WAF-A-MoLE

WAF-A-MoLE A guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool f...

Angora

Angora Angora es un fuzzer guiado por cobertura basado en mutaciones. El objetivo principal de Angora es aumentar la cobertura de ramas resolviendo restricciones de rutas sin ejecución simbólica. Trabajo Publicado Arxiv: Angora: Efficient Fuzzing by Principled Search, S&P 2018. Compilar Angora...

hyperpom

HYPERPOM AArch64 fuzzing library based on the Apple Silicon hypervisor Table of contents Disclaimer Getting Started Prerequisites Self-Signed Binaries and Hypervisor Entitlement Compilation Workflow Documentation Examples Running the Tests Authors Hyperpom is a coverage-guided mutation-based...

Melkor_ELF_Fuzzer

-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- - | -- DESCRIPTION -- | - -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- - Melkor - An ELF File Format Fuzzer Melkor, a fictional character from J. R. R. Tolkien's Middle-earth legendarium, was the first Dark Lord and master of Sauron. He's mentioned...

DNG File Fuzzer for Robustness

This Python script is a mutation-based fuzzing tool designed to test the robustness of DNG Digital Negative / TIFF-based file parsers by generating large numbers of corrupted or semi-valid image files. It works by starting from a minimal valid DNG structure, then applying random mutations to...

CVE-2025-26791

A flaw was found in DOMPurify. This vulnerability allows attackers to execute mutation-based Cross-site scripting mXSS via an incorrect template literal regular expression...

Basecamp: Mutation Based Stored XSS on Trix Editor version latest (2.1.8)

A vulnerability was discovered in the Trix Editor version 2.1.8 where a mutation-based stored cross-site scripting XSS attack was possible. The vulnerability could be exploited by crafting a malicious payload that, when copied and pasted into the editor, would trigger the execution of arbitrary...

WAF-A-MoLE - A Guided Mutation-Based Fuzzer For ML-based Web Application Firewalls

A guided mutation-based fuzzer for ML-based Web Application Firewalls, inspired by AFL and based on the FuzzingBook by Andreas Zeller et al. Given an input SQL injection query, it tries to produce a semantic invariant query that is able to bypass the target WAF. You can use this tool for assessin...

Internet Bug Bounty: DOMPurify bypass

A mutation based bypass exists in DOMPurify when sanitizing svg elements using almost the same technique described by Michał Bentkowski @SecurityMB at https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/. A PoC payload with the DOM state before and after parsin...

Lavarel-Security XSS Filter Bypass Vulnerability

Lavarel-Security cross site scripting filter suffers from a bypass vulnerability. Product: Lavarel-Security XSS Filter Bypass Vulnerability: Mutation Based XSS Bypass Impact: Medium/High Authors: Rafay Baloch Company: RHAinfoSEC Website: http://rhainfosec.com Status: Fixed ========= Description...

OWASP Java Encoder Filter Bypass

Product: OWASP Java Encoder Vulnerability: Mutation Based XSS Bypass Impact: Medium/Limited Authors: Rafay Baloch And Alex Infuhr Company: RHAinfoSEC Website: http://services.rafayhackingarticles.net Status: To be fixed in the next release ========= Description ========= Owasp encoder is an...