wordlist_generator

wordlistgenerator Tool wordlistgenerator generates unique to your target wordlist with techniques mentioned in tomnomnom's video "Who, What, Where, When". It takes URLs from gau to extract directories, file names or words on pages. As additional feature it can extract HTML comments. By default to...

Apkatshu

Apkatshu Apkatshu its a Tool for extracting urls , emails , ip address , and interesting data from APK files root@kitploit: Apkatshu : tool written in bash/python for extracting urls, emails, ip addresses, and interesting data from APK files. The user can choose either JADX or APKTOOL for...

RTF-Cleaner

RTF-Cleaner RTF Cleaner, tries to extract URL from malicious RTF samples using CVE-2017-0199 & CVE-2017-8759...

urx

Extracts URLs from OSINT Archives for Security Insights. Urx is a command-line tool designed for collecting URLs from OSINT archives, such as the Wayback Machine and Common Crawl. Built with Rust for efficiency, it leverages asynchronous processing to rapidly query multiple data sources. This too...

cc.py

cc.py 根据 "commoncrawl.org" 的结果提取特定目标的 URL。 已更新至 v.0.3 | 更新内容： 处理速度快 65% 通过 -y/--year 指定年份，例如：-y 2018 通过 -o/--out 指定输出文件，例如：-o whatever.txt 为特定索引爬取所有页面 -i/--index，例如：cc.py army.mil -i CC-MAIN-2018-05 列出所有可用索引 -l/--list，例如：cc.py army.mil -l 待办事项 为特定索引爬取 实现多线程 允许输入年份范围 实现 direct-grep 临时文件写入 用法...

Instagram-Notes-Audio-Leakage-via-URL-Extraction-Fixed

🎙️ Instagram Notes Audio Leakage via URL Extraction Fixed & Rewarded 🛡️ Vulnerability Summary In 05/2025, I discovered a vulnerability in Instagram Web that allowed any user to extract the original video file from a Note and access the background audio , which was not meant to be publicly...

fses

fses Fucking Search Engines Scraper - 検索エンジンからURLをスクレイピングするPythonライブラリ スクレイピングする検索エンジン root@kitploit: Ask Bing DuckDuck GO UOL Yahoo インストール root@kitploit: git clone https://github.com/mthbernardes/fses.git cd fses pip install -r requeriments.txt 使い方 Askを使用した簡単な検索 root@kitploit: from...

unfurl

unfurl 提取 stdin 提供的 URL 的各个部分 安装 如果你已经安装并配置好 Go： root@kitploit: ▶ go install github.com/tomnomnom/unfurl@latest 否则，下载适用于你平台的最新二进制文件，解压后将其移动到 $PATH 中的某个位置（例如 /usr/bin/）： root@kitploit: ▶ wget https://github.com/tomnomnom/unfurl/releases/download/v0.0.1/unfurl-linux-amd64-0.0.1.tgz ▶ tar xzf...

mavd

mavd 移动应用漏洞检测 从 CLI 接收域名或 APK 名称，识别与该域名关联的大多数应用并在本地下载 APK。然后使用 dex2jar 将 APK 逆向为 jar 文件，提取类文件和对象，并在代码中搜索 'secret' 类型的关键词和 URL。...

CVE-2017-5638_struts

I extended Scott Campbell's script further, made it more complicated : While "HTTPStrutsAttack" will stop 100% of the recon, there was still miniscule chance that if a scanner hits a vulnerable system, even though we'd block the scanner, vulnerable system might still do the wget included in the...

galer

galer root@kitploit: /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 HTML属性からURLをクロールインで高速に取得するツール。@omespino Tweetに触発され、Chrome DevTools Protocolを通じてJavaScriptを評価することでsrc、href、url、actionの値を抽出可能です。 リソース インストール バイナリから ソースから GitHubから 使い方 基本使用 フラグ 例 単一URL リストからURL 標準入力から ライブラリ TODO ヘルプとバグ...

misp-extractor

MISP抽出ツール このコードは、指定されたMISP（Malware Information Sharing Platform）サーバーに接続し、指定された数のイベントを解析して、イベント内で見つかったIPアドレス、URL、MD5ハッシュを3つの別々のファイルに書き込みます。 使用方法 このスクリプトを使用するには、MISPインスタンスのURLと有効なAPIキーを指定する必要があります。その後、MISPConnector.runメソッドを呼び出して属性を取得し、ファイルに保存できます。 コードを使用するには、以下のコマンドを実行します： root@kitploit: python3...

pmg

pmg 从网址中提取参数/路径 用法： $ cat urls.txt | python3 PmG.py 结果 保存结果 $ cat urls.txt | python3 PmG.py ResultsFile.txt 你可以在这里使用正则表达式添加更多参数/路径 :D root@kitploit: wordlist = r'url=|password=|link=|u=|word=|username=|linkid=', r'+CSCOU+', CVE-2020-3452 r'.sql|db|tar|backup|bak|zip|git|php'...

jsluicepp

📄 目录 👋 简介 🛠️ 设置 📝 用法 📜 功能特性 监控 URL 发送到 Repeater 机密 机密通知 复制 URL 包含/排除匹配 仅限作用域内 内联标签 隐藏重复项 显示带参数的行 导入/导出 保存设置 👋 简介 jsluice++ 是一款 Burp Suite 扩展，旨在使用 CLI 工具 jsluice 对 JavaScript 流量进行被动和主动扫描。 该扩展利用 jsluice 的能力从静态 JavaScript 文件中提取 URL、路径和机密信息，并将其与 Burp Suite 集成，使您能够轻松扫描来自 Burp Suite Sitemap 或 Proxy 的...

jsluice

jsluice jsluice 是一个 Go 包和命令行工具，用于从 JavaScript 源代码中提取 URL、路径、机密以及其他有趣的数据。 如果你想立即执行这些操作：请查看命令行工具。 如果你想将 jsluice 的功能集成到你自己的项目中：请查看示例，并阅读包文档。 安装 要安装命令行工具，请运行： root@kitploit: ▶ go install github.com/BishopFox/jsluice/cmd/jsluice@latest 要将该包添加到你的项目中，请运行： root@kitploit: ▶ go get...

RTF-Cleaner

RTF-Cleaner RTF de-obfuscator for CVE-2017-0199 documents to find URLs statically. Use this tool to statically find URLs in obfuscated RTF documents. Usage: .\rtfCleanerUniversal.ps1 path-to-file Example: .\rtfCleanerUniversal.ps1 'C:\Users\yams\Downloads\invoiceForYams.doc' If the built in...

eml_parser has a URL extraction bypass via HTML entities in URLs

Summary emlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...

GHSA-FXGQ-9M89-CXJ9 eml_parser has a URL extraction bypass via HTML entities in URLs

Summary emlparser performs certain validations on potential URL strings to discard bogus values. In versions prior to 3.0.2, this validation was performed before unescaping any HTML entities that might occur in the string. This caused the library to wrongfully reject valid URLs that use HTML...

CVE-2026-55618 eml_parser: URL extraction bypass via HTML entities in URLs

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the cleanfounduri function in emlparser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash,...

EUVD-2026-65697

emlparser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the cleanfounduri function in emlparser/parser.py validates potential URL strings before unescaping HTML entities used for colon, slash,...