WAF-A-MoLE

WAF-A-MoLE MLベースのWebアプリケーションファイアウォール（WAF）向けの、AFLに触発され、Andreas ZellerらのFuzzingBookを基にした ガイド付きミューテーションベースのファザー です。 SQLインジェクションクエリを入力として与えると、ターゲットのWAFをバイパスできる 意味論的に不変な クエリを生成しようとします。WAF-A-MoLEに解空間を探索させることで、ターゲットの分類器がカバーしていない危険な「盲点」を見つけ、製品の堅牢性を評価するためにこのツールを使用できます。 アーキテクチャ...

Angora

Angora Angora 是一个基于变异的覆盖引导模糊测试器。Angora 的主要目标是通过求解路径约束来提升分支覆盖率，而无需借助符号执行。 已发表论文 Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018. 构建 Angora 构建依赖 Linux-amd64（已在 Ubuntu 16.04/18.04 和 Debian Buster 上测试） Rust stable（= 1.31），可通过 rustup 获取 LLVM 4.0.0 - 12.0.1：运行 PREFIX=/path-to-install...

hyperpom

HYPERPOM Libreria di fuzzing AArch64 basata sull'hypervisor Apple Silicon Indice dei contenuti Disclaimer Per Iniziare Prerequisiti Binari auto-firmati ed entitlement dell'hypervisor Flusso di compilazione Documentazione Esempi...

Melkor_ELF_Fuzzer

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- - | -- DESCRIZIONE -- | - -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- - Melkor - Un Fuzzer per il Formato File ELF Melkor, un personaggio immaginario del legendarium della Terra di Mezzo di J. R. R. Tolkien, fu il primo Signore Oscuro e il maestro di...

DNG File Fuzzer for Robustness

This Python script is a mutation-based fuzzing tool designed to test the robustness of DNG Digital Negative / TIFF-based file parsers by generating large numbers of corrupted or semi-valid image files. It works by starting from a minimal valid DNG structure, then applying random mutations to...

CVE-2025-26791

A flaw was found in DOMPurify. This vulnerability allows attackers to execute mutation-based Cross-site scripting mXSS via an incorrect template literal regular expression...

Basecamp: Mutation Based Stored XSS on Trix Editor version latest (2.1.8)

A vulnerability was discovered in the Trix Editor version 2.1.8 where a mutation-based stored cross-site scripting XSS attack was possible. The vulnerability could be exploited by crafting a malicious payload that, when copied and pasted into the editor, would trigger the execution of arbitrary...

WAF-A-MoLE - A Guided Mutation-Based Fuzzer For ML-based Web Application Firewalls

A guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool for assessin...

Internet Bug Bounty: DOMPurify bypass

A mutation based bypass exists in DOMPurify when sanitizing svg elements using almost the same technique described by Michał Bentkowski @SecurityMB at https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/. A PoC payload with the DOM state before and after parsin...

Lavarel-Security XSS Filter Bypass Vulnerability

Lavarel-Security cross site scripting filter suffers from a bypass vulnerability. Product: Lavarel-Security XSS Filter Bypass Vulnerability: Mutation Based XSS Bypass Impact: Medium/High Authors: Rafay Baloch Company: RHAinfoSEC Website: http://rhainfosec.com Status: Fixed ========= Description...

OWASP Java Encoder Filter Bypass

Product: OWASP Java Encoder Vulnerability: Mutation Based XSS Bypass Impact: Medium/Limited Authors: Rafay Baloch And Alex Infuhr Company: RHAinfoSEC Website: http://services.rafayhackingarticles.net Status: To be fixed in the next release ========= Description ========= Owasp encoder is an...