php_code_analysis

this script will scan your code the script can find 1. checkfileupload issues 2. hostheaderinjection 3. SQl injection 4. insecure deserialization 5. openredirect 6. SSRF 7. XSS 8. LFI 9. commandinjection features 1. fast 2. simple report usage: python code.py file.php -this will scan one file...

php_code_analysis

Dieses Skript wird Ihren Code scannen Das Skript kann finden: 1. checkfileupload issues 2. hostheaderinjection 3. SQl injection 4. insecure deserialization 5. openredirect 6. SSRF 7. XSS 8. LFI 9. commandinjection Funktionen 1. schnell 2. einfacher Bericht Verwendung: python code.py file.php -thi...

waf-bypass

WAF Bypass Tool WAF Bypass Tool is an open source tool to analyze the security of any WAF for False Positives and False Negatives using predefined and customizable payloads. Check your WAF before an attacker does. WAF Bypass Tool is developed by Nemesida WAF team with the participation of...

LFI-Destruction

🔥 LFI-Destruction – Autorisiertes Penetrationstest-Framework LFI-Destroyer ist ein umfassendes, modulares Local-File-Inclusion-LFI-Exploitation-Framework, das für autorisierte Sicherheitsexperten entwickelt wurde. Es kombiniert mehrere Angriffstechniken in einem einzigen, einfach zu bedienenden...

lazyrecon

| | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and is optimized...

BurpParamFlagger

BurpParamFlagger Eine Burp-Erweiterung, die eine passive Scan-Prüfung hinzufügt, um Parameter zu kennzeichnen, deren Name oder Wert auf eine mögliche Einsatzstelle für SSRF oder LFI hinweisen könnte. Hinweis: Ich glaube, dass Burp Pro erforderlich ist, um diese Erweiterung zu nutzen, da sie auf d...

OWASP-mth3l3m3nt-framework

OWASP Mth3l3mnt Framework Ein leicht größeres Upgrade verzeiht das Wortspiel ist im Gange. Dies bringt Dinge wie: Einfachere Codierungsstandards Unterstützung für PHP 8 Robusterer Funktionsumfang Behebung von eingesandten Fehleranfragen. Dieses Tool wird unter der GNU Affero General Public Licens...

bugbounty-cheatsheet

Folha de Dicas de Bug Bounty 📚 Referência| 🔎 Vulnerabilidades ---|--- Plataformas de Bug Bounty| XSS Livros| SQLi Ferramentas Especiais| SSRF Reconhecimento| Injeção de CRLF Plataformas de Prática| Injeção de CSV Dicas de Bug Bounty| LFI | XXE | RCE | Redirecionamento Aberto | Criptografia |...

LFI-FINDER

🍀 LFI FINDER TOOL 🍀 Geschrieben von TMRSWRR Version 1.0.0 Instagram: TMRSWRR 📹 Wie man es verwendet 📹 Klicken Sie auf das Bild... LFI-FINDER ist ein Open-Source-Tool, das auf GitHub verfügbar ist und sich auf die Erkennung von Local File Inclusion LFI-Schwachstellen konzentriert. Local File...

Gu3ssWeak

Gu3ssWeak Um aplicativo Android deliberadamente vulnerável para pesquisa de segurança móvel, prática de bug bounty e aprendizado no estilo CTF. Contém 21 vulnerabilidades documentadas mapeadas para o OWASP Mobile Top 10. Início Rápido git clone [email protected]:b4sith-sec/Gu3ssWeak.git cd...

uro

uro Using a URL list for security testing can be painful as there are a lot of URLs that have uninteresting/duplicate content; uro aims to solve that. It doesn't make any http requests to the URLs and removes: incremental urls e.g. /page/1/ and /page/2/ blog posts and similar human written conten...

Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check. id: CVE-2020-29453 info: name: Jira Server Pre-Auth - Arbitrary File...

Ray Static File - Local File Inclusion

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. id: CVE-2023-6020 info: name: Ray Static File - Local File Inclusion author: byt3bl33d3r severity: high description: | LFI in Ray's /static/ directory allows attackers to read any file on the...

CMSimple 3.1 - Local File Inclusion

CMSimple 3.1 is susceptible to local file inclusion via cmsimple/cms.php when registerglobals is enabled which allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including...

ChatGPT个人专用版 - Server Side Request Forgery

A Server-Side Request Forgery SSRF in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter. id: CVE-2024-27564 info: name: ChatGPT个人专用版 - Server Side Request Forgery author: DhiyaneshDK...

Bonita BPM Portal <6.5.3 - Local File Inclusion

Bonita BPM Portal before 6.5.3 allows remote attackers to read arbitrary files via a .. dot dot in the theme parameter and a file path in the location parameter to bonita/portal/themeResource. id: CVE-2015-3897 info: name: Bonita BPM Portal 6.5.3 - Local File Inclusion author: 0xAkoko severity:...

Joomla! Component com_jvideodirect - Directory Traversal

Directory traversal vulnerability in the jVideoDirect comjvideodirect component for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-0942 info: name: Joomla! Component comjvideodirect - Directory Traversal author:...

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory or the backups-dup-pro/tmp directory in the Pro version, which temporarily stores files containing sensitive data. When directory listing is...

Mirasys DVMS Workstation <=5.12.6 - Local File Inclusion

Mirasys DVMS Workstation versions 5.12.6 and prior suffer from local file inclusion vulnerabilities. id: CVE-2018-8727 info: name: Mirasys DVMS Workstation =5.12.7 to mitigate the LFI vulnerability. reference: -...

Visual Composer <= 45.16.0 - Unauthenticated LFI

Visual Composer Website Builder for WordPress = 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication. id: CVE-2026-12227 info:...