wBlock

wBlock The end of Safari ad-blocking B.S. A free, open-source ad blocker for Safari on Mac, iPhone, iPad, and Apple Vision Pro. Safari gives ad blockers very little room. Each content blocker gets 150,000 rules and can't touch a page's JavaScript. wBlock ships five of them 750,000 rules plus a...

CVE-2023-51802

CVE-2023-51802 Simple Student Attendance System v.1.0 - attendancereport 中的跨站脚本 XSS 漏洞 描述 : Simple Student Attendance System v.1.0 中的跨站脚本漏洞允许远程攻击者通过向 attendancereport 组件的 "page" 或 "classmonth" 参数传递精心构造的负载来执行任意代码。 受影响产品版本 : Simple Student Attendance System v.1.0 CVE 作者 : Geraldo Alcântara 日期 :...

r4ven

If you find this GitHub repo useful, please consider giving it a star! ⭐️ ▶️ Watch Video - How To Use! This project is a security research and awareness tool designed to demonstrate how modern web browsers may expose location data, camera access, IP address, and device information when users...

wig

wig - Web应用信息收集器 wig是一个网络应用信息收集工具，可以识别众多内容管理系统和其他管理应用。 应用指纹识别基于已知CMS不同版本文件的校验和与字符串匹配。据此为每个检测到的CMS及其版本计算评分。每个检测到的CMS会与最可能的版本一起显示。评分计算基于权重和给定校验和的"命中"数量。 wig还会尝试根据服务器返回的'server'和'x-powered-by'头信息猜测服务器操作系统。wig包含一个已知不同操作系统头信息的数据库，使其能够猜测Microsoft Windows版本以及Linux发行版及其版本。 系统要求 wig使用Python 3 构建，因此不兼容Pyth...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

GenGravSSTIExploit

英文 GenGravSSTIExploit 是一个 PoC Python 脚本，利用 Grav CMS 版本 -p ：目标 URL，格式为 https://hostname。 ：端口号（默认为 80）。 示例： python GenGravSSTIExploit.py -t http://example.com -p 8080 4. 与 Exploit 交互 如果利用成功，你会获得一个可以执行操作系统命令的 URL： + RCE payload injected. Visit the malicious page: http://example.com:8080/poc?do= 示例输出...

objection

📱objection - Runtime Mobile Exploration objection is a runtime mobile exploration toolkit, powered by Frida, built to help you assess the security posture of your mobile applications, without needing a jailbreak. Supports both iOS and Android. Inspect and interact with container file systems...

r77-rootkit

r77 Rootkit Fileless ring 3 rootkit r77 is a ring 3 rootkit that hides everything: Files, directories Processes & CPU/GPU usage Registry keys & values Services TCP & UDP connections Junctions, named pipes, scheduled tasks Hiding by prefix Everything that starts with "$77" is hidden. Configuration...

cve-2025-22294

CVE-2025-2294 – 本地文件包含 LFI 在 WordPress 插件 Kubio AI Page Builder 中 详细 write-up 的链接 部署的链接 exp 的链接 批量检测文件的链接： 主动检测模板 被动检测模板 Python 批量检测 exp Golang 批量检测 exp 所有图片均从文件夹 images 加载...

Gixy-Next

Gixy-Next: NGINX Configuration Security Scanner for Security Audits Overview Gixy-Next Gixy is an open-source NGINX configuration security scanner and hardening tool that statically analyzes your nginx.conf to detect security misconfigurations, hardening gaps, and common performance pitfalls befo...

peirates

Peirates What is Peirates? Peirates, a Kubernetes penetration tool, enables an attacker to escalate privilege and pivot through a Kubernetes cluster. It automates known techniques to steal and collect service account tokens, secrets, obtain further code execution, and gain control of the cluster...

CVE-2025-2294

CVE-2025-2294 简介 CVE-2025-2294 是 WordPress 的 Kubio AI Page Builder 插件中的一个本地文件包含（LFI）类型的关键漏洞。该漏洞允许 未经身份验证的远程攻击者传递一个特制参数，导致插件可以包含服务器上的任意文件；如果包含的是可执行的 PHP 文件，则可能导致远程代码执行（RCE）。 受影响版本： 所有插件版本 ≤ 2.5.1 。 CVSS v3.1： 9.8（严重） 。 报告目的 1. 系统整理现有资料并解释漏洞的本质。 2. 审查漏洞生效的条件和配置。 3. 展示检测方法和防护建议（不含逐步 PoC）。 4...

osmedeus

Osmedeus Osmedeus - A Modern Orchestration Engine for Security What is Osmedeus? Osmedeus is a security focused declarative orchestration engine that simplifies complex workflow automation into auditable YAML definitions, complete with encrypted data handling, secure credential management, and...

osmedeus

Osmedeus Osmedeus - A Modern Orchestration Engine for Security What is Osmedeus? Osmedeus is a security focused declarative orchestration engine that simplifies complex workflow automation into auditable YAML definitions, complete with encrypted data handling, secure credential management, and...

CVE-2025-55182-bypass

CVE-2025-55182 请求头绕过 针对 CVE-2025-55182 的 Next-Action 请求头绕过。无需特征请求头即可实现 React RSC RCE，从而绕过 WAF 规则。 关键发现 利用过程无需 Next-Action 请求头。 攻击向量| Next-Action 请求头| WAF 检测 ---|---|--- 原始 CVE| 必需| 可检测 本绕过| 无需| 规避请求头规则 工作原理 ┌─────────────────────────────────────────────────────────────────────────────┐ │ ORIGINAL...

GetBlocked

GetBlocked! Cleaner pages. Fewer trackers. Local-only. GetBlocked! is a lightweight, local-only Chrome extension that helps reduce common third-party website tracking by blocking known tracker requests, cleaning tracking links, and explaining tracking attempts. An optional experimental Decoy Mode...

infernal-twin

Infernal-Wireless v3 Release 3 Improved and Compatibility on Kali Linux 2018 Added Visual Representation of Wireless Scan Added Visual Representation of Probe Requests and Map per SSID requested by Devices Updated MAC address mapping Added MAC address mappting on probe request devices Evil Twin...

feroxbuster

!WARNING Security Notice – Domain Impersonation The domain feroxbuster.com is NOT affiliated with this project, its maintainers, or any official feroxbuster releases. Official feroxbuster downloads are distributed ONLY through: https://github.com/epi052/feroxbuster open source...

dnsdiag

DNS Measurement, Troubleshooting and Security Auditing Toolset Have you ever wondered if your ISP is intercepting your DNS traffic? Have you noticed any unusual behavior in your DNS responses, or been redirected to the wrong address and suspected something might be off with your DNS? We offer a...

dorkbot

dorkbot Scan Google or other search results for vulnerabilities. dorkbot is a modular command-line tool for performing vulnerability scans against sets of webpages returned by Google search queries or other supported sources. It is broken up into two sets of modules: Indexers - modules that retur...