CVE-2025-31486-PoC

Disclaimer: The vulnerabilities described in this article and their reproduction steps are intended solely for cybersecurity research and educational purposes. No one may use the information provided herein for illegal purposes or unauthorized system testing. The author assumes no responsibility...

hackEmbedded

hackebds 🔗中文 readme Overview hackebds is a toolkit for embedded-device payload generation, encrypted shell workflows, SOCKS5 proxy tunneling, and device information lookup. The current branch uses a pure ELF workflow for encrypted shell and proxy features: reverseshellfile + encryptedshellserver ...

pacpoc

PACPoC: A local PoC exploit for CVE-2019-2205 To try out this exploit install the "malicious" app PacTest.apk and make exploit.pac available over http with, for example python -m SimpleHTTPServer. Then go to proxy settings on an Android device, select proxy autoconfig, and enter the URL to...

festin

FestIN the powered S3 bucket finder and content discover What is FestIn Why Festin Install Using Python Using Docker Full options Usage Configure search domains Concurrency HTTP Crawling configuration Manage results Proxy usage DNS Options Full Text Support Running as a service or watching mode...

CVE-2024-47066

CVE-2024-47066 ★ CVE-2024-47066 LobeChat SSRF PoC ★ Description CVE-2024-47066 : Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in src/app/api/proxy/route.ts does not consider redirect and could be...

node9-proxy

🛡️ node9 Access control for AI agents Your AI agents can reach Slack, GitHub, email, and your database. node9 decides what they may do with each one. Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · on...

OAuth-Request-Crafter

OAuth-Request-Crafter OAuth Request Crafter is a tool that helps you to play with OAuth signature protected URLs. Features Support GET,POST,PUT and DELETE Proxy the Request Tamper URL, Parameters & Headers on the GO Add additional Headers and Cookie Why? When dealing with OAuth signature protecte...

CVE-2021-3019

CVE-2021-3019 LanProxy Directory Traversal Lanproxy is an intranet penetration tool that proxies LAN personal computers and servers to the public network. It supports tcp traffic forwarding and supports any tcp upper layer protocol access to intranet websites, local payment interface debugging, s...

CVE-2016-2569

Hello there, Thank you for reading my first blog entry. Today we will go with exploit creation for one of the open-source tool Squid Caching proxy server. So What Is Squido? Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. It reduces bandwidth and improves response time...

CVE-2017-7529-POC

CVE-2017-7529-POC Vulnerability Impact This vulnerability affects all Nginx default configuration modules from version 0.5.6 to 1.13.2. An attacker only needs to enable caching to send malicious requests for remote attacks, causing information disclosure. When the Nginx server uses a proxy cache,...

joro

Joro A web exploitation framework for offensive security professionals. Intercepting proxy, blind vulnerability detection, web shell generation, C2 integration, and collaboration tools in a single binary with an embedded web UI. Warning: This tool is intended for authorized penetration testing an...

Hermes-Proxy

Hermes Proxy Hermes Proxy is a desktop HTTP/HTTPS interception app built with Electron and Vite. It captures requests/responses, lets you replay requests, and export/import HAR files. Features Live traffic table with request/response details Replay requests with editable URL/headers Export all...

PhantomCrawler

.png PhantomCrawler is a security testing and research tool that simulates website interactions from different proxy IP addresses to analyze how websites behave under varied network and geolocation conditions. Features: Utilizes a list of proxy IP addresses from a specified file. Supports both HT...

grdpwasm

grdpwasm A web-based RDP client built with Go WebAssembly and grdp. Connect to a Windows Remote Desktop server directly from your browser — no plugins required. Architecture Browser WASM ──WebSocket──► proxy Go ──TCP──► RDP Server Because browsers cannot open raw TCP sockets, a lightweight Go pro...

traefik-CVE-2024-45410-poc

Shadow Corp CTF Challenge Welcome to the Shadow Corp Capture the Flag CTF challenge! This challenge will test your skills in identifying and exploiting vulnerabilities related to security headers and HTTP proxy behavior. Your mission is to bypass protections and uncover secrets hidden within the...

USBCoercer

Supported Targets| ESP32-S3 ---|--- USBCoercer: A TinyUSB based WPAD Coercion Device USBCoercer turns an ESP32 development board with native USB-OTG into an Ethernet-over-USB gadget capable of coercing proxy configuration via WPAD. It builds on the TinyUSB Network Control Model NCM example and ad...

TREVORproxy

TREVORproxy A SOCKS proxy written in Python that randomizes your source IP address. Round-robin your evil packets through SSH tunnels or give them billions of unique source addresses! See the accompanying Blog Post for a fun rant and some cool demos! Note: If you're looking to defend against this...

Moxy

Moxy Moxy Next-Gen Man in the middle proxy Open-source DAST tool for pentesting powered by agentic AI capabilities Supporting Ollama. Built on top of browser-use, Moxy streamlines dynamic application security testing. 🚀 INSANELY EASY TO USE And it's free, who doesn't like free stuff? Preview Aler...

matchlock

Matchlock Experimental: This project is still in active development and subject to breaking changes. Matchlock is a CLI tool for running AI agents in ephemeral microVMs - with network allowlisting, secret injection via MITM proxy, and VM-level isolation. Your secrets never enter the VM. Why...

http_bridge

Http Bridge Motivation I've wrote this program as a proof of concept to test the idea of be able to send tcp stream packets over simple http request like PUT, PATCH, POST, GET, without use a proxy way like CONNECT method. Also as a practice exercise to train my novice skill on rust language...