pwndrop

pwndrop is a self-deployable file hosting service for sending out red teaming payloads or securely sharing your private files over HTTP and WebDAV. If you've ever needed to quickly set up an nginx/apache web server to host your files and you were never happy with the limitations of python -m...

yara

!IMPORTANT This project is in maintenance mode. More info: https://virustotal.github.io/yara-x/blog/yara-x-is-stable/ YARA in a nutshell YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malwar...

domhttpx

domhttpx is a google search engine dorker with HTTP toolkit built with python, can make it easier for you to find many URLs/IPs at once with fast time. List Install Usage Flags Basic Usage One Keyword Multiple Keyword Extract Title Page Extract Title Page from Real Path Extract Status Code Extrac...

fses

fses Fucking Search Engines Scraper - python library to scrap url's from search engines Search Engines we scrap root@kitploit: Ask Bing DuckDuck GO UOL Yahoo Install root@kitploit: git clone https://github.com/mthbernardes/fses.git cd fses pip install -r requeriments.txt Usage Simple search using...

CVE-2018-7600-Masschecker

CVE-2018-7600-Masschecker Strumento per verificare la vulnerabilità CVE-2018-7600 su diversi URL...

CVE-2026-53580

Trilium is an open-source hierarchical note-taking application affected in versions prior to 0.104.0 . The automatic image-download feature accepts file:// URLs in tags within text notes and performs a filesystem read with no path validation . Because the HTML sanitizer allows the file scheme, a...

urlhunter

root@kitploit: o Utku Sen's /\o Oo |/ =- .===O- URL -O- / /U' hunter /|\ || |/ \ | utkusen.com |K || twitter.com/utkusenen urlhunter è uno strumento di ricognizione che permette di cercare su URL esposti tramite servizi di accorciamento come bit.ly e goo.gl. Il progetto è scritto in Go. Come?...

CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81691

openssl_encrypt versions before 1.4.9 fail to validate server URLs in the login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. This allows an attacker on the network path to intercept cleartext credentials —including client_id, passwords, and JWTs—re...

dcrawl

dcrawl dcrawl is a simple, but smart, multi-threaded web crawler for randomly gathering huge lists of unique domain names. How it works? dcrawl takes one site URL as input and detects all links in the site's body. Each found link is put into the queue. Successively, each queued link is crawled in...

web-traffic-generator

web-traffic-generator A quick and dirty HTTP/S "organic" traffic generator. About Just a simple poorly written Python script that aimlessly "browses" the internet by starting at pre-defined ROOTURLS and randomly "clicking" links on pages until the pre-defined MAXDEPTH is met. I created this as a...

CVE-2023-0099-exploit

CVE-2023-0099-exploit Titolo Exploit: simple urls 115 - Reflected XSS Google Dork: Autore Exploit: AmirZargham Homepage del fornitore: https://getlasso.co/ Link del software: https://wordpress.org/plugins/simple-urls/ Versione: 115...

Mlflow < 2.11.0 - Path Traversal

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '' character can be used to insert a path into the fragment, effectively...

ChatGPT个人专用版 - Server Side Request Forgery

A Server-Side Request Forgery SSRF in pictureproxy.php of ChatGPT commit f9f4bbc allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the urlparameter. id: CVE-2024-27564 info: name: ChatGPT个人专用版 - Server Side Request Forgery author: DhiyaneshDK...

5MMISSI-CVE-2017-1000499

5MMISSI-CVE-2017-1000499 PoC de CVE-2017-1000499 Les versions de phpMyAdmin 4.7.x antérieures à 4.7.6.1/4.7.7 sont vulnérables à une faiblesse CSRF. En trompant un utilisateur pour qu'il clique sur une URL spécialement conçue, il est possible d'effectuer des opérations nuisibles sur la base de...

authkeysync

AuthKeySync Sincronizza automaticamente le chiavi pubbliche SSH da URL remote ai tuoi server 📖 Documentazione Completa Il Problema Gestire l'accesso SSH su più server è doloroso: I membri del team entrano o escono e devi aggiornare authorizedkeys su ogni server Gli sviluppatori ruotano le loro...

signy

signy Signierte URLs für kleine Geräte. Hintergrund signy ist eine Bibliothek zum Erstellen signierter URLs auf eingebetteten Geräten unter Verwendung asymmetrischer Kryptographie. Signierte URLs werden typischerweise verwendet, um zeitlich begrenzten Zugriff auf private Ressourcen zu gewähren, w...

gospider

GoSpider GoSpider - Fast web spider written in Go Painless integrate Gospider into your recon workflow? this project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine Installation GO install root@kitploit: GO111MODULE=on go install...

xcrawl3r

xcrawl3r xcrawl3r is a command-line utility designed to recursively spider webpages for URLs. It works by actively traversing websites - following links embedded in webpages, and parsing files including sitemaps & robots.txt - to uncover every URL. Unlike xurlfind3r that doesn't interact directly...

TheTimeMachine

🚀 TheTimeMachine v3.0 - Armare Wayback per il Recon, Bug Bounty, OSINT e molto altro! Hai sentito parlare di viaggi nel tempo nei film e nei fumetti, vero? Beh, questa non è più finzione 😎. TheTimeMachine ti permette di scavare nel passato di qualsiasi app web estraendo URL archiviati dalla Wayba...