caronte

caronte$ Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using...

burpcommander

burpcommander Ruby command-line interface to Burp Suite's REST API Usage burpcommander VERSION: 1.0.1 - UPDATED: 08/29/2018 -t, --target IP Address Defaults to 127.0.0.1 -p, --port Port Number Defaults to 1337 -k, --key API Key If you require an API key specify it here -i, --issue-type-id String...

FACT_core

The Firmware Analysis and Comparison Tool FACT Contents Why FACT? Setup Usage Documentation Contribute Additional plugins Analysis Import/Export Presentations Social Acknowledgments License Why FACT? Firmware analysis can be used to achieve several interesting goals. Chief among those are...

WuppieFuzz

WuppieFuzz v1.8.0 TNO developed WuppieFuzz, a coverage-guided REST API fuzzer developed on top of LibAFL, targeting a wide audience of end-users, with a strong focus on ease-of-use, explainability of the discovered flaws and modularity. WuppieFuzz supports all three settings of testing black box,...

api-scanner-docker

API Scanner - Self-Hosted Deployment API Scanner is an automated API security testing tool that scans REST and SOAP APIs for vulnerabilities using OpenAPI/Swagger specifications and WSDL files. Prerequisites Docker Engine 20.10+ Docker Compose v2 Python 3.6+ for setup script 8 GB RAM minimum 16 G...

REST-Attacker

REST-Attacker REST-Attacker is an automated penetration testing framework for APIs following the REST architecture style. The tool's focus is on streamlining the analysis of generic REST API implementations by completely automating the testing process - including test generation, access control...

WP2Shell

WP2Shell - CVE-2026-63030 / CVE-2026-60137 WordPress REST API Batch SQL Injection to RCE Full discovery and exploitation tool for WordPress REST API Batch endpoint vulnerability. This tool exploits a critical SQL injection vulnerability in the WordPress REST API /wp-json/batch/v1 endpoint, allowi...

CVE-2019-18890

CVE-2019-18890 CVE-2019-18890 POC Proof of Concept REDMINE UP TO 3.2.9/3.3.9 SQL INJECTION https://nvd.nist.gov/vuln/detail/CVE-2019-18890 Requirements: Access credentials Subproject is required REST API is enabled On Mysql the first query on which injection occurs looks like the example below wi...

CVE-2023-23752

CVE-2023-23752 Joomla Unauthorized Access Vulnerability CVE-2023-23752 Vulnerability Description Joomla is an open-source content management system CMS, written in PHP, supporting multiple database systems such as MySQL, MSSQL, and PostgreSQL. Improper access restrictions lead to unauthorized...

ADOKit

ADOKit Description Azure DevOps Services Attack Toolkit - ADOKit is a toolkit that can be used to attack Azure DevOps Services by taking advantage of the available REST API. The tool allows the user to specify an attack module, along with specifying valid credentials API key or stolen...

CVE-2026-9830

CVE-2026-9830 BookingPress Pro API Assessment PoC This repository contains a Python proof of concept for validating a reported unauthenticated BookingPress Pro REST API exposure. A successful response may contain booking and customer information, which can include personal data. Authorization...

CVE-2026-110975

A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint GET /datasources and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration...

snowpick

snowpick is a ServiceNow exposure scanner that finds misconfigured widget ACLs, REST API access controls, and unauthenticated data exposure. ServiceNow exposes data through two common public surfaces: Service Portal widgets and the Table REST API. When access controls on either surface are...

CVE-2023-2732

CVE-2023-2732 MStore API = 3.9.2 - Authentication Bypass https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/mstore-api/mstore-api-392-authentication-bypass Description The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including...

OWASP-WSTG-Rag

OWASP WSTG RAG A Retrieval-Augmented Generation RAG system that indexes the OWASP Web Security Testing Guide WSTG into a vector database, providing instant access to security testing methodologies via REST API and MCP Model Context Protocol for Claude Code integration. Features Complete WSTG...

WSSAT

WSSAT - Web Service Security Assessment Tool WSSAT is an open source web service security scanning tool which provides a dynamic environment to add, update or delete vulnerabilities by just editing its configuration files. This tool accepts WSDL address list as input file and for each service, it...

CVE-2026-110975 Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure

A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint GET /datasources and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration...

EUVD-2026-109109

A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint GET /datasources and the datasource-metadata endpoint — serialized datasource objects using a default Gson configuration...

CVE-2026-110975

A flaw in Kruize Autotune allows for datasources credential disclosure due to a lack of an authentication layer on its REST API. Specifically, the list-datasources (GET /datasources) and datasource-metadata endpoints serialize datasource objects using a default Gson configuration without a field-...

CVE-2021-40539

CVE-2021-40539 CVE-2021-40539: ADSelfService Plus RCE Vulnerability I: Vulnerability Description ZOHO ManageEngine ADSelfService Plus is ZOHO's integrated self-service password management and single sign-on solution for Active Directory and cloud applications. CVE-2021-40539 Zoho ManageEngine...