Check Risk WAF

Check Risk WAF Российское комплексное облачное WAF-решение для защиты веб-приложений и инфраструктуры Russian integrated cloud WAF solution for web application and infrastructure protection Сайт · Документация · Русский · English Русская версия Check Risk WAF – это Российское комплексное облачное...

CVE-2025-55182-Waf

Next.js/React RSC Scanner & Exploit - RCE This tool is designed for security researchers and penetration testers to detect and exploit the CVE-2025-55182 vulnerability in Next.js/React RSC applications. It provides multiple scanning modes, exploitation features, and WAF bypass techniques...

ffufw

ffufw ffuf with that special sauce Install root@kitploit: go install github.com/puzzlepeaches/ffufw@latest Why? ffufw is a wrapper around ffuf to make directory bruteforcing easier and more intelligent. The tool has the following features: Multithreaded execution of ffuf commands for a list of UR...

wafparan01d3

Quick WAF "paranoid" Doctor Evaluation WAFPARAN01D3 The Web Application Firewall Paranoia Level Test Tool. — Fromalt3kx.github.io -blue.svg Introduction to Paranoia Levels In essence, the Paranoia Level PL allows you to define how aggressive the Core Rule Set is. Reference:...

teler

!IMPORTANT Dear users, We wanted to share some important updates regarding the development of teler IDS. 🛑 The development of teler IDS is currently on hold. However, we're thrilled to inform you that we've decided to take a bold step by embarking on a complete refactor, starting from scratch to...

naxsi

Project Status This is a project status update regarding Naxsi. As you may have noticed, the development of Naxsi has been stopped and the repository will be archived for historical reasons. This means that no new updates or bug fixes will be released for this version. However, if you wish to...

ftw

Framework for Testing WAFs FTW Purpose This project was created by researchers from ModSecurity and Fastly to help provide rigorous tests for WAF rules. It uses the OWASP Core Ruleset V3 as a baseline to test rules on a WAF. Each rule from the ruleset is loaded into a YAML file that issues HTTP...

AutoSQLi

AutoSQLi, the new way script-kiddies hack websites Features Save System - there is a complete save system, which can resume even when your pc crashed. - technology is cool Dorking - from the command line one dork : YES - from a file: NO - from an interactive wizard: YES Waffing - Thanks to...

sqlmap-ai

SQLMap AI Assistant An AI-powered wrapper around SQLMap that makes SQL injection testing more accessible and automated. Features Core Features AI-Assisted Testing - Intelligent vulnerability analysis and recommendations Adaptive Testing - Step-by-step testing that adapts to target responses...

react2shell-CVE-2025-55182-poc

CVE-2025-55182 React2Shell PoC con Bypass de WAF Un exploit de prueba de concepto limpio y confiable en Python para CVE-2025-55182 también conocido como React2Shell, una vulnerabilidad crítica de ejecución remota de código en los Componentes de Servidor React utilizados por Next.js App Router y...

BurpSuiteHTTPSmuggler

Burp Suite HTTP Smuggler A Burp Suite extension to help pentesters to bypass WAFs or test their effectiveness using a number of techniques. This extension has been developed by Soroush Dalili @irsdl from NCC Group. The initial release v0.1 only supports the Encoding capability that can be quite...

R4venzCl4w

R4venzCl4w ◣◢ノ-=≡≡卍 A modular Framework for Pentesters and Bug Hunters written in Python3. Table of Contents R4venzCl4w ◣◢ノ-=≡≡卍 Technologies & Tools Requirements Features Features Implementation Installation Config Usage Options Example Todo Contributing License 🔧 Technologies & Tools 📚...

Imperva_gzip_WAF_Bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...

CVE-2017-5638-Attack-and-Defense

Laboratorio de Defensa y Explotación de Apache Struts2 S2-045 Un laboratorio de seguridad basado en Docker que demuestra tanto explotación como defensa contra la vulnerabilidad Apache Struts2 S2-045 CVE-2017-5638. Este laboratorio incluye: 1. Aplicación vulnerable : Struts 2.3.31 vulnerable a...

CVE-2025-66478-kinda-waf

kinda-waf Simple, temporary WAF protection tester targeting a specific payload sequence. Let's help websites stay safe until they are properly patched! Purpose Protect from CVE-2025-66478 by detecting and blocking requests containing specific payload signatures. This shouldn't break legitimate...

next88

next88 - Escáner de RCE para Componentes de Servidor React Implementación en Go de alto rendimiento para detectar vulnerabilidades RCE en Componentes de Servidor React CVE-2025-55182 y CVE-2025-66478. Características 🚀 Alto Rendimiento : Binario compilado en Go con concurrencia basada en gorutina...

CVE-2026-37236

A flaw was found in grpc-gateway up to v2.28.0. A remote attacker could exploit an incorrect access control vulnerability by sending a specially crafted POST request that includes the X-HTTP-Method-Override header. The application processes this header without restricting allowed methods, allowin...

cve-2021-44228-waf-tests

Simple bash script to test your WAF or other devices against Log4Shell attack strings and various bypasses Bypass tricks from: https://github.com/Puliczek/CVE-2021-44228-PoC-log4j-bypass-words To run: root@kitploit: ./cve-2021-44228.sh -t -c Or to use the defaults of https://127.0.0.1 and 403:...

log4j-scanner

log4j-scanner A Log4j vulnerability scanner is automated scanner to find log4j CVE-2021-44228 and CVE202145046 vulnerabilities in web applications. Features 1- It supports multiple URL to perform scan 2- It has payload that can bypass some WAF 3- It supports GET and POST request 4- It supports us...

CVE-2026-24306

Azure Front Door Privilege Escalation – CVE-2026-24306 PoC For authorized red team / research use only. Author not responsible for misuse. Vulnerability allows: Arbitrary routing rule injection Backend pool / origin group modification WAF policy attachment / override Custom domain takeover on...