jsluicepp

📄 Содержание 👋 Введение 🛠️ Установка 📝 Использование 📜 Возможности Мониторинг URL Отправить в Repeater Секреты Уведомления о секретах Копировать URL Позитивный/негативный фильтр Только в пределах scope Инлайн-теги Скрыть дубликаты Показывать параметризованные Импорт/Экспорт Сохранить настройки 🤝...

BFScan

BFScan Инструмент для первичной обработки APK / XAPK / APKM / DEX / JAR / WAR приложений. Поиск строк в исходном коде и ресурсах, похожих на URI, пути или секреты Генерация сырых HTTP-запросов и спецификаций OpenAPI на основе файлов конфигурации, аннотаций классов и методов Поддерживаемые...

vajra

An automated web hacking framework for web applications Table of Content About Vajra What is Vajra Key Feaures What Vajra does Installation Running with docker-compose Tools Used by Vajra Contributing License Future Plans/Under Development Credits Disclaimer FAQ Detailed insight about Vajra can b...

barq

barq barq: Le framework de post-exploitation AWS Cloud ! Qu'est-ce que c'est ? barq est un framework de post-exploitation qui vous permet d'effectuer facilement des attaques sur une infrastructure AWS en cours d'exécution. Il vous permet d'attaquer des instances EC2 en cours d'exécution sans...

nord-stream

Nord Stream Nord Stream — это инструмент, который позволяет извлекать секреты, хранящиеся в CI/CD-окружениях, путём развёртывания вредоносных пайплайнов. В настоящее время поддерживаются Azure DevOps, GitHub и GitLab. Подробнее в следующем посте в блоге:...

adiskreader-secretsdump

🚩 Спонсоры Если вам нравится этот проект, подумайте о приобретении лицензий OctoPwn — нашего полноценного набора для пентеста, который работает в вашем браузере! Для уведомлений о новых сборках/релизах и другой информации заходите в наш Discord adiskreader-secretsdump Извлекает секреты реестра и...

SrHollow

SrHollow Извлечение секретов LSA, повторное использование существующей теневой копии VSS + встроенный парсер regf + расшифровка LSA AES-256 через bcrypt.dll. Цепочка из 6 шагов 1. Перечислить\GLOBAL?? через NtOpenDirectoryObject + NtQueryDirectoryObject. Выбрать HarddiskVolumeShadowCopyN с...

CVE-2025-36753 SWD Interface Open on Growatt ShineLan-X

The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to extracting secrets or domains from within the device...

EUVD-2022-2736

Malicious code in bioql PyPI...

PT-2025-30401

The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access an...

CVE-2021-29620

Report portal is an open source reporting and analysis framework. Starting from version 3.1.0 of the service-api XML parsing was introduced. Unfortunately the XML parser was not configured properly to prevent XML external entity XXE attacks. This allows a user to import a specifically-crafted XML...

CVE-2018-1000010

Jenkins DRY Plugin 2.49 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks...

GHSA-MGFG-7533-7JF6 ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL

Impact This is not a vulnerability in the code per se, but included Varnish VCL templates enable compression of API and JSON messages. This is a potential case of the BREACH vulnerability, which affects HTTP compression, where secrets can be extracted through carefully crafted requests. The fix...

Code Injection

Woodpecker is vulnerable to Code Injection. The vulnerability is due to insufficient user validation, allowing any user to trigger malicious workflows that can either take over the host running the agent or extract secrets by overwriting plugin entry points...

Code Injection

Woodpecker is vulnerable to Code Injection. The vulnerability is due to insufficient user validation, allowing any user to trigger malicious workflows that can either take over the host running the agent or extract secrets by overwriting plugin entry points...

CVE-2024-41121

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...

GHSA-XW35-RRCP-G7XM Woodpecker's custom workspace allow to overwrite plugin entrypoint executable

Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are...

GHSA-3WF2-2PQ4-4RVC Woodpecker's custom environment variables allow to alter execution flow of plugins

Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are...

Woodpecker's custom environment variables allow to alter execution flow of plugins

Impact The server allow to create any user who can trigger a pipeline run malicious workflows: - Those workflows can either lead to a host takeover that runs the agent executing the workflow. - Or allow to extract the secrets who would be normally provided to the plugins who's entrypoint are...

CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...