node9-proxy

🛡️ node9 Access control for AI agents Your AI agents can reach Slack, GitHub, email, and your database. node9 decides what they may do with each one. Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · on...

Modlishka

..Modlishka.. Modlishka es una herramienta de pruebas de penetración de código abierto que actúa como un proxy man-in-the-middle. Introdujo un nuevo enfoque técnico para manejar el flujo de tráfico HTTP basado en navegador, lo que le permite actuar como proxy transparente de tráfico multidominio,...

CVE-2026-1337-AI-Coding-Assistant-Prompt-Injection-to-Sandbox-Escape

CVE-2026-1337 – AI Coding Assistant Prompt Injection to RCE 📖 Overview A prompt injection vulnerability in an AI-powered code review bot allows an attacker to inject arbitrary shell commands by manipulating the bot’s “fix” suggestion. The sanitizer uses a simple blacklist that is bypassed using...

rustdllproxy

rustdllproxy A Rust crate utility to easily generate and develop proxy DLLs for Windows applications. Installation cargo install rustdllproxy Compatibility This crate currently only supports the standard DLL PE format. Current Limitations When hooking functions with custom code, the function...

network-fingerprint

network-fingerprint Capture packet request/response pairs for a port and/or IP to aid in Network protocol based Nuclei Templates creation. Resources Installation Instructions Usage Running network-fingerprint Output Format Usage ▶ network-fingerprint -h This will display help for the tool. You ca...

py3webfuzz

Py3webFuzz ';-- Python Web Fuzzing module Library Python3 Module Compatible Author Jonathan Angeles @ex0day Github: https://github.com/jangelesg/py3webfuzz Contributors Nathan Hamiel @nathanhamiel DESCRIPTION Based on pywebfuzz, Py3webfuzz is a Python3 module to assist in the identification of...

sccmsqlclient

sccmsqlclient A dedicated MSSQL client for SCCM database exploration and exploitation. Recon queries Run PowerShell scripts on managed clients Extract secrets Installation PIPX $ pipx install git+https://github.com/synacktiv/sccmsqlclient/ PIP You can install by cloning the repository and...

CVE-2023-25202

CVE-2023-25202: Insecure file upload mechanism Description CVE-2023-25202 involves an insecure file upload mechanism within the Therefore application, which is overly permissive in the types of files users can upload. The application only blocks uploads of HTML, EXE, and BAK files, leaving it...

cve-2022-42889-intercept

cve-2022-42889-intercept For versions below Java 11, special attention is required, as higher versions have already removed the Javascript interpreter. This solution targets Java 8. Intercept illegal parameters via JVM startup parameters and jps pid. quick start -----------------------load...

Exploitivator

Exploitivator V2.0 - modificado para usar Python 3 Requisitos previos Esto solo ha sido probado en Kali. Depende del módulo pymetasploit3 para Python, descrito en detalle aquí: https://coalfire.com/the-coalfire-blog/pymetasploit3-metasploit-automation-library Instale los paquetes necesarios de Ka...

Drupalgeddon2

CVE-2018-7600 | Drupal 7.58 / 8.3.9 / 8.4.6 / 8.5.1 - 'Drupalgeddon2' RCE SA-CORE-2018-002 Inspired from https://github.com/dreadlocked/Drupalgeddon2 Supports: Drupal 8.3.9 / 8.4.6 / 8.5.1 user/register URL, attacking account/mail & postrender parameter, using PHP's passthru function Pending Yet ...

gitleaks

Gitleaks ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ !WARNING Gitleaks está completo en cuanto a funcionalidades. No estoy incorporando nuevas funciones en Gitleaks. Las versiones futuras serán solo parches de seguridad. Estoy centrando mi atención en Betterleaks license:...

gitleaks

Gitleaks ┌─○───┐ │ │╲ │ │ │ ○ │ │ ○ ░ │ └─░───┘ !WARNING Gitleaks is feature complete. I'm not merging new features into Gitleaks. Future releases will be security patches only. I'm shifting my focus to Betterleaks Gitleaks is a tool for detecting secrets like passwords, API keys, and tokens in g...

SunnyDayBPF

SunnyDayBPF SunnyDayBPF is an eBPF-based post-syscall user-buffer telemetry deception research technique originally proposed and researched by Azizcan Dastan. The technique investigates whether data observed by user-space security, logging, or telemetry agents can be altered after a read-like...

Cheshire

Cheshire Pre-flight payload QA for Adaptix, powered by LitterBox. Cheshire is an Adaptix C2 service plugin that bridges the Adaptix client to a LitterBox sandbox. From inside the Adaptix UI, an operator can pick any binary, dispatch it through LitterBox's full analyzer chain static + dynamic +...

dawgmon

dawgmon - Dawg the Hallway Monitor RESUMEN El nombre de esta herramienta está basado en un episodio temporada 10, episodio 10 de South Park en el que Cartman es Dawg the Hallway Monitor patrullando los pasillos de su escuela. Es una herramienta que ayuda a monitorear los cambios que han ocurrido ...

rebrowser-patches

🪄 Patches for undetectable browser automation This repo contains patches to enhance popular web automation libraries. Specifically, it targets the puppeteer and playwright packages. Some aspects of automation libraries or browser behavior cannot be adjusted through settings or command-line...

recog

Recog: A Recognition Framework Recog is a framework for identifying products, services, operating systems, and hardware by matching fingerprints against data returned from various network probes. Recog makes it simple to extract useful information from web server banners, snmp system description...

CVE-2022-1388

CVE-2022-1388 BIG IP REST RCE On F5 BIG-IP 16.1.x versions prior to 16.1.2.2., 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Use the following...

yaralyzer

THE YARALYZER Visually inspect all of the regex matches and their sexier, more cloak and dagger cousins, the YARA matches found in binary data and/or text. See what happens when you force various character encodings upon those matched bytes. With colors. Quick Start pipx install yaralyzer Scan...