KingOfBugBountyTips

KingOfBugBountyTips 终极漏洞赏金侦察武器库 "暗影中狩猎，代码中信任" Telegram | Twitter | YouTube | LinkedIn DoD VDP 范围 DoD Vulnerability Disclosure Program | KingRecon DOD 完整 DoD 范围 - 19 个域名 bash BBRF Scope - All DoD Domains bbrf inscope add '.af.mil' '.army.mil' '.marines.mil' '.navy.mil' '.spaceforce.mil' '.ussf.mil...

CVE-2025-6554

CVE-2025-6554 root@kitploit: function leakhole let x; delete x?.y?.a; return y; let y; function pwn let hole = leakhole; %DebugPrinthole; pwn; 漏洞 变量 y 在声明之前被访问。正常情况下这会触发 ReferenceError（暂存死区，TDZ），但在旧版 V8 中，当与 delete x?.y 结合使用时，检查失败并返回内部哨兵值 "The Hole"。 补丁前 V8 仅检查了一次 TDZ，然后错误地假设 y 是有效的。这使得 "The Hole...

bbot

BEE·bot is a multipurpose scanner inspired by Spiderfoot, built to automate your Recon , Bug Bounties , and ASM! https://github.com/blacklanternsecurity/bbot/assets/20261699/e539e89b-92ea-46fa-b893-9cde94eebf81 A BBOT scan in real-time - visualization withVivaGraphJS Installation root@kitploit:...

Vulnerability-Disclosures

Divulgaciones de Vulnerabilidades de Mandiant Este repositorio detalla las vulnerabilidades divulgadas por Mandiant. Estas vulnerabilidades fueron descubiertas mediante investigación interna, evaluaciones de Red Team, o en uso activo en el entorno salvaje. Las pruebas de concepto PoCs pueden o no...

quiver

Quiver : A Meta-Tool for Kali Linux Quiver is an organized namespace of shell functions that pre-fill commands in your terminal so that you can ditch your reliance on notes, copying, pasting, editing, copying and pasting again. Quiver helps you remember how to use every tool in your arsenal and...

bbscope

bbscope.com 用于聚合来自 HackerOne、Bugcrowd、Intigriti 和 YesWeHack 的漏洞赏金计划范围的 Web 界面和 API。 快速开始 Docker root@kitploit: cd website cp .env.example .env 编辑 .env — 至少设置 POSTGRESPASSWORD 和你的平台凭证 docker compose up -d --build 站点将通过 https://yourdomain.com 访问（Caddy 通过 Let's Encrypt 自动处理 HTTPS）。 Cloudflare DNS 挑战...

APTS

什么是 OWASP APTS？ 自主渗透测试平台的治理标准。它定义了这些系统必须做什么才能安全、透明地在既定边界内运行，无论它们是由供应商交付、作为服务运营，还是由企业安全团队内部构建用于测试自己的组织。 APTS 不是一种测试方法论。它通过应对自主操作特有的问题来补充 PTES、OWASP WSTG 和 OSSTMM：范围执行、安全自主、防操纵和问责制。 8 个领域的 173 个层级要求...

SCOPE

SCOPE: Security Cloud Ops Purple Engagement SCOPE ejecuta flujos de trabajo de equipo púrpura en AWS con inventario determinista en Python y agentes de IA acotados. Audita recursos de AWS, valida rutas de ataque, genera manuales de explotación solo para revisión, produce controles y guía...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

CVE-2020-0796

CVE-2020-0796 Windows SMBv3 本地特权提升漏洞利用 作者 Daniel García Gutiérrez @danigargu Manuel Blanco Parajón @dialluvioso 漏洞利用分析 PoC分析 by SungLin 知道创宇404团队 Writeup+PoC by @ZecOps 参考 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796...

progress-burp

Progress Tracker Burp Suite extension to track vulnerability assessment progress. Features Capturing items unique requests from the Burp Suite tools Proxy, Repeater, Target. Request unique key is defined as follows: target host, port, protocol, path and method. Items have following editable...

ipa-scope

IPA-SCOPE v.2 IPA-SCOPE 是一个针对 iOS 应用的静态分析工具，能够提取重要信息，如链接、有趣的文件（.json, .cer, .der, .api 等），在渗透测试 iOS 应用时非常有用，能展示良好的结果。 此工具的新功能 ✅快速且易于使用 ✅获取二进制信息（如 API 密钥、子域名等） ✅保存并显示过滤结果 ✅获取目标应用中的链接库 ✅获取应用中的所有字符串和类 要求： Linux 或 Mac OS 安装： git clone https://github.com/xcodeOn1/ipa-scope.git sudo pip3 install -r...

project-black

Project Black 范围控制、范围扫描器和进度追踪器，用于更轻松地处理漏洞众测或渗透测试项目 Anatoly Ivanov，Positive Technologies 这个工具是做什么用的？ 该工具鼓励在渗透测试/漏洞众测中采用更有条理 的方法，追踪进度和通用的扫描信息。 它可以启动 masscan nmap dirsearch amass patator 针对你工作的范围，并将数据以方便的形式存储。对项目数据执行有用的过滤，例如： 查找所有具有开放端口但不是80端口的主机 查找所有IP以82开头的主机 查找 dirsearch 至少发现一个200状态码文件的主机 安装 通过...

ZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange

Summary A vulnerability in ZITADEL’s OAuth2 Token Exchange endpoint allows an authenticated user or client to exchange a low-privilege access token for a token with elevated permissions at a completely different application. This bypasses the intended authorization and separation policies...

gimmepatz

😼 gimmePATz 😼 - Herramienta de reconocimiento de tokens de acceso personal PAT ¿Alguna vez has encontrado un token de acceso personal PAT de GitHub o NPM y te has preguntado «¿Es válido?» o «¿Qué podría hacer un tipo malo con esto?» Bueno, si es así, ¡tengo la herramienta para ti! Te presento...

CVE-2026-54180 backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, the Update, Delete, and Reorder operations resolve records from the unscoped model query inste...

EUVD-2026-77709

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.15 and 7.0.47, HasMany and MorphMany handling through attachManyRelation during CRUD create and update...

rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

EUVD-2026-77452

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints that allows authenticated users to read restricted email addresses. Attackers can recover hidden attendee emails by exploiting incorrect ACL scope validation that checks parent...