socid-extractor

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...

cdb

Pown CDB Pown CDB is a Chrome Debug Protocol utility. The main goal of the tool is to automate common tasks to help debug web applications from the command-line and actively monitor and intercept HTTP requests and responses. This is particularly useful during penetration tests and other types of...

dnsdiag

DNS Measurement, Troubleshooting and Security Auditing Toolset Have you ever wondered if your ISP is intercepting your DNS traffic? Have you noticed any unusual behavior in your DNS responses, or been redirected to the wrong address and suspected something might be off with your DNS? We offer a...

ssrf-sheriff

SSRF Sheriff This is an SSRF testing sheriff written in Go. It was originally created for the Uber H1-4420 2019 London Live Hacking Event, but it is now being open-sourced for other organizations to implement and contribute back to. Features Respond to any HTTP method GET, POST, PUT, DELETE, etc...

waymore

Описание - v8.9 Идея waymore заключается в том, чтобы найти еще больше ссылок из Wayback Machine и других источников, чем другие существующие инструменты. 👉 Самое большое отличие waymore от других инструментов в том, что он также может загружать архивированные ответы для URL-адресов на Wayback...

wotop

Web-On-Top-Of-Protocol WOTOP root@kitploit: ██╗ ██╗ ██████╗ ████████╗ ██████╗ ██████╗ ██║ ██║██╔═══██╗╚══██╔══╝██╔═══██╗██╔══██╗ ██║ █╗ ██║██║ ██║ ██║ ██║ ██║██████╔╝ ██║███╗██║██║ ██║ ██║ ██║ ██║██╔═══╝ ╚███╔███╔╝╚██████╔╝ ██║ ╚██████╔╝██║ ╚══╝╚══╝ ╚═════╝ ╚═╝ ╚═════╝ ╚═╝ Introduction WOTOP is a...

EVIL-CVE-2021-23017-Update-2025

уязвимость в серверах NGINX версии 0.6.18–1.20.0. Скрипты предназначены для вызова отказа в обслуживании DoS путём отправки вредоносных DNS-ответов с улучшениями для обхода брандмауэров. Это улучшенная версия оригинального PoC из M507/CVE-2021-23017-PoC. Предупреждение : Используйте только с явно...

send

@fastify/send Send는 파일 시스템에서 파일을 HTTP 응답으로 스트리밍하기 위한 라이브러리로, 부분 응답Ranges, 조건부 GET 협상If-Match, If-Unmodified-Since, If-None-Match, If-Modified-Since, 높은 테스트 커버리지, 그리고 애플리케이션이나 프레임워크에서 적절한 조치를 취하는 데 활용할 수 있는 세분화된 이벤트를 지원합니다. Installation 이 모듈은 npm 레지스트리를 통해 제공되는 Node.js 모듈입니다. 설치 방법은 npm install 명령...

Keycloak - SAML Core Package Signature Validation Flaw

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

Pritunl VPN Server 1.29.2145.25 - Username Enumeration

Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint. id: CVE-2020-25200 info: name: Pritunl VPN Server 1.29.2145.25 - Usernam...

galah

Кратко: Galah /ɡəˈlɑː/ — произносится «гу-лаа» — это веб-ханпот на основе LLM, предназначенный для имитации различных приложений и динамического ответа на произвольные HTTP-запросы. Galah поддерживает основных LLM-провайдеров, включая OpenAI, GoogleAI, GCP Vertex AI, Anthropic, Cohere и Ollama. В...

CVE-2024-50962

DonWeb Ferozo Webmail의 크로스 사이트 스크립팅XSS CVE-2024-50962 설명 Ferozo Webmail v1.1 의 크로스 사이트 스크립팅XSS 취약점으로 인해 공격자가 Identities 및 Automatic Responses 구성 요소를 통해 임의의 스크립트를 실행할 수 있습니다. 이 취약점은 사용자 세션을 하이재킹하고, 피싱 공격을 수행하며, 자격 증명을 탈취하는 데 사용될 수 있습니다. 공격 복잡성 낮음 필요한 권한 없음 사용자 상호 작용 필요함 사용자가 주입된 스크립트가 포함된 구성 요소와 상...

dnspooq

dnspooq DNSpooq PoC - dnsmasq 캐시 중독 CVE-2020-25686, CVE-2020-25684, CVE-2020-25685 교육 목적으로만 사용하세요 요구 사항 Docker compose Docker 익스플로잇 컨테이너 실행 root@kitploit: $ docker-compose up -d exploit.py 실행 root@kitploit: $ docker-compose exec attacker bash bash-5.0 python exploit.py Querying non-cached names...

EUVD-2026-42684

@Mockoon/commons-server: Path traversal in templated filePath lets a request escape the served directory prefix-only base check...

ssrf-sheriff

SSRF Sheriff Это шериф для тестирования SSRF, написанный на Go. Он был изначально создан для Uber H1-4420 2019 London Live Hacking Event, но теперь он публикуется с открытым исходным кодом, чтобы другие организации могли его внедрять и вносить свой вклад. Возможности Отвечает на любой HTTP-метод...

dnscrypt-autoinstall

dnscrypt-autoinstall This project has been archived, see last comment in 108. A script for installing and automatically configuring DNSCrypt on Linux-based systems. Description DNSCrypt is a protocol for securing communications between a client and a DNS resolver by encrypting DNS queries and...

CVE-2026-45768 Suricata ldap: unbounded responses per transaction can lead to resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic...

CVE-2026-45768

Suricata versions 8.0.0 through prior to 8.0.5 are affected by a resource exhaustion vulnerability in its LDAP application-layer parser . The LDAP transaction state could store an unbounded number of responses per transaction. Because LDAP is processed over UDP , an unauthenticated remote attacke...

CVE-2026-45768

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic...

CVE-2026-45768 Suricata ldap: unbounded responses per transaction can lead to resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic...