CVE-2025-30208-EXP

CVE-2025-30208-EXP Vite development server arbitrary file read vulnerability CVE-2025-30208, with wide coverage, simple exploitation, and no restrictions, posing a huge threat! Fofa search syntax: body="/@vite/client" Hunter search syntax: web.body="/@vite/client" Exp script usage -u to check -p...

CredMaster

CredMaster Launch a password spray / brute force attach via Amazon AWS passthrough proxies, shifting the requesting IP address for every authentication attempt. This dynamically creates FireProx APIs for more evasive password sprays. Shoutout to @ustayready for his CredKing and FireProx tools,...

python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

kalitorify

Transparent Proxy through Tor for Kali Linux About kalitorify kalitorify is a shell script for Kali Linux which use iptables settings to create a Transparent Proxy through the Tor Network , the program also allows you to perform various checks like checking the Tor Exit Node i.e. your public IP...

python-tornado: Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding

A vulnerability was discovered in Tornado where it improperly handles HTTP requests containing duplicate Transfer-Encoding: chunked headers. When duplicate Transfer-Encoding headers are present in an incoming request, Tornado ignores them and treats the request as body-less, leaving the chunked...

DSSS

Damn Small SQLi Scanner Damn Small SQLi Scanner DSSS is a fully functional SQL injection vulnerability scanner supporting GET and POST parameters written in under 100 lines of code. As of optional settings it supports HTTP proxy together with HTTP header values User-Agent, Referer and Cookie...

extended-xss-search

Extended XSS Searcher and Finder This is the extended version based on the initial idea already published as "xssfinder". This private version allows an attacker to perform not only GET but also POST requests. Additionally its possible to proxy every request through Burp or another tunnel. First...

hakoriginfinder

hakoriginfinder Tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies. How does it work? This tool will first make a HTTP request to the hostname/URL that you provide and store the response, then it will make a request to every IP address...

CVE-2014-1266-poc

OS X/iOS SSL Flaw POC Overview This repository contains some Go code that demonstrates the recently discovered SSL verification vulnerability in iOS and OS X. Apple Update Announcement Adam Langley's writeup Usage $ git clone https://github.com/gabrielg/CVE-2014-1266-poc.git $ cd CVE-2014-1266-po...

OnionHop

OnionHop V3 OnionHop V3 is a modern, cross-platform desktop app Windows, macOS and Linux that routes your traffic through Tor. It can run Tor as a local SOCKS proxy or as a system-wide tunnel, automatically pick a working connection strategy for your network with Smart Connect , scan and apply...

ssct

ShadowSocks ConnecTion A wrapper tool for shadowsocks to consistently bypass firewalls. Quick start Automatically connect The easiest way to run this tool is just type ssct in terminal, and ssct will acquire available shadowsocks servers from ishadowsocks and connect to it automatically. Connect ...

Invoke-SocksProxy

Invoke-SocksProxy Creates a local or "reverse" Socks proxy using powershell. The local proxy is a simple Socks 4/5 proxy. The reverse proxy creates a tcp tunnel by initiating outbond SSL connections that can go through the system's proxy. The tunnel can then be used as a socks proxy on the remote...

filtron

Filtron Reverse HTTP proxy to filter requests by different rules. Can be used between production webserver and the application server to prevent abuse of the application backend. The original purpose of this program was to defend searx, but it can be used to guard any web application. Installatio...

webhandler

WebHandler A handler for PHP system functions & also an alternative 'netcat' handler Info WebHandler tries to simulate a 'Linux bash prompt' to handle and process: - PHP program execution functions e.g. system, passthru, exec, etc - Bind shell connections - Reserve shell connections Another featu...

mallet

Mallet, a framework for creating proxies Mallet is a tool for creating proxies for arbitrary protocols, along similar lines to the familiar intercepting web proxies, just more generic. It is built upon the Netty framework, and relies heavily on the Netty pipeline concept, which allows the graphic...

Zeus-Scanner

Annuaire des liens utiles Qu'estce que Zeus Les caractéristiques de Zeus Exigences et installation Ubuntu/Debian centOS autre Capturesécran vidéo Demo manuel d'utilisation Comment fonctionne Zeus Fonctionnalité Passant drapeaux sqlmap avec Zeus Informations légales Licence GPL Code de conduite...

frp

frp README | 中文文档 Sponsors frp is an open source project with its ongoing development made possible entirely by the support of our awesome sponsors. If you'd like to join them, please consider sponsoring frp's development. Gold Sponsors Recall.ai - API for meeting recordings If you're looking for...

DllShimmer

DllShimmer Weaponize DLL hijacking easily. Backdoor any function in any DLL without disrupting normal process operation. How it works DllShimmer parses the original DLL and extracts information about exported functions name, ordinal number, and forwarder info. Based on this information, DllShimme...

titus

Titus: High-Performance Secrets Scanner Titus is a high-performance secrets scanner that detects credentials, API keys, and tokens in source code, files, and git history. It ships with 487 detection rules covering hundreds of services and credential types, drawn from NoseyParker and Kingfisher...

Shwmae

Shwmae Shwmae shuh-my is a Windows Hello abuse tool that was released during DEF CON 32 as part of the Abusing Windows Hello Without a Severed Hand talk. The purpose of the tool is to abuse Windows Hello from a privileged user context. Shwmae Copyright C 2024 Shwmae enum Default Verb Enumerate...