w3af

w3af - Web Application Attack and Audit Framework w3af is an open source web application security scanner which helps developers and penetration testers identify and exploit vulnerabilities in their web applications. The scanner is able to identify 200+ vulnerabilities, including Cross-Site...

CVE-2018-10949

Zimbra Collaboration User Enumeration Script CVE-2018-10949 How to use The argument --host must be the hostname or IP address of Zimbra Collaboration Web Application root page, and --userlist an list of usernames to check against it. root@kitploit: root@kali ./cve-2018-10949-user-enum.py --host...

CVE-2020-14295

CVE-2020-14295 Vulnerability details - https://github.com/Cacti/cacti/issues/3622 Install pip3 install -r requirements.txt Usage root@kitploit: $ ./gimme-a-shell.py --help usage: gimme-a-shell.py -h -t Target -U Username -P Password -i Shell-IP -p Shell-Port optional arguments: -h, --help show th...

nmap

Nmap Nmap is released under a custom license, which is based on but not compatible with GPLv2. The Nmap license allows free usage by end users, and we also offer a commercial license for companies that wish to redistribute Nmap technology with their products. See Nmap Copyright and Licensing for...

WhatWaf

WhatWaf? WhatWaf is an advanced firewall detection tool who's goal is to give you the idea of "There's a WAF?". WhatWaf works by detecting a firewall on a web application, and attempting to detect a bypass or two for said firewall, on the specified target. SIDE-NOTE: Any issue that is not the...

yasuo

YASUO @0xsauby Description Yasuo is a ruby script that scans for vulnerable 3rd-party web applications. While working on a network security assessment internal, external, redteam gigs etc., we often come across vulnerable 3rd-party web applications or web front-ends that allow us to compromise th...

ZIPFileRaider

ZIP File Raider - Burp Extension for ZIP File Payload Testing ZIP File Raider is a Burp Suite extension for attacking web application with ZIP file upload functionality. You can easily inject Burp Scanner/Repeater payloads in ZIP content of the HTTP requests which is not feasible by default. This...

x8

x8 Hidden parameters discovery suite written in Rust. The tool aids in identifying hidden parameters that could potentially be vulnerable or reveal interesting functionality that may be missed by other testers. Its high accuracy is achieved through line-by-line comparison of pages, comparison of...

Mass-Assigner

Mass Assigner Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter...

lightbulb-framework

LightBulb LightBulb is an open source python framework for auditing web application firewalls and filters. Synopsis The framework consists of two main algorithms: GOFA : An active learning algorithm that infers symbolic representations of automata in the standard membership/equivalence query mode...

GetDataReport

ABOUT Script in PHP+JS for get information of target through a web application, use $SERVER functions and JS functions for get information of our client. Plugin WEBApps in some web applications need to collect information from the client to perform tasks with this plugin will be easier to work wi...

CVE-2023-23752

CVE-2023-23752 simple program for joomla CVE-2023-23752 scanner, This is a simple Ruby script that checks if a list of targets is vulnerable to CVE-2023-23752, a critical security vulnerability in a web application. The script sends a HTTP GET request to a specified endpoint, and extracts...

feroxbuster

!WARNING Security Notice – Domain Impersonation The domain feroxbuster.com is NOT affiliated with this project, its maintainers, or any official feroxbuster releases. Official feroxbuster downloads are distributed ONLY through: https://github.com/epi052/feroxbuster open source...

crowdsec

CrowdSec هو حل أمني مفتوح المصدر وتشاركي يوفر كشفًا وحمايةً مبنيةً على التعهيد الجماعي للخوادم ضد عناوين IP الضارة. اكتشف وامنع باستخدام محرك الأمان الخاص بنا، وساهم في الشبكة، واستمتع بقائمة الحظر المجتمعية في الوقت الفعلي. الميزات والمزايا محرك أمان متعدد الاستخدامات CrowdSec Security Engine هو...

DVWA

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Application DVWA is a PHP/MariaDB web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of...

ravage

Ravage Ravage is an evidence-first CLI for assessing a running web application that you own or are explicitly authorized to test. It combines deterministic reconnaissance and validation with an optional model-driven attack loop, while keeping scope, authentication, traffic accounting, and evidenc...

ntopng

ntopng مقدمة ntopng® هي تطبيق مراقبة حركة الشبكة قائم على الويب، تم إصداره تحت رخصة GPLv3. إنها التجسيد الجديد لـ ntop الأصلي الذي تم كتابته في عام 1998، وتم الآن تجديدها من حيث الأداء وسهولة الاستخدام والميزات. بينما يمكنك قراءة المزيد عن ntopng على موقع ntop الإلكتروني http://www.ntop.org، نقتر...

ModSecurity

Libmodsecurity는 ModSecurity v3 프로젝트의 한 구성 요소입니다. 이 라이브러리 코드베이스는 웹 트래픽을 수신하고 기존 ModSecurity 처리를 적용하는 ModSecurity 커넥터에 대한 인터페이스 역할을 합니다. 일반적으로 ModSecurity SecRules 형식으로 작성된 규칙을 로드/해석하고 커넥터를 통해 애플리케이션에서 제공하는 HTTP 콘텐츠에 적용하는 기능을 제공합니다. Apache용 ModSecurity일명 ModSecurity v2.x를 찾고 있다면, 해당 버전은 여전히 유지관리되며...

shfz

shfz A scenario-based web application fuzzng tool that supports fuzz generation by genetic algorithm. Features Easy to customize fuzzing test by scripting fuzzing scenario in JavaScript / TypeScript Third-party packages can be used in fuzzing scenario script Genetic algorithm fuzz generation...

hackguard

hackguard FAST WEB APPLICATION VULNERABILITY SCANNER Requirements: root@kitploit: 1. Make sure python3 is installed in windows Or in Linux 2. For Windows: python -m pip install -r requirements.txt 3. For Linux: python3 -m pip install -r requirements.txt Installation: root@kitploit: 1. For Linux...