shuffledns

massDNS wrapper to bruteforce and resolve the subdomains with wildcard handling support Feature • Install • Run • Wildcard • License • Discord shuffleDNS is a wrapper around massdns, written in go, that allows you to enumerate valid subdomains using active bruteforce, as well as resolve subdomain...

subfinder

Fast passive subdomain enumeration tool. Features • Install • Usage • API Setup • Library • Join Discord subfinder is a subdomain discovery tool that returns valid subdomains for websites, using passive online sources. It has a simple, modular architecture and is optimized for speed. subfinder is...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

dnsx

A fast and multi-purpose DNS toolkit designed for running DNS queries Features • Installation • Usage • Running dnsx • Wildcard • Notes • Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...

jfscan

!CAUTION ⚠️ Project Deprecated This project has been rewritten in Go for better performance and features. Please use the new version here: nullt3r/massmap Description Killing features Unleash the power of Nmap with Masscan for large-scale scans Scan targets using domain names and other formats...

sqlmap-tamper-api

SQLmap Tamper-API It's an API for SQLmap tamper scripts allows you to use your favorite programming language to write your tamper scripts. This API solves SQLmap limitation of accepting only python to write tamper scripts. How it works taper-api.py script sends the payload and kwargs in a JSON...

Out-FINcodedCommand

Out-FINcodedCommand v1.0 Introduction Out-FINcodedCommand is a PowerShell v2.0+ compatible PowerShell POC script designed to highlight several obfuscation techniques used by FIN threat actors. The primary obfuscation techniques highlighted in this tool are: 1. cmd.exe's variable char/string...

autoPwn

Warning Completely re-writing this right now. Focus will be on interactive Linux apps that only take input from stdin for starters. Attempting to use Shellphish's Driller and Fuzzer functionality. autoPwn in it's current state will do this in limited form. Simply run autoPwn ./binary then select...

Xjar_tips

Xjartips Introduction: Spring Boot JAR 安全加密运行工具, 同时支持的原生JAR. 基于对JAR包内资源的加密以及拓展ClassLoader来构建的一套程序加密启动, 动态解密运行的方案, 避免源码泄露以及反编译. 功能特性 无代码侵入, 只需要把编译好的JAR包通过工具加密即可. 完全内存解密, 降低源码以及字节码泄露或反编译的风险. 支持所有JDK内置加解密算法. 可选择需要加解密的字节码或其他资源文件. 支持Maven插件, 加密更加便捷. 动态生成Go启动器, 保护密码不泄露. 其中xjar...

log4stdin

log4stdin — log4shell injection for anything with stdout This repository contains a Java application intentionally vulnerable to CVE-2021-44228, colloquially known as log4shell. log4stdin is quite literally nothing more than an stdin-reader, input of which is fed into a vulnerable log4j instance...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : PostgreSQL vulnerabilities (USN-8653-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8653-1 advisory. It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could...

drinkme

drinkme drinkme es un arnés de prueba para shellcode. Lee shellcode de stdin y lo ejecuta. Esto permite a los pentesters probar rápidamente sus payloads antes del despliegue. Formatos drinkme puede manejar shellcode en los siguientes formatos: "0x" "\x" "x" "" Por ejemplo, NOP podría representars...

refinery

Binary Refinery docs tests codecov pypi High Octane Triage Analysis || || || || || | / / / \ || ==||=====|| | / |/ \ /==| / \ ===| '======|| | \ | | \ | \ /| | || || /||/ / | | | || =========''====/=========/ /==||=====||======' \ / / Il Binary Refinery™ è una raccolta di script Python che...

qsreplace

qsreplace Acepta URLs desde stdin, reemplaza todos los valores de la cadena de consulta con un valor proporcionado por el usuario, solo genera cada combinación de parámetros de cadena de consulta una vez por host y ruta. Uso Archivo de entrada de ejemplo: ▶ cat urls.txt...

unfurl

unfurl Extrahiere Teile von URLs, die über stdin bereitgestellt werden Installation Wenn Go installiert und konfiguriert ist: ▶ go install github.com/tomnomnom/unfurl@latest Andernfalls lade die neueste Binärdatei für deine Plattform herunter, entpacke sie und verschiebe sie an einen Ort in deine...

anew

anew Fügt Zeilen von stdin an eine Datei an, aber nur, wenn sie nicht bereits in der Datei vorkommen. Gibt neue Zeilen auch an stdout aus, ähnlich wie ein tee -a, das Duplikate entfernt. Anwendungsbeispiel Hier enthält eine Datei namens things.txt eine Liste von Zahlen. newthings.txt enthält eine...

Astra Linux – Vulnerability in imagemagick

ImageMagick 7.1.0-49 is vulnerable to Denial of Service attacks. When it parses a PNG image for example, for resizing, the conversion process may cause it to wait for stdin input...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

AlmaLinux 9.6 [TuxCare] Security Update: polkit / polkit-devel / polkit-docs / polkit-libs (ALMALINUX9.6:CLSA-2026:1779368297)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779368297 advisory. - A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...