onionscan

¿Qué es OnionScan? OnionScan es una herramienta gratuita y de código abierto para investigar la Dark Web. A pesar de todas las increíbles innovaciones tecnológicas en el ámbito del anonimato y la privacidad, siempre existe una amenaza constante que no tiene un parche tecnológico efectivo: el erro...

Atlas

Atlas - Quick SQLMap Tamper Suggester v1.0 Atlas is an open source tool that can suggest sqlmap tampers to bypass WAF/IDS/IPS, the tool is based on returned status code. Screen Installation root@kitploit: $ git clone https://github.com/m4ll0k/Atlas.git atlas $ cd atlas $ python atlas.py python3+...

de4dot

Description de4dot is an open source GPLv3 .NET deobfuscator and unpacker written in C. It will try its best to restore a packed and obfuscated assembly to almost the original assembly. Most of the obfuscation can be completely restored eg. string encryption, but symbol renaming is impossible to...

doork

doork description doork is a open-source passive vulnerability auditor tool that automates the process of searching on Google information about specific website based on dorks. doork can update his own database from ghdb and use it for find flaws without even contact the target endpoint. You can...

whitewidow

Preamble Firstly readthis if you want Whitewidow development to continue. Hello all you whitewidow fans out there I say that with good intentions I promise!. It's me Ekultek, I'm just here to give you a little inside on what's going on with the whitewidow development team and what's happening wit...

TBomb

TBomb v2.1b A free and open-source SMS/Call bombing application Announcement Important Notice: Due to a combination of low-quality contributions, spam pull requests/issues, and my shift towards exploring new projects, I’ve made the decision to archive this repository. This project has been one of...

EAST

Extensible Azure Security Tool Extensible Azure Security Tool Later referred as E.A.S.T is tool for assessing Azure and to some extent Azure AD security controls. Primary use case of EAST is Security data collection for evaluation in Azure Assessments. This information JSON content can then be us...

metasploit-framework-nu11secur1ty

Metasploit Framework El Metasploit Framework es una herramienta de código abierto publicada bajo una licencia estilo BSD. Para obtener información detallada sobre la licencia, consulte el archivo COPYING. Última Versión Acceda a la última versión de Metasploit desde la página Instaladores...

GoF5-CVE-2020-5902

GoF5-CVE-2020-5902 Utilidad Open-Source para validar la vulnerabilidad crítica en F5 BIG-IP Traffic Management User Interface TMUI CVE-2020-5902 hecho en Golang. Demo Windows...

NETworkManager v2026.9.7.0

NETworkManager A powerful open-source tool for managing networks and troubleshooting network problems! Streamline and simplify your network administration and troubleshooting with NETworkManager. Connect, monitor, and troubleshoot your network and server infrastructure using built-in tools like...

AperiSolve v3.7.10

Aperi'Solve Try it now: https://www.aperisolve.com Support Aperi'Solve: Aperi'Solve is an open-source steganalysis web platform that performs automated analysis on images to detect and extract hidden data using common steganography tools and techniques. Key features Visualize each bit layer LSB a...

UBUNTU-CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

CVE-2026-19264

Postiz is an open-source social media scheduling tool. The route that serves locally stored media joins URL-supplied path segments onto the upload directory and streams the file without normalising the path or confining it to that directory, and the route requires no authentication. Raw...

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's...

XSSer Penetration Testing Tool 1.9

XSSer is an open source penetration testing tool that automates the process of detecting and exploiting XSS injections against different applications. It contains several options to try to bypass certain filters, and various special techniques of code injection. 12 additions, 12 modifications, 10...

CVE-2026-50030

DataEase prior to 2.10.23 exposes the SQL preview path (DatasetDataApi.previewSql/previewSqlCheck) via /de2api/datasetData/previewSql, accepting PreviewSqlDTO.sql, PreviewSqlDTO.datasourceId, and PreviewSqlDTO.isCross. The system stores decoded SQL in datasourceRequest.query and CalciteProvider.f...

EUVD-2026-41983

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Livewire component Server\Resources exposes public methods startUnmanaged, stopUnmanaged, restartUnmanaged that accept a container ID parameter directly from the browse...

EUVD-2026-41982

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, log drain secret and environment values were interpolated into shell commands without sufficient encoding, allowing an authenticated user to inject commands executed on the...

CVE-2026-42172

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. This issue is fixed in version 4.0.0-beta.474...

EUVD-2026-41980

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Sanctum API tokens did not expire, allowing a leaked token to retain access indefinitely until manually revoked. This issue is fixed in version 4.0.0-beta.474...