GHSA-87MG-5GRR-RHWH Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Summary The Feed Reader front-end module passes RSS feed URLs from its configuration directly to $this-feedIo-read$url without any scheme validation or private-IP blocklist. A backend user with module-edit permissions can configure an arbitrary URL pointing to internal network services,...

stringsifter

StringSifter is a machine learning tool that automatically ranks strings based on their relevance for malware analysis. Quick Links Technical Blogpost - Learning to Rank Strings Output for Speedier Malware Analysis Announcement Blogpost - Open Sourcing StringSifter DerbyCon Talk - StringSifter:...

protobuf-inspector

protobuf-inspector Programa simple que puede analizar blobs codificados en Google Protobuf versión 2 o 3 sin conocer su definición acompañante. Imprimirá una representación agradable y coloreada de su contenido. Ejemplo: Como puede ver, los nombres de los campos se pierden obviamente, junto con...

awesome-rust-security

Awesome Rust Security Curated list of awesome projects and resources related to Rust and computer security Table of Contents Tools Web and Cloud Security Vulnerability Assessment Offensive Security and Red Teaming Threat Detection and Forensics Cryptography Applications Educational Books Articles...

siem

Offensive SIEM Practical techniques for leveraging SIEM as an offensive discovery tool, helping defenders think like attackers to strengthen security from within. Queries See above - queries.md file. Will keep getting updated when needed. The idea is to have layer on layer coverage using differen...

link

link link is a command and control framework written in rust. Currently in beta. Table of Contents Introduction Features Feedback Build Process Acknowledgments Introduction...

link

link link es un framework de comando y control escrito en Rust. Actualmente en beta. Tabla de Contenidos Introduction Features Feedback Build Process Acknowledgments Introducción...

codex-security

Codex Security @openai/codex-security is a CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in your code. 👉👉 See theCodex Security documentation for full documentation. Some cybersecurity requests and protected findings require approval through Trusted Access fo...

bunkerweb

🌐 Website | 🤝 Panel | 📓 Documentation | 👨‍💻 Demo | 📱 Demo UI | 🧩 Templates | 🛡️ Examples 💬 Chat | 📝 Forum | 📝 Community | 🗺️ Threatmap | 📊 Status | 🔎 Feedback 🛡️ Make security by default great again! BunkerWeb Bun...

Sn1per

Products Attack Surface Management About Sn1per News Contact Demo Pricing Shop Sn1per — The Offensive-Security Platform for Modern Teams Recon, scanning, exploitation, and reporting in a single workspace — whether you're a solo pentester or a global SOC. Sn1per Professional 2026 is here The large...

Shadowbroker

🛰️ S H A D O W B R O K E R Intercepción Global de Amenazas — Plataforma de Inteligencia Geoespacial en Tiempo Real ShadowBroker ShadowBroker es una plataforma de inteligencia descentralizada que agrega telemetría OSINT en tiempo real de múltiples dominios desde más de 60 fuentes de inteligencia en...

Writeups

Writeups Collection of detailed and optimized? write-ups for various CTF challenges...

VulnerableGWTApp

Vulnerable GWT Web Application This is a version of the StockWatcher example application described in the GWT getting-started guide that has been modified to use the GWT "enhanced classes" feature, making it vulnerable to a Java deserialization attack. It should only be used for testing detection...

idalib-cli

️ idalib-cli Agent-native CLI for the IDA Pro IDALib — every command takes one -d/--db flag, every answer is JSON. English · 中文 ✨ Features 🗄️ Stateless — pass -d/--db a binary or an .i64; no daemon, no session bookkeeping. 💾 Persistent IDB state — the IDB file is the state: comments, bookmarks,...

clusterd

clusterd clusterd es un conjunto de herramientas de ataque para servidores de aplicaciones de código abierto. Nacido de la frustración con los métodos actuales de fingerprinting y explotación, clusterd automatiza las fases de fingerprinting, reconocimiento y explotación de un ataque a servidores ...

yersinia

Árbol de expansión 1: Ataque DoS enviando BPDUs de configuración root@kitploit: ¡Enviemos algunos BPDUs de configuración afirmando ser la raíz!!! Al enviar continuamente BPDUs de configuración con root pathcost 0, ID de puente generado aleatoriamente y por lo tanto el mismo ID raíz, y algunos...

yersinia

Spanning Tree 1: DOS attack sending conf BPDUs root@kitploit: Let's send some conf BPDUs claiming be root!!! By sending continously conf BPDU with root pathcost 0, randomly generated bridge id and therefore the same root id, and some default values for other fields, we try to annoy the switches...

dex-oracle

Oracle Un desofuscador Dalvik basado en patrones que utiliza ejecución limitada para mejorar el análisis semántico. También, la inspiración para otro desofuscador Android: Simplify. Antes Después sha1: a68d5d2da7550d35f7dbefc21b7deebe3f4005f3 md5: 2dd2eeeda08ac8c15be8a9f2d01adbe8 Instalación Paso...

h4rpy

h4rpy h4rpy es una herramienta automatizada de ataque WPA/WPA2 PSK, un wrapper del framework aircrack-ng. h4rpy proporciona una interfaz limpia para el descifrado automatizado de redes WPA/WPA2 PSK. h4rpy habilita el modo monitor en la interfaz inalámbrica seleccionada, escanea el espacio...

crackle

crackle cracks BLE Encryption AKA Bluetooth Smart. crackle exploits a flaw in the BLE pairing process that allows an attacker to guess or very quickly brute force the TK Temporary Key. With the TK and other data collected from the pairing process, the STK Short Term Key and later the LTK Long Ter...