HTTPLoot

HTTPLoot An automated tool which can simultaneously crawl, fill forms, trigger error/debug pages and "loot" secrets out of the client-facing code of sites. Usage To use the tool, you can grab any one of the pre-built binaries from the Releases section of the repository. If you want to build the...

KeePwn

A python script to help red teamers discover KeePass instances and extract secrets. Features KeePass Discovery Look for KeePass installation files through SMB C$ share. Accept multiple target sources IP, CIDR, hostname, file. Check for KeePass metadata version, last access time. Check for running...

sccmsqlclient

sccmsqlclient A dedicated MSSQL client for SCCM database exploration and exploitation. Recon queries Run PowerShell scripts on managed clients Extract secrets Installation PIPX $ pipx install git+https://github.com/synacktiv/sccmsqlclient/ PIP You can install by cloning the repository and...

secretsdump.py

secretsdump.py Description This is a customized version of the secretsdump.py script from the impacket Python library. It allows the extraction of secrets NTDS.dit, SAM and .SYSTEM registry hives from multiple Windows systems simultaneously. This customized version improves the original by...

JSScanner

JSScanner You can find the article related to this script here https://securityjunky.com/scanning-js-files-for-endpoint-and-secrets/ To install the required tools use bash install.sh Change the alive.txt with the domains you need to test. These should be in below format http://example.com...

jsluice

jsluice jsluice is a Go package and command-line tool for extracting URLs, paths, secrets, and other interesting data from JavaScript source code. If you want to do those things right away: look at the command-line tool. If you want to integrate jsluice's capabilities with your own project: look ...

troll-a

Troll-A Troll-A is a command line tool for extracting secrets such as passwords, API keys, and tokens from WARC Web ARChive files. Troll-A is an easy-to-use , comprehensive , and fast solution for finding secrets in web archive. Features Protocols: Supports retrieving web archives directly from a...

CVE-2025-68664-LangGrinch-PoC

📑 Table of Contents 🎯 Executive Summary 📂 Project Structure 🚀 Quick Start 🐛 Vulnerability Deep Dive 🔬 Technical Root Cause Analysis ⚔️ Attack Chain Methodology 💀 Payload Arsenal 55+ 🎮 Operator's Strategy Guide...

cve-2018-1002105

This was modified from https://gravitational.com/blog/kubernetes-websocket-upgrade-security-vulnerability/. All credit goes to the kind folks at Gravitational. The original PoC code was modified to go a bit beyond checking for vulnerability and to actually run a command inside the first container...

CVE-2026-104618

On request the sdbootutil script creates a world-readable debug log in /var/log/sdbootutil.log. The log file is created world-readable, however, which means that arbitrary low-privileged users in the system will be able to extract secrets from it...

gitbleed_tools

GitBleed Tools - para extraer datos de repositorios git reflejados Acerca de Este repositorio contiene scripts de shell que se pueden usar para descargar y analizar diferencias entre repositorios Git clonados y reflejados. Para más información sobre la peculiaridad subyacente en el comportamiento...

dumpscan

El desarrollo público de esta herramienta se ha pausado, pero todavía se está trabajando en privado. Espere una actualización masiva en el tercer/cuarto trimestre de 2024. Dumpscan es una herramienta de línea de comandos diseñada para extraer y volcar secretos de kernels y formatos de Minidump de...

Practical Secrets Extraction against Black-Box LLMs

Large language models LLMs increasingly power autonomous coding agents such as Codex and Claude Code, yet their training corpora may contain confidential credentials exposed in public repositories or collected from private development artifacts, creating risks of memorization and subsequent...

CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

XXE vulnerability in ivy-report

ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...

simple-ReDos

ReDOS Timing Attack Exploit Overview This Python script d...

GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd

ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction in github.com/argoproj/argo-cd...

Jenkins Assembla Plugin has an XXE vulnerability

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when parsing responses from the configured Assembla server. This allows attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkin...

CVE-2026-57303

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity XXE attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery...

CVE-2026-57303: Server-Side Request Forgery (SSRF)

Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity XXE attacks, allowing attackers able to control the responses of the configured Assembla server to extract secrets from the Jenkins controller or perform server-side request forgery...