burp-vulners-scanner

burp-vulners-scanner Description Burp Suite scanner plugin based on Vulners.com vulnerability database API Search fingerprints in http response inspired by plugin "Software Version Reporter" and check found version in vulners.com vulnerability database Experemental Check unique URLs in vulners.co...

THM-Tempest

TryHackMe — Tempest SOC Level 1 Pathway | Incident Response Investigation Overview Full incident response investigation of a compromised Windows machine. The attacker gained initial access via a malicious Word document exploiting CVE-2022-30190 Follina, established persistence, tunneled through t...

CVE-2025-66478

1 POST / HTTP/1.1 Host: localhost:3000 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/60.0.3112.113 Safari/537.36 Assetnote/1.0.0 Next-Action: x X-Nextjs-Request-Id: b5dce965 Content-Type: multipart/form-data;...

IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

CVE-2025-40634

CVE-2025-40634 The TP-Link Archer AX50 router is vulnerable to a stack-based buffer overflow on its firmware version 1.0.14 Build 20240108 rel.426554555, leading to Remote Code Execution both in the LAN and in the WAN side. This vulnerability has the same root cause as CVE-2020-10881, found by th...

nightHawkResponse

nightHawk Response Custom built application for asynchronus forensic data presentation on an Elasticsearch backend. This application is designed to ingest a Mandiant Redline "collections" file and give flexibility in search/stack and tagging. The application was born out of the inability to contr...

tscopy

TScopy Updated 2022-03-31 Introducing TScopy It is a requirement during an Incident Response IR engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating system OS because they are in use, which is particularly frustrating with event logs...

CVE-2022-44877

CVE-2022-44877 Overview This bash script is used to test the vulnerability of web servers to CVE-2022-44877. The script performs a curl request to a target URL with a payload encoded in base64. If the target is vulnerable to the CVE-2022-44877 vulnerability, the elapsed time of the curl request...

galah

TL;DR: Galah /ɡəˈlɑː/ - pronounced ‘guh-laa’ is an LLM-powered web honeypot designed to mimic various applications and dynamically respond to arbitrary HTTP requests. Galah supports major LLM providers, including OpenAI, GoogleAI, GCP's Vertex AI, Anthropic, Cohere, and Ollama. Unlike traditional...

Log4j-CVE-2021-44228

This python scanner will detect the log4j vulnerability in java instances and ping back the response...

CVE-2019-25137-RCE

CVE-2019-25137-RCE CVE-2019-25137 is an Umbraco RCE vulnerability, the script within this repo is slightly altered This exploit script is based on script by Alexandre ZANNI EDB-ID 49488. It is slightly altered, changed the flow to skip token extraction before login, performed the login first...

fastfinder

FastFinder Un outil léger de réponse aux incidents pour la chasse aux menaces et le tri forensic ✨ Aperçu FastFinder est un outil de réponse aux incidents puissant et léger, conçu pour les professionnels de la cybersécurité effectuant de la chasse aux menaces, de la forensic live et du tri...

hakoriginfinder

hakoriginfinder Outil pour découvrir l'hôte d'origine derrière un proxy inverse. Utile pour contourner les WAF et autres proxys inverses. Comment ça marche ? Cet outil effectue d'abord une requête HTTP vers le nom d'hôte/URL que vous fournissez et stocke la réponse, puis il effectue une requête...

CVE-2022-23342

CVE-2022-23342 Security Advisory – Username Enumeration in OnBase Affected software versions and builds: OnBase Application Server OnBase releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are impacted. Fixed software versions and builds: OnBase EP3 releases great...

bypass-403

Bypass-403 Un script simple créé pour un usage personnel pour contourner les 403 Il peut également être utilisé pour comparer les réponses dans diverses conditions comme montré dans la capture ci-dessous Utilisation ./bypass-403.sh https://example.com admin ./bypass-403.sh website-here path-here...

aftermath

À propos Aftermath est un framework de réponse aux incidents open source basé sur Swift. Aftermath peut être utilisé par les défenseurs afin de collecter, puis d'analyser les données provenant de l'hôte compromis. Aftermath peut être déployé depuis un MDM idéalement, mais il peut aussi s'exécuter...

byp4xx

/ / / // / / / / / / / // /| |// |// / // / // / // / / Some cURL options you may use as example: -L follow redirections 30X responses -x : to set a proxy -m to set a timeout -H for new headers. Escape double quotes. -d for data in the POST requests body -... Built-in options: --all Verbose mode...

uac

Unix-like Artifacts Collector UAC À propos • Documentation • Fonctionnalités principales • Systèmes d'exploitation pris en charge • Utilisation • Contribuer • Support • Licence 🔎 À propos de UAC UAC Unix-like Artifacts Collector est un outil de réponse aux incidents puissant et extensible conçu...

sleuthkit

The Sleuth Kit ВВЕДЕНИЕ The Sleuth Kit — это набор криминалистических инструментов с открытым исходным кодом для анализа файловых систем и дисков Microsoft и UNIX. The Sleuth Kit позволяет следователям выявлять и восстанавливать доказательства из образов, полученных в ходе реагирования на инциден...

cve-2023-20198

cve-2023-20198 Description. 1vere$k POC on the CVE-2023-20198 based on the Blog. Also including a check on hexademical response according to the original Cisco article. The script works in the two modes: check mode which is just makes a connection for the particular URL and checks a response code...