CVE-2021-44228

Tai-e for CVE-2021-44228 This a sample project that utilizes Tai-e to identify Log4Shell a.k.a. CVE-2021-44228 vulnerability and its trigger paths Related video in Chinese: https://www.bilibili.com/video/BV1dV411F781 Getting started Clone this repository via Git: git clone...

clair

Clair Note : The main branch may be in an unstable or even broken state during development. Please use releases instead of the main branch in order to get stable binaries. Clair is an open source project for the static analysis of vulnerabilities in application containers currently including OCI...

uddup

UDdup - URLs Deduplication Tool The tool gets a list of URLs, and removes "duplicate" pages in the sense of URL patterns that are probably repetitive and points to the same web template. For example: https://www.example.com/product/123 https://www.example.com/product/456...

deepsecrets

DeepSecrets - a better tool for secret scanning !WARNING Active development was switched to the creator's fork at https://github.com/ntoskernel/deepsecrets. This repository will not receive any updates...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

uptux

uptux Specialized privilege escalation checks for Linux systems. Implemented so far: Writable systemd paths, services, timers, and socket units Disassembles systemd unit files looking for: References to executables that are writable References to broken symlinks pointing to writeable directories...

Invoke-DumpMDEConfig

DumpMDEConfig PowerShell Script Overview Invoke-DumpMDEConfig is a PowerShell script designed to extract and display Microsoft Defender configuration and logs, including excluded paths, enabled ASR rules, allowed threats, protection history, and Exploit Guard protection history. The script provid...

leaky-paths

About A collection of special paths linked to major web frameworks and infrastructure projects, known juicy APIs, misconfigurations.. etc. These could be used for web-content discovery as the fastest way to find quick wins. Goal With the goal of providing the community with high-quality wordlists...

LID

██╗ ██╗██████╗ ██║ ██║██╔══██╗ ██║ ██║██║ ██║ ██║ ██║██║ ██║ ███████╗██║██████╔╝ ╚══════╝╚═╝╚═════╝ Linux Integrity Drift — "Linux is Dying" — Systematic discovery of kernel code paths that bypass LSM security guarantees The gate was never breached. It was walked around. What is LID? The Linux...

meg

meg meg is a tool for fetching lots of URLs but still being 'nice' to servers. It can be used to fetch many paths for many hosts; fetching one path for all hosts before moving on to the next path and repeating. You get lots of results quickly, but non of the individual hosts get flooded with...

mole

Mole Mole is a Binary Ninja plugin designed to identify interesting execution paths in binaries. It performs backward slicing on variables using Binary Ninja 's Medium Level Intermediate Language MLIL in Static Single Assignment SSA form, forming the basis for a static taint analysis. In Mole , a...

Coercer

A python script to automatically coerce a Windows server to authenticate on an arbitrary machine through many methods. Windows Support To build a binary for Windows, download the installer.ps1 script from this repository. Run it simply with no arguments to create a binary in the working directory...

EUVD-2026-81586

vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting...

k8scout

k8scout Beta — A single-binary Kubernetes attack path engine for authorized security assessments. Drop it into a compromised pod, run it, and get a map of every realistic escalation path — from your current foothold to cluster-admin, node access, secret theft, and cloud IAM roles. The idea You ha...

go_parser

Yet Another Golang binary parser for IDAPro English |中文 NOTE : Now the latest master branch is the Python3 version. The old master branch has been changed to branch py2 , and temporarily not maintained. Instructions for Python3 branch This version is developed and tested on macOS/Windows, IDA7.4+...

Apache-CVE-2021-41773

CVE-2021-41773 Apache HTTP Server Path Traversal Contributors 이희수@lheeeesoo Apache HTTP Server 2.4.49에는 URL 경로를 정규화하는 과정에서 인코딩된 상위 경로를 제대로 차단하지 못하는 취약점이 존재한다. 공격자는 .%2e와 같은 값을 이용하여 웹 서버가 공개하도록 설정한 디렉터리 밖으로 이동할 수 있다. 외부 디렉터리에 대한 접근이 허용된 환경에서는 서버 내부 파일이 노출될 수 있으며, CGI 기능이 활성화된 경우에는 시스템 셸을 실행하여 원격 명...

forbiddenpass

UPDATE Thanks to Knowledge-Wisdom-Understanding MrPMillz for making the script cleaner and fixing the header payloads. INSTALLATION git clone https://github.com/gotr00t0day/forbiddenpass.git cd forbiddenpass pip3 install -r requirements.txt python3 forbiddenpass.py -h USAGE . . . . \ /\ | || | /|...

Dop2Mop

Dop2Mop A proof-of-concept OpenGraph collector for BloodHound that maps attack paths from DevOps to MLOps infrastructure. Based on Pipelines of Privilege: Attack Paths from DevOps to MLOps Infrastructure by Brett Hawkins @h4wkst3r. Table of Contents Acknowledgments Overview Supported Platforms...

CVE-2024-1086-checker

CVE-2024-1086-checker 이것은 취약한 커널 구성을 탐지하는 간단한 체커 스크립트입니다. 이 스크립트에서 "kernel config not vulnerable" 결과가 나온다는 것은 현재 알려진 경로로는 취약점을 악용할 수 없다는 뜻일 뿐입니다. 사용 방법 curl -s "https://raw.githubusercontent.com/kevcooper/CVE-2024-1086-checker/main/checkcve20241086.py" | python3 git clone...

debugHunter

debugHunter 숨겨진 디버그 엔드포인트 및 개발 환경을 발견하세요 버그 바운티 헌터와 침투 테스터를 위한 필수 Chrome 확장 프로그램 브라우징하는 동안 디버그 매개변수, 민감한 헤더 및 노출된 경로를 수동적으로 탐지합니다. 왜 debugHunter인가? 디버그 엔드포인트와 노출된 구성 파일을 찾는 것은 버그 바운티 헌팅에서 흔한 기술입니다. debugHunter 는 방문하는 모든 웹사이트를 수동적으로 스캔하여 발견 시 경고함으로써 이 과정을 자동화합니다: 🔧 디버그 매개변수 — ?debug=1, ?env=dev,...