WAF-A-MoLE

WAF-A-MoLE Un fuzzer guiado basado en mutaciones para Cortafuegos de Aplicaciones Web basados en ML, inspirado en AFL y basado en el FuzzingBook de Andreas Zeller y otros. Dada una consulta de inyección SQL de entrada, intenta producir una consulta semánticamente invariante que sea capaz de eludi...

Angora

Angora Angora is a mutation-based coverage guided fuzzer. The main goal of Angora is to increase branch coverage by solving path constraints without symbolic execution. Published Work Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018. Building Angora Build Requirements Linux-amd64...

hyperpom

HYPERPOM AArch64 fuzzing library based on the Apple Silicon hypervisor Table of contents Disclaimer Getting Started Prerequisites Self-Signed Binaries and Hypervisor Entitlement Compilation Workflow Documentation Examples Running the Tests Authors Hyperpom is a coverage-guided mutation-based...

Melkor_ELF_Fuzzer

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- - | -- DESCRIPTION -- | - -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- - Melkor - An ELF File Format Fuzzer Melkor, a fictional character from J. R. R. Tolkien's Middle-earth legendarium, was the first Dark Lord and master of Sauron. He's mentioned...

DNG File Fuzzer for Robustness

This Python script is a mutation-based fuzzing tool designed to test the robustness of DNG Digital Negative / TIFF-based file parsers by generating large numbers of corrupted or semi-valid image files. It works by starting from a minimal valid DNG structure, then applying random mutations to...

CVE-2025-26791

A flaw was found in DOMPurify. This vulnerability allows attackers to execute mutation-based Cross-site scripting mXSS via an incorrect template literal regular expression...

Basecamp: Mutation Based Stored XSS on Trix Editor version latest (2.1.8)

A vulnerability was discovered in the Trix Editor version 2.1.8 where a mutation-based stored cross-site scripting XSS attack was possible. The vulnerability could be exploited by crafting a malicious payload that, when copied and pasted into the editor, would trigger the execution of arbitrary...

WAF-A-MoLE - A Guided Mutation-Based Fuzzer For ML-based Web Application Firewalls

A guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool for assessin...

Internet Bug Bounty: DOMPurify bypass

A mutation based bypass exists in DOMPurify when sanitizing svg elements using almost the same technique described by Michał Bentkowski @SecurityMB at https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/. A PoC payload with the DOM state before and after parsin...

Lavarel-Security XSS Filter Bypass Vulnerability

Lavarel-Security cross site scripting filter suffers from a bypass vulnerability. Product: Lavarel-Security XSS Filter Bypass Vulnerability: Mutation Based XSS Bypass Impact: Medium/High Authors: Rafay Baloch Company: RHAinfoSEC Website: http://rhainfosec.com Status: Fixed ========= Description...

OWASP Java Encoder Filter Bypass

Product: OWASP Java Encoder Vulnerability: Mutation Based XSS Bypass Impact: Medium/Limited Authors: Rafay Baloch And Alex Infuhr Company: RHAinfoSEC Website: http://services.rafayhackingarticles.net Status: To be fixed in the next release ========= Description ========= Owasp encoder is an...