browsertunnel

browsertunnel Browsertunnel is a tool for exfiltrating data from the browser using the DNS protocol. It achieves this by abusing dns-prefetch, a feature intended to reduce the perceived latency of websites by doing DNS lookups in the background for specified domains. DNS traffic does not appear i...

Pummel

██████╗ ██╗ ██╗███╗ ███╗███╗ ███╗███████╗██╗ ██╔══██╗██║ ██║████╗ ████║████╗ ████║██╔════╝██║ ██████╔╝██║ ██║██╔████╔██║██╔████╔██║█████╗ ██║ ██╔═══╝ ██║ ██║██║╚██╔╝██║██║╚██╔╝██║██╔══╝ ██║ ██║ ╚██████╔╝██║ ╚═╝ ██║██║ ╚═╝ ██║███████╗███████╗ ╚═╝ ╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚══════╝ Disclaimer:...

orbitaldump

OrbitalDump A simple multi-threaded distributed SSH brute-forcing tool written in Python. How it Works When the script is executed without the --proxies switch, it acts just like any other multi-threaded SSH brute-forcing scripts. When the --proxies switch is added, the script pulls a list usuall...

fireprox

FireProx Overview Benefits Disclaimers Maintainer Credit Basic Usage Installation Screenshots Contributing Overview Being able to hide or continually rotate the source IP address when making web calls can be difficult or expensive. A number of tools have existed for some time but they were either...

authelia

!OpenSSF Scorecardhttps://shieldcn.dev/badge/dynamic/json.svg?url=https://img.shields.io/ossf-scorecard/github.com/authelia/authelia.json&query=$.message&label=openssf%20scorecard&logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmc...

http-garden

The HTTP Garden The HTTP Garden is a collection of HTTP servers and proxies configured to be composable, along with scripts to interact with them in a way that makes finding vulnerabilities much much easier. For some cool demos of the vulnerabilities that you can find with the HTTP Garden, check...

elite-proxy-finder

elite-proxy-finder This script was not working for a few months. I just fixed it 7/6/15. Only uses gatherproxy.com now. Finds elite anonymity L1 HTTP proxies then tests them all in parallel. Tests each proxy against 3 IP checking URLs including one which is HTTPS to make sure it can handle HTTPS...

pastego

pastego Scrape/Parse Pastebin using GO and grammar expression PEG. pastego.png Installation $ go get -u github.com/notdodo/pastego Usage Search keywords are case sensitive pastego -s "password,keygen,PASSWORD" You can use boolean operators to reduce false positive pastego -s "quake && earthquake,...

Oracle E-Business Suite <=12.2 - Authentication Bypass

Oracle E-Business Suite component: Manage Proxies 12.1 and 12.2 are susceptible to an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise it by self-registering for an account. Successful attacks of this vulnerability can result in...

ProxyListReliabilityCheck

ProxyListReliabilityCheck Perl script to test the reliability of a list of open web proxies. The script takes in a text file list of IPAddress:Port of open web proxies to test 1 per line. It then attempts to crawl to the following URL through each target proxy:...

CVE-2023-44487

HTTP/2 Rapid Reset: CVE-2023-44487 Description This repository contains proof-of-concept PoC code for the HTTP/2 Rapid Reset vulnerability identified as CVE-2023-44487. Vulnerability Overview CVE ID : CVE-2023-44487 Impact : Denial of Service DoS Affected Protocols : HTTP/2 Affected Components :...

Low-Cost Android Phones Ship With Preinstalled Malware That Turns Them Into Residential Proxies

Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several...

orbitaldump

OrbitalDump Una herramienta simple de fuerza bruta SSH distribuida y multi-hilo escrita en Python. Cómo funciona Cuando el script se ejecuta sin la opción --proxies, actúa como cualquier otro script de fuerza bruta SSH multi-hilo. Cuando se añade la opción --proxies, el script obtiene una lista...

com.github.sstone:akka-amqp-proxies_2.10 (1.4-ml1), com.github.sstone:amqp-client_2.10 (>=1.3-ml1, <=1.4-ml4) +4 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (3.2.1)

com.rabbitmq:amqp-client MAVEN version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.sstone:akka-amqp-proxies2.10 1.4-ml1 - com.github.sstone:amqp-client2.10 =1.3-ml1, =0.9.0, =0.7.0,...

com.github.sstone:akka-amqp-proxies_2.10 (1.4-ml1), com.github.sstone:amqp-client_2.10 (>=1.3-ml1, <=1.4-ml4) +4 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (3.2.1)

com.rabbitmq:amqp-client MAVEN version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.sstone:akka-amqp-proxies2.10 1.4-ml1 - com.github.sstone:amqp-client2.10 =1.3-ml1, =0.9.0, =0.7.0,...

com.github.sstone:akka-amqp-proxies_2.10 (>=1.1-rc1, <=1.3), com.github.sstone:akka-amqp-proxies_2.10.1 (1.2) +1 more potentially affected by CVE-2026-106123 via com.rabbitmq:amqp-client (3.0.1)

com.rabbitmq:amqp-client MAVEN version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.sstone:akka-amqp-proxies2.10 =1.1-rc1, =1.1-rc1, =1.1 Source cves: CVE-2026-106123 Source advisory:...

CVE-2026-107207

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach...

CVE-2026-107207

LMCache versions through 0.5.5 are vulnerable to a server-side request forgery (SSRF) vulnerability in the frontend monitoring service. Due to missing authentication in the frontend node catalog, unauthenticated attackers can register arbitrary hosts via POST /api/proxies . Once registered, these...

CVE-2026-107207 LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach...

CVE-2026-107207 LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach...