76 matches found
cowitness
CoWitness CoWitness 是一款旨在充当 HTTP、HTTPS 和 DNS 服务器的工具。它允许你提供网页服务、记录 HTTP 请求以及自定义 DNS 响应。本 README 提供了功能概述以及如何编译和使用 CoWitness 工具的说明。 功能 HTTP 服务器 ：CoWitness 包含一个监听 80 端口 的 HTTP 服务器。它可以提供当前工作目录下的静态文件。每个 HTTP 请求都会被记录，包括客户端的 IP 地址、请求的资源以及用户代理。 HTTPS 服务器 ：除了 HTTP 服务器外，CoWitness 还提供一个监听 443 端口的 HTTPS 服务器。与...
dnsFookup
DnsFookup v 2.0.1 DNS Rebinding フレームワーク: もちろんDNSサーバー 新しいサブドメインを作成し、DNSサーバーを制御し、ログを表示するためのPython Web APIなど 使いやすくするためのダサいReactアプリ 変更履歴 API ドキュメント 何ができるのか？ Burp CollaboratorのようにDNSビンを作成できます。 しかし、さらにいくつかの機能が追加されています... 作成されたサブドメインが解決するIP/ドメインとその回数を指定できます。現在は A、CNAME、AAAAレコードがサポートされています...
Pentest-Mapper
Pentest Mapper Pentest Mapper は、Burp Suite の拡張機能であり、Burp Suite...
Jupyter Server: 5xx request logging leaks token-bearing Referer header values
SummaryWhen a request returns a 500, jupyterserver/log.py logs a small JSON block of request headers. The Referer header was copied into it as-is, so a token in the Referer URL ended up in the logs in plain text. ImpactAnyone who can read the server logs can pick tokens out of these 500 entries...
CVE-2022-4539
使用注意事项： 适应性： 您可以轻松修改有效载荷、IP 生成逻辑和代理，以匹配不同的场景或环境。 道德使用： 确保在测试任何系统前已获得明确授权。 可扩展性： 本代码设计为可扩展且适应性强，既适用于小规模测试，也适用于更复杂的大型评估。 WordPress 的 Web 应用程序防火墙插件在 2.1.2 及之前版本中存在 IP 地址欺骗漏洞。这是因为在请求日志记录和登录限制中，获取 IP 地址信息的位置限制不足。攻击者可以提供带有不同 IP 地址的 X-Forwarded-For 标头，该地址将被记录，并可用来绕过可能已阻止某个 IP 地址或国家/地区登录的设置。...
CVE-2026-86049: Insertion of Sensitive Information into Log File
Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...
SUSE CVE-2026-15603
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...
CVE-2026-72817
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...
CVE-2026-72817 go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For
go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...
laravel-threat-detection v1.6.1
Laravel Threat Detection Passive intrusion detection for Laravel — see every SQL injection, XSS, scanner, and bot probe hitting your app, logged with full context. It's an IDS, not a WAF: it never blocks, filters, or modifies a request. Drop it into any Laravel 10–13 app and it starts scanning...
laravel-threat-detection v1.4.0
Laravel Threat Detection Passive intrusion detection for Laravel — see every SQL injection, XSS, scanner, and bot probe hitting your app, logged with full context. It's an IDS, not a WAF: it never blocks, filters, or modifies a request. Drop it into any Laravel 10–13 app and it starts scanning...
CVE-2026-7828 UltraVNC repeater integer overflow in win_log malloc leading to heap overflow
UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the winlog function allocates list nodes via mallocsizeofstruct LIST + strlenline, where line is derived from HTTP request URIs. If strlenline is sufficiently large,...
CVE-2026-7828: Integer Overflow or Wraparound
UltraVNC repeater through 1.8.2.2 contains an integer overflow in the HTTP request logging path. In repeater/webgui/settings.c:336, the winlog function allocates list nodes via mallocsizeofstruct LIST + strlenline, where line is derived from HTTP request URIs. If strlenline is sufficiently large,...
morgan 安全漏洞
Morgan is an open-source HTTP request logging middleware developed by ExpressJS. Versions 1.2.0 to 1.10.1 of Morgan contain security vulnerabilities. These vulnerabilities stem from the remoteuser token not being escaped with control characters, which may lead to log manipulation...
CVE-2026-44516 Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers...
Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
Summary The LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown...
EUVD-2008-6885
Malware in sbrugna...
EUVD-2020-0232
Malware in sbrugna...