CVE-2026-111172 @casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide,...

aws_pwn

AWS pwn Summary This is a collection of horribly written scripts for performing various tasks related to penetration testing AWS. Please don't be sad if it doesn't work for you. It might be that AWS has changed since a given tool was written or it might be that the code sux. Either way, please fe...

CVE-2024-34102

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ CVE-2024-34102...

git-hound

🐾 GitHound A pattern-matching, patch-attacking, batch-catching secret snatcher. Overview GitHound hunts down exposed API keys, secrets, and credentials across GitHub by pairing GitHub dorks with pattern matching, contextual detection, and commit-history analysis. Input a GitHub dork into GitHound...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

twebit

Bitcoin analysis with machine learning How it works? 1- Get tweets from twitter 2- Filter tweets 3- Tweet classification with naive bayes algorithm Positive,negative and neut Installation git clone https://github.com/omergunal/twebit cd twebit pip3 install -r requirements.txt Update your api keys...

cve-2019-6693

FortiGate Password Decrypt Script - CVE-2019-6693 🔐 An authorized remote user with access or knowledge of the standard encryption key could gain access and decrypt the FortiOS backup files and all non-administrator passwords, private keys, and High Availability HA passwords. Overview This Python...

github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

RAU_crypto

RAUcrypto Combined exploit for Telerik UI for ASP.NET AJAX. File upload for CVE-2017-11317 and CVE-2017-11357 - will automatically upload the file .NET deserialisation for CVE-2019-18935 Now supports testing for the target's ability to pull in remote payloads from an attacker-hosted SMB service...

CVE-2026-41940

Based on Watch Tower POC , Supports direct shell access via websocket , and adding root api keys for persistance...

actions-secrets

SecureStack Secrets Analysis GitHub Action A GitHub Action that analyses your source code for secrets, credentials, API keys, server and database hostnames/URLS, and a lot more! When you add this to GitHub Actions we will analyze your source code to make sure there is no sensitive data in your...

CVE-2026-14483_exploit

CVE-2026-14483 — Realtyna WPL / Organic IDX Unauthenticated Arbitrary File Upload → RCE Unauthenticated arbitrary file upload leading to RCE in the Realtyna WPL / Organic IDX WordPress plugin real-estate-listing-realtyna-wpl ≤ 5.2.0. The plugin registers an "I/O service" on the public WordPress...

hostintel

hostintel This tool is used to collect various intelligence sources for hosts. Hostintel is written in a modular fashion so new intelligence sources can be easily added. Hosts are identified by FQDN host name, Domain, or IP address. This tool only supports IPv4 at the moment. The output is in CSV...

hashcat

hashcat hashcat is the world's fastest and most advanced password recovery utility, supporting five unique modes of attack for over 300 highly-optimized hashing algorithms. hashcat currently supports CPUs, GPUs, and other hardware accelerators on Linux, Windows, and macOS, and has facilities to...

agent-vault-proxy

Keys on the Wire Your AI agent never holds your API keys. It sends a placeholder; the real secret is swapped in on the wire. Stops credential stealers Shai-Hulud and similar and prompt-injected agents from leaking your secrets. A compromised agent has nothing to take. How it works 1. Your agent...

synodecrypt

SynoDecrypt A tool to decrypt all Synology encrypted archives SPK, PAT, .... The reverse engineering work is explained in our blog post. Installation pip install -r requirements.txt Usage You first have to extract the encryption keys and put them into a JSON file e.g. into keys.json. This JSON fi...

voron-crypto

Voron crypto/protocol library — request for review This is the crypto and messaging-protocol core of a small E2EE messenger project, pulled out on its own for outside review. It is not the whole product — the Android client and deployment config are intentionally left out; this is just the part...

interrogate

Interrogate Interrogate is a proof-of-concept tool for identification of cryptographic keys in binary material regardless of target operating system, first and foremost for memory dump analysis and forensic usage. Able to identify AES, Serpent, Twofish and DER-encoded RSA keys as of version 0.0.4...

shim-review

This repo is for review of requests for signing shim. To create a request for review: clone this repo preferably fork it edit the template below add the shim.efi to be signed add build logs add any additional binaries/certificates/SHA256 hashes that may be needed commit all of that tag it with a...

SecretFinder

about SecretFinder SecretFinder is a python script based on LinkFinder, written to discover sensitive data like apikeys, accesstoken, authorizations, jwt,..etc in JavaScript files. It does so by using jsbeautifier for python in combination with a fairly large regular expression. The regular...