nimrm

nimrm Native WinRM shell client written in Nim Version 1.2.0 · Author Chokri Hammedi blue0x1 · License MIT Legal Notice nimrm is intended for lawful administration, security testing, and research on systems you own or have explicit permission to access. The author is not responsible for misuse or...

crml

CRML — Lenguaje de Modelado de Riesgo Cibernético Estado: Borrador. Este proyecto está en desarrollo intenso y puede cambiar sin previo aviso. Agradecemos sugerencias, incidencias y contribuciones. ⚠️ ADVERTENCIA Este código se está desarrollando actualmente en la rama crml-dev-1.3. Para el último...

sigma-cli

Interfaz de línea de comandos de Sigma Esta es la interfaz de línea de comandos de Sigma que utiliza la librería pySigma para gestionar, listar y convertir reglas Sigma en lenguajes de consulta. Primeros pasos Instalación La forma más sencilla de instalar la CLI de Sigma es mediante pipx o pip...

hakoriginfinder

hakoriginfinder Tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies. How does it work? This tool will first make a HTTP request to the hostname/URL that you provide and store the response, then it will make a request to every IP address...

webanalyze

webanalyze Esta es una adaptación de Wappalyzer en Go. Esta herramienta está diseñada para ser eficiente y permite probar listas enormes de hosts. !NOTE Debido a que Wappalyzer eliminó el acceso público a sus definiciones de aplicaciones, webanalyze actualmente carga las definiciones desde enthec...

Reversecore_MCP

Reversecore MCP AI-Powered Reverse Engineering & Security Analysis via Model Context Protocol An MCP server that gives AI assistants like Claude and Cursor the ability to perform reverse engineering, malware analysis, vulnerability research, digital forensics, and source code auditing through...

zeek

The Zeek Network Security Monitor A powerful framework for network traffic analysis and security monitoring. Key Features — Documentation — Getting Started — Development — License Key Features In-depth Analysis Zeek ships with analyzers for many protocols, enabling high-level semantic analysis at...

xsubfind3r

xsubfind3r xsubfind3r 是一个命令行工具，旨在以简单高效的方式发现给定域名的子域名。它通过收集来自多种被动数据源的信息来工作（即不直接与目标交互，而是收集已公开可用的数据）。这使得 xsubfind3r 成为安全研究人员、IT 专业人士以及任何希望深入了解域名关联子域名的用户的强大工具。 目录 功能特性 安装 安装预编译二进制（无需 Go 环境） 从源码安装（需 Go 环境） go install ... go build ... 开发版 通过 Docker 安装（需 Docker 环境） 安装后配置 使用方法 贡献 许可证 功能特性...

firemark

🌐 语言 English | 简体中文 | 繁體中文 | 日本語 | 한국어 | हिन्दी | ไทย | Français | Deutsch | Español | Italiano | Русский | Português | Nederlands | Polski | العربية | فارسی | Türkçe | Tiếng Việt | Bahasa Indonesia | অসমীয়া firemark 一款快速、单一二进制的水印工具，支持图像和PDF。使用Rust构建。 为什么需要给文档添加水印？...

Security-101

🌐 多语言支持 通过 GitHub Action 支持（自动化且始终保持最新） 阿拉伯语 | 孟加拉语 | 保加利亚语 | 缅甸语 | 中文（简体） | 中文（繁体，香港） | 中文（繁体，澳门） | 中文（繁体，台湾） | 克罗地亚语 | 捷克语 | 丹麦语 | 荷兰语 | 爱沙尼亚语 | 芬兰语 | 法语 | 德语 | 希腊语 | 希伯来语 | 印地语 | 匈牙利语 | 印尼语 | 意大利语 | 日语 | 卡纳达语 | 韩语 | 立陶宛语 | 马来语 | 马拉雅拉姆语 | 马拉地语 | 尼泊尔语 | 尼日利亚皮钦语 | 挪威语 | 波斯语 | 波兰语 | 葡萄牙语（巴西） |...

augustus

Augustus - 用于提示注入、越狱和对抗性攻击测试的LLM漏洞扫描器 Augustus - LLM漏洞扫描器 针对210多种对抗性攻击测试大型语言模型，涵盖提示注入、越狱、编码利用和数据提取。 Augustus 是一款基于Go语言、面向安全专业人员的LLM漏洞扫描器。它针对各种对抗性攻击测试大型语言模型，集成28个LLM提供商，并生成可操作的漏洞报告。 与面向研究的工具不同，Augustus专为生产环境安全测试而构建——并发扫描、速率限制、重试逻辑和超时处理开箱即用。 目录 为什么选择Augustus 功能特性 快速开始 支持的提供商 使用方法 单个探针 多个探针 Buff变换...

pwndoc

PwnDoc PwnDoc is a pentest reporting application making it simple and easy to write your findings and generate a customizable Docx report. The main goal is to have more time to Pwn and less time to Doc by mutualizing data like vulnerabilities between users. Documentation Installation Data Roles...

Apache2 - Transfer-Encoding Chunked XSS

Apache2 PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 contain a reflected cross-site scripting vulnerability caused by mishandling of chunked transfer-encoding requests in sapi/apache2handler/sapiapache2.c. Attackers can execute malicious scripts via crafted...

Xdebug <= 2.5.5 - Command Injection

Xdebug = 2.5.5 contains an unauthenticated command injection caused by accepting debugger protocol commands without authentication when remote debugging is enabled, letting remote attackers execute arbitrary PHP code and system commands, exploit requires remote debugging enabled. id: CVE-2015-101...

ISPConfig - PHP Code Injection

An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if adminallowlangedit is enabled. id: CVE-2023-46818 info: name: ISPConfig - PHP Code Injection author: non-things severity: high description: | An issue was discovered...

NocoBase - SQL Injection

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...

Vendure Core - SQL Injection

Vendure, an open-source headless commerce platform built on Node.js/TypeScript, contains a critical SQL injection vulnerability in its Shop API. The languageCode query parameter is interpolated directly into a raw SQL CASE expression in ProductService.findOneBySlug without parameterization or inp...

LMDeploy - Server-Side Request Forgery

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery SSRF vulnerability in the vision-language module. The loadimage function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal or...

Adobe Experience Manager - Expression Language Injection

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability. id: CVE-2019-16469 info: name: Adobe Experience Manager - Expression Language Injection author: DomenicoVeneziano severity: high description: | Adobe Experience Manager versions...

LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...