SetCookieAnalysisInBrowsers

浏览器中设置 Cookie 的分析 许可证 根据 AGPL 发布（更多信息请参阅 LICENSE）。 说明 更多信息请参阅以下博客文章： https://www.nccgroup.com/en/blog/2015/01/analysis-of-setting-cookies-for-third-party-websites-in-different-browsers/ 用法 "victimsite" 目录应复制到支持 ASPX 的服务器上（除非 "cookiemanager.aspx" 已用 PHP 重写）。 该 URL 应在 "testcaserunner.html" 文件中设置到...

distributed-system-testing

Distributed Systems Testing Skills Two skills for AI coding agents that design and run claim-driven tests for distributed and stateful systems. Together they produce a structured Markdown test plan and a findings report with 10-state verdicts and an explicit SUT / harness / checker / environment...

owasp-istg

OWASP IoT Security Testing Guide The OWASP IoT Security Testing Guide provides a comprehensive methodology for penetration tests in the IoT field offering flexibility to adapt innovations and developments on the IoT market while still ensuring comparability of test results. The guide provides an...

detection-rules

Detection Rules Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine. This repository was first announced on Elastic's blog post, Elastic Security...

htcap

HTCAP htcap is a web application scanner able to crawl single page application SPA recursively by intercepting ajax calls and DOM changes. KEY FEATURES Recursive DOM crawling engine Discovers ajax/fetch/jsonp/websocket requests Supports cookies, proxy, custom headers, http auth and more Heuristic...

chipsec

CHIPSEC: Platform Security Assessment Framework CHIPSEC is a framework for analyzing the security of PC platforms including hardware, system firmware BIOS/UEFI, and platform components. It includes a security test suite, tools for accessing various low level interfaces, and forensic capabilities...

multer-sca-rule-test_cve-2025-7338

此存储库没有 README。...

not-going-anywhere

概述 Not Go-ing Anywhere 是一组存在漏洞的 Golang 程序，旨在展示常见漏洞，并为用户提供一个测试平台，用于发现、修复和补救 Golang 漏洞。 它仿照我们的 不那么智能的合约 仓库，包含两类程序的混合： 一个使用 gRPC、Web 与 database/sql 的全面漏洞生态，以及 一组专注的程序，用于演示我们常见的 Golang 问题...

CyberStrike

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी 攻撃的セキュリティのために作られた、初のオープンソース AI エージェント。 ターミナルからの自律ペネトレーションテスト —...

decker

Decker - 渗透测试编排框架 目的 Decker 是一个渗透测试编排框架。它利用 HashiCorp Configuration Language 2（与 Terraform 相同的配置语言）来实现声明式的 渗透测试即代码，让你的测试可以被版本化、共享、重用，并与团队或社区协作。 decker 配置文件示例： // variables are pulled from environment // ex: DECKERTARGETHOST // they will be available throughout the config files as var. // ex:...

cve-2009-3555-test-server

这是什么？ 这是一个使用Go TLS栈的vendored fork实现的TLS服务器，其中强制禁用了重新协商指示扩展，这将触发OpenSSL 3.0+中针对CVE-2009-3555的缓解措施。注意，它实际上并不容易受到CVE-2009-3555的影响，因为Go TLS栈根本不允许重新协商。 该程序的作用是充当测试服务器，用于测试那些拒绝连接到具有不安全客户端重新协商配置的服务器（例如没有设置SSLOPALLOWUNSAFELEGACYRENEGOTIATION选项的OpenSSL 3.0+）的TLS客户端。...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

recox

Recox v2.0 RecoX is an incredibly versatile and powerful tool that is specifically designed to aid in the identification and classification of vulnerabilities within web applications. The script is able to detect vulnerabilities that are not typically included in the OWASP top ten vulnerabilities...

Integer-Overflow-test

此存储库没有 README。...

Log4NetSolarWindsSNMP-

Log4NetSolarWindsSNMP- 用于 Solarwinds DLLs 的 CVE-2018-1285 警报的测试应用程序...

lava

LAVA: Large Scale Automated Vulnerability Addition Evaluating and improving bug-finding tools is currently difficult due to a shortage of ground truth corpora i.e., software that has known bugs with triggering inputs. LAVA attempts to solve this problem by automatically injecting bugs into...

CVE-2025-29927-Testing

CyberMaxx 提供的 CVE-2025-29927 测试脚本。 CVE-2025-29927 测试工具 此 PowerShell 脚本旨在帮助安全研究人员和系统管理员测试 Next.js 应用中的 CVE-2025-29927 漏洞。它通过验证 Next.js 版本并检查中间件实现的潜在安全风险，来确认目标应用是否存在中间件绕过问题。 功能： 响应头检查：从目标 URL 获取 HTTP 响应头，以确认是否使用了 Next.js x-powered-by: Next.js。 版本提取：在目标应用的静态 JavaScript 文件中搜索所使用的 Next.js 版本。...

CVE-2022-35914-RCE

CVE-2022-35914 por cyb3rk0ala PoC para CVE-2022-35914 , una vulnerabilidad de inyección de comandos que involucra el componente de prueba htmLawed en instalaciones vulnerables de GLPI. La herramienta proporciona ejecución de comandos a través del endpoint vulnerable e incluye funcionalidad de...

nodexp

NodeXP - Detection and Exploitation Tool for Node.js Services! NodeXP is an intergrated tool, written in Python 2.7, capable of detecting possible vulnerabilities on Node.js services as well as exploiting them in an automated way, based on ServerSideJavascriptInjection attack! Getting Started -...

wycheproof

Wycheproof 项目 Wycheproof 项目是一个由社区管理的测试向量库，密码学库开发者可以使用这些测试向量来检测已知攻击、规范不一致以及其他各种实现错误。 测试向量以 JSON 测试向量数据的形式维护，并附有JSON schema文件来记录测试向量数据的结构。 快速开始 1. 克隆此仓库。您可能还希望将 Wycheproof 作为 Git 子模块集成，或设置自动化以跟踪随时间的变化。 2. 编写（或从 JSON schema 文件生成）代码，以适合您的实现语言/项目的方式加载向量数据。 3. 对于每个感兴趣的算法，确定密码学 API...