dotenv-diff

dotenv-diff Scan your codebase to detect every environment variable reference. It helps you catch missing, unused, duplicated, and misused variables early, before they cause runtime errors. First class support for SvelteKit, Next.js, and Nuxt. Also works well in modern JavaScript/TypeScript...

CVE-2026-35585-poc

CVE-2026-35585: File Browser OS Command Injection PoC Description This repository contains a Proof of Concept PoC for CVE-2026-35585 , a critical OS Command Injection vulnerability discovered in File Browser versions 2.0.0 through 2.33.1. The vulnerability exists in the "Custom Command Hooks"...

gh-dork

gh-dork Supply a list of dorks and, optionally, one of the following: a user -u a file with a list of users -uf an organization -org a file with a list of organizations -of a repo -r You can also pass: an output directory to store results -o a filename to store valid items, if your users or org...

envy

Quick Start • Configuration • Commands • Keybindings • FAQ • Documentation A secure encrypted vault for managing API keys, secrets, and environment variables. Built for developers who live in the terminal. What is Envy? I built Envy because I was tired of juggling .env files and keeping secrets...

Metabase_CVE-2021-41277

MetabaseCVE-2021-41277 Description Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs...

CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 POC Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD, resulting in...

miteru

This repository does not have a README...

CVE-2014-6271

Shellshock Exploitation CVE-2014-6271 Shellshock is effectively a Remote Command Execution vulnerability in BASH. This script exploits the vulnerability in the web environment on apache or similar with modcgi enabled. The vulnerability lies in the manipulation of environment variables, which are...

r2frida

r2frida Radare2 and Frida better together Description Self-contained plugin for radare2 that ships frida and allows to instrument local or remote processes using r2 commands instead but not limited to Frida scripts. The radare project provides a complete toolchain for reverse engineering, it's...

BypassCredGuard

BypassCredGuard - Credential Guard Bypass Via Patching Wdigest Memory Background Adam Chester @xpn wrote an article called "Exploring Mimikatz - Part 1 - WDigest" about memory patching to enable UseLogonCredential and make Wdigest cache cleartext credentials intrigued me. The wdigest.dll module...

CVE-2014-6271

CVE-2014-6271 Description This project allows reproducing the vulnerability CVE-2014-6271 , also known as Shellshock. Shellshock is a security vulnerability in Bash that allows executing malicious code via environment variables. The purpose of this project is to demonstrate the impact of this...

unicorn

Unicorn Engine LOOKING FOR CONTRIBUTORS! See this. Unicorn is a lightweight, multi-platform, multi-architecture CPU emulator framework, based on QEMU. Unicorn offers some unparalleled features: Multi-architecture: ARM, ARM64 ARMv8, M68K, MIPS, PowerPC, RISCV, SPARC, S390X, TriCore and X86 16, 32,...

httpstat

httpstat httpstat visualizes curl1 statistics in a way of beauty and clarity. It is a single file🌟 Python script that has no dependency👏 and is compatible with Python 3🍻. Features Beautiful terminal output — timing breakdown of DNS, TCP, TLS, server processing, and content transfer Structured JSO...

ForgottenButNotGone

Forgotten but Not Gone This repository contains proof-of-concept scripts for the vulnerabilities presented at the talk "Forgotten but Not Gone: Unauthenticated RCEs and LPEs in Legacy Linux Services" from Black Hat USA 2026 and DEF CON 34. CVE-2026-28372 Local privilege escalation in TelnetD:...

checkov

Checkov is a static code analysis tool for infrastructure as code IaC and also a software composition analysis SCA tool for images and open source packages. It scans cloud infrastructure provisioned using Terraform, Terraform plan, Cloudformation, AWS SAM, Kubernetes, Helm charts, Kustomize,...

rayder

Rayder A lightweight tool for orchestrating and organizing your command-line workflows About • Installation • Usage • Workflow Configuration • Parallel Execution • Workflows About Rayder is a command-line tool designed to simplify the orchestration and execution of workflows. It allows you to...

vercel-april2026-incident-response

Vercel April 2026 Incident Response Guide Last updated: 20 April 2026 @ 12.07 PM AEST/Brisbane - v2 — incorporates Vercel CEO update of 20 April IMPORTANT: This is not legal or official advice. If you think you have been compromised please reach out to an incident response partner. This informati...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

gha-lab-e8902eccd3

自动化研究产物 — 非上游项目。 本仓库是由自动化工具链构建的一次性实验环境，用于拉瓦尔大学（Université Laval）硕士论文中复现已公开的 GitHub Actions 工作流漏洞。它是 timescale/pgai 在提交 2a209b058c60823b57e8b7775b10244ff340eb8b（2025-05-14）时的逐字快照，依据该项目自身的许可证重新分发，该许可证文件已原样包含在本快照中。 上游项目未 参与其中，也从未 成为攻击目标，此处研究的漏洞已公开。本仓库中的每个密钥和变量均为随机生成的虚拟值——不包含任何真实凭据。操作引用和运行器镜像均固定为其在...