ApplicationInspector

Introduction Microsoft Application Inspector is a software source code characterization tool that helps identify coding features of first or third party software components based on well-known library/API calls and is helpful in security and non-security use cases. It uses hundreds of rules and...

log4j-scanner-CVE-2021-44228

log4j-scanner CVE-2021-44228 Simple tool for scanning entire directories for attempts of CVE-2021-44228 there are always ways to bypass filters , same goes for the regex patterns...

jsleak

Description I was developing jsleak during most of my free time for my own need.It is easy-to-use command-line tool designed to uncover secrets and links in JavaScript files or source code. The jsleak was inspired by Linkfinder and regexes are collected from multiple sources. Features: Discover...

git-secrets

=========== git-secrets パスワードやその他の機密情報をgitリポジトリにコミットするのを防ぎます。 .. contents:: :depth: 2 概要 :: git secrets --scan -r|--recursive --cached --no-index --untracked ... git secrets --scan-history git secrets --install -f|--force git secrets --list --global git secrets --add -a|--allowed -l|--literal...

pmg

pmg Extract parameters/paths from urls usage : $ cat urls.txt | python3 PmG.py results Save results $ cat urls.txt | python3 PmG.py ResultsFile.txt here you can add more parameters/paths using regex :D wordlist = r'url=|password=|link=|u=|word=|username=|linkid=', r'+CSCOU+', CVE-2020-3452...

warcannon

WARCannon - 破壊的に強力な並列WARC処理 WARCannonは、インターネットをgrepするプロセスを簡略化し、低コスト化するために構築されました。 WARCannonを使えば、以下のことが可能です： 実際のCommon Crawlデータに対して正規表現パターンを作成・テスト Common Crawlデータセットを簡単に読み込んで並列処理 信じられないほどの容量でWARCを非同期に処理するために、計算能力をスケール 結果を保存し、簡単に取得 動作の仕組み...

secret-regex-list

Secret Regex List List of regex for scraping secret API keys and juicy information. You can directly copy this and put into your python code, some regexes might require three quotes or else it will break the code. "Cloudinary" : "cloudinary://.", "Firebase URL": ".firebaseio.com", "Slack Token":...

endext

EndExt EndExt is a .go tool for extracting all the possible endpoints from the JS files Idea When you crawll all the JS files from waybackruls for example, or even collecting the JS files urls from your target website's home source page .. If the website was using API system and you wanna look fo...

filebuster

Filebuster An extremely fast and flexible web fuzzer What is it? Filebuster is a HTTP fuzzer / content discovery script with loads of features and built to be easy to use and fast! It uses one of the fastest HTTP classes in the world of PERL - Furl::HTTP. Also the thread modelling is optimized to...

git-vuln-finder

git-vuln-finder gitのコミットメッセージから潜在的なソフトウェア脆弱性を見つけます。 出力形式はJSONで、関連するコミットとそのコミットに含まれる可能性のあるソフトウェア脆弱性の修正情報が含まれます。 検索はコミットメッセージのみに対する正規表現のセットに基づいています。 CVE IDが存在する場合、それらは自動的に出力に追加されます。 入力には任意のgitリポジトリまたはGHアーカイブソースを使用できます。 必要条件 jq sudo apt install jq Python poetry インストール ライブラリとして使用する...

fuzzdb

FuzzDBは、動的アプリケーションセキュリティテストを通じてアプリケーションのセキュリティ脆弱性を見つける可能性を高めるために作成されました。これは、フォールトインジェクションパターン、予測可能なリソースの場所、およびサーバー応答を照合するための正規表現の、最初で最も包括的なオープン辞書です。 攻撃パターン - FuzzDBには、フォールトインジェクションテストのための攻撃ペイロードプリミティブの包括的なリストが含まれています。...

dismember

🔪 Dismember Dismember는 Linux용 명령줄 도구 키트로, 모든 프로세스또는 특정 프로세스의 메모리를 스캔하여 일반적인 비밀과 커스텀 정규 표현식 등을 찾는 데 사용할 수 있습니다. 결국 완전한 /proc 도구 키트가 될 것입니다. grep 명령을 사용하면 모든 접근 가능한 프로세스의 모든 메모리에서 정규 표현식을 매칭할 수 있습니다. 이를 통해 메모리에서 민감한 데이터를 찾거나, 메모리에 포함된 내용으로 프로세스를 식별하거나, 프로세스 메모리에서 흥미로운 정보를 조사하는 데 사용할 수 있습니다. scan 명령...

CVE-2026-84367

A flaw was found in joi. A remote attacker can alter the prototype of an object returned by validation by submitting specially crafted input keys. When an application configures dynamic key renaming based on regular expression patterns, the validator fails to properly restrict sensitive internal...

CVE-2026-82617 Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

PYSEC-2026-3752

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attackers to cause quadratic CPU consumption by supplying malformed TEI blocks with many unmatched opening tags. Attackers can exploit lazy regex patterns in the readblock method...

CVE-2026-70493

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

CVE-2026-70493

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the built-in knowledge search path in backend/openwebui/tools/knowledgefs.py and backend/openwebui/tools/builtin.py let a chat participant choose a pattern used to grep knowledge files...

CVE-2025-71395

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations,...

org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource...

CVE-2025-71379

A flaw was found in vLLM. Multiple regular expression denial of service ReDoS vulnerabilities exist in versions greater than or equal to 0.6.3 and less than 0.9.0. An attacker can exploit this by submitting crafted input with nested or repeated structures to specific regex patterns within vLLM,...