected Cross-Site Scripting XSS vulnerability in FuguHub 8.1 , where SVG files containing inline JavaScript are...

CVE-2024-4367-Analysis

CVE-2024-4367: Arbitrary JavaScript Execution in PDF.js Overview CVE-2024-4367 is a critical vulnerability in the PDF.js library that allows arbitrary JavaScript execution in a user's browser, leading to Cross-Site Scripting XSS attacks. This affects Firefox Example: python3 poc.py "alert1" Demo...

JSshell

JSshell - version 3.1 JSshell - a JavaScript reverse shell. This is used for executing JS code remotely, exploiting blind XSS, ... Requirements: Any OS + Python 2 or Python 3 New in JSshell version 3.1 Updated in the new version of JShell 3.1: New JSshell command: snippet - allows to write a...

JSFScan.sh

JSFScan.sh Blog can be found at https://medium.com/@patelkathan22/beginners-guide-on-how-you-can-use-javascript-in-bugbounty-492f6eb1f9ea?sk=21500dc4288281c7e6ed2315943269e7 Script made for all your javascript recon automation in bugbounty. Just pass subdomain list to it and options according to...

stegcloak

StegCloak 텍스트를 위한 투명 망토 StegCloak는 순수 JavaScript로 작성된 스테가노그래피 모듈로, 함수형 프로그래밍 스타일로 설계되었습니다. 비밀을 압축 및 암호화한 후 특수 유니코드 보이지 않는 문자를 사용하여 텍스트 내에 숨깁니다. 문자열에 안전하게 워터마크를 남기거나, 웹페이지에 보이지 않는 스크립트를 삽입하거나, 소셜 미디어 텍스트에 사용하거나, 기타 은밀한 통신을 위해 활용할 수 있습니다. 완전히 보이지 않습니다! 자세한 작동 방식은 이 Medium 글에서 확인하거나, 데모를 시청해 보세요. 기능...

JSScanner

JSScanner You can find the article related to this script here https://securityjunky.com/scanning-js-files-for-endpoint-and-secrets/ To install the required tools use bash install.sh Change the alive.txt with the domains you need to test. These should be in below format http://example.com...

HtmlSmuggling

HtmlSmuggling HTML smuggling is a malicious technique used by hackers to hide malware payloads in an encoded script in a specially crafted HTML attachment or web page. The malicious script decodes and deploys the payload on the targeted device when the victim opens/clicks the HTML attachment/link...

CVE-2021-38149

CVE-2021-38149 Chikitsa Patient Management System 2.0.0 Stored Cross-Site Scripting XSS An instance of stored cross-site scripting XSS exists in multiple pages on version 2.0.0 of Chikitsa Patient Management System that allows for arbitrary JavaScript to be executed in a user's browswer that coul...

WebView2-Cookie-Stealer

Blog Post Please read this blog post to get more information. Source Code This code is a modified version of Microsoft's WebView2 Code. The current code can be cleaned up and made much better. Demo Launch Example Usage Example Usage Tested on Windows 10 & 11. When the binary is executed...

jsubfinder

JSubFinder is a tool writtin in golang to search webpages & javascript for hidden subdomains and secrets in the given URL. Developed with BugBounty hunters in mind JSubFinder takes advantage of Go's amazing performance allowing it to utilize large data sets & be easily chained with other tools...

FuckJsonp-RCE-CVE-2022-26809-SQL-XSS-FuckJsonp

The tracing method of this honeypot targets red team members using mobile hotspots. The honeypot directly obtains the attacker's phone number for tracing. It catches them every time. Red team members, be careful. First, when you open the website, it monitors whether the F12 console is opened. If...

malware-jail

malware-jail Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction. Written for Node.js malware-jail is written for Node's 'vm' sandbox. Currently implements WScript Windows Scripting Host context env/wscript.js, at least the part frequently used by malware...

cve-lite-on-pi

cve-lite-on-pi A short write-up of running CVE Lite CLI against the pi monorepo, and what it found. Background This experiment was prompted by the article "OWASP CVE Lite CLI – New Tool to Scan for Vulnerabilities in Your Projects" CyberSecurityNews. What is CVE Lite CLI? CVE Lite CLI is a...

unfurl

unfurl Pull out bits of URLs provided on stdin Install If you have Go installed and configured: ▶ go install github.com/tomnomnom/unfurl@latest Otherwise download the latest binary for your platform, extract it and move it to somewhere in your $PATH e.g. /usr/bin/: ▶ wget...