nuvola

nuvola nuvola with the lowercase n is a tool to dump and perform automatic and manual security analysis on AWS environments configurations and services using predefined, extensible and custom rules created using a simple Yaml syntax. The general idea behind this project is to create an abstracted...

cirro

Cirro is an extensible security research platform that enables researchers and penetration testers to collect, analyze, and visualize cloud environments and identity relationships through graph databases. Built with a modular architecture, Cirro can be extended to support multiple platforms and...

EuConform

EuConform 🇪🇺 Open-Source Evidence Toolkit For AI Compliance Open evidence format • Local bias evaluation • Schema validation • CycloneDX interoperability Offline-first • Privacy-preserving • Reusable artifacts • WCAG 2.2 AA accessible EuConform defines an open evidence format for AI compliance and...

WebGoat.NET

Desde el indicador de comandos, acceda al directorio DB de WebGoat.NET root@kitploit: % cd /WebGoat.NET/DB Inicie la utilidad mysql, proporcionando el nombre y la contraseña, si es necesario de un usuario con permiso para crear bases de datos. Por ejemplo, para usar el usuario root predeterminado...

CVE-2025-30065

CVE-2025-30065 Research Notes This repository is kept intentionally small and readable. It is intended for authorized security research, local validation, and defensive study of CVE-2025-30065 in Apache Parquet / Avro schema handling. The README focuses on repository hygiene, build reproducibilit...

isr-sqlget

-- ISR - Infobyte Security Research -- | ISR-sqlget | www.infobytesec.com | ..:: DESCRIPCIÓN ISR-sqlget: Es una herramienta de inyección SQL ciega desarrollada en Perl. Permite obtener esquemas de bases de datos y filas de tablas. Usando un único GET/POST puedes acceder silenciosamente a la...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

ecs-templates

Resumen Este repositorio contiene todo lo necesario para convertir los logs de Corelight o Zeek al estándar de nomenclatura del Elastic Common Schema ECS y almacenarlos en un despliegue de Elastic Stack. Publicado originalmente en 2019, el mismo año que Elastic Common Schema, este repositorio sig...

polaris

Polaris is an open source policy engine for Kubernetes Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the...

graphicator

Graphicator Graphicator es un "scraper" / extractor de GraphQL. La herramienta itera sobre el documento de introspection devuelto por el endpoint de GraphQL objetivo, y luego reestructura el esquema en una forma interna para poder recrear las consultas soportadas. Cuando se crean dichas consultas...

GraphQLmap

GraphQLmap GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes. Install Features and examples Dump a GraphQL schema Interact with a GraphQL endpoint Execute GraphQL queries Autocomplete queries GraphQL field fuzzing Example 1 - Bruteforce a character Examp...

batchql

BatchQL BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements. When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet,...

airflowscan

airflowscan Checklist and tools for increasing security of Apache Airflow. DISCLAIMER This project NOT AFFILIATED with the Apache Foundation and the Airflow project, and is not endorsed by them. Contents The purpose of this project is provide tools to increase security of Apache Airflow...

airflowscan

airflowscan Lista de verificación y herramientas para aumentar la seguridad de Apache Airflow. AVISO Este proyecto NO ESTÁ AFILIADO con la Apache Foundation ni con el proyecto Airflow, y no cuenta con su respaldo. Contenido El propósito de este proyecto es proporcionar herramientas para aumentar ...

CVE-2026-78152 SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outputs on public pages by default, allowing unauthenticated visitors to obtain the email address of any user who has published content...

CVE-2026-78152

SureRank SEO WordPress plugin versions 1.6.2 through 1.10.0 fail to exclude registered account email addresses from the Person Schema structured data it outputs on public pages by default. This allows unauthenticated visitors to enumerate the email addresses of any user who has published content,...

pbtk

pbtk - Protobuf 앱 리버스 엔지니어링 Protobuf는 Google에서 개발한 직렬화 형식으로, 점점 더 많은 Android, 웹, 데스크톱 및 기타 애플리케이션에서 사용되고 있습니다. 이는 데이터 구조를 선언하는 언어 로 구성되며, 대상 구현에 따라 코드 또는 다른 종류의 구조로 컴파일됩니다. pbtk Protobuf 툴킷는 통합 GUI를 통해 접근할 수 있는 완전한 기능의 스크립트 세트로, 두 가지 주요 기능을 제공합니다: 프로그램에서 Protobuf 구조 추출 , 이를 다시 읽을 수 있는 .proto 파일로...

SuiteCRM Unauthenticated Graphql Introspection

Graphql Introspection is enabled without authentication, exposing the scheme defining all object types, arguments, and functions. id: CVE-2023-47643 info: name: SuiteCRM Unauthenticated Graphql Introspection author: isacaya severity: medium description: | Graphql Introspection is enabled without...

CVE-2026-41242

CVE-2026-41242 — protobuf.js Code Injection to RCE CVSS 9.4 Critical | Code Injection CWE-94 Overview protobuf.js npm: protobufjs versions ≤ 7.5.4 and ≤ 8.0.0 are vulnerable to arbitrary code execution via type names in the protobuf schema. The @protobufjs/codegen module concatenates type names...

CVE-2026-49462

NL Portal Backend Libraries (used in Dutch government portals) ships a default configuration in versions up to and including 3.0.0 that exposes two GraphQL developer features without requiring authentication: the GraphiQL playground at the /graphiql endpoint and schema introspection . Together, t...