Arkhota

Arkhota, веб-брутфорсер для Android Что? Arkhota — это веб-брутфорсер HTTP/S для ОС Android. Зачем? Веб-брутфорсер всегда есть на компьютере хакера по очевидным причинам. Иногда атаки требуют быстроты и/или минимальной подготовки устройства. Кроме того, телефон привлекает меньше внимания, чем...

LKWA

LKWA Lesser Known Web Attack Lab est destiné aux pentesters intermédiaires qui peuvent tester et pratiquer des attaques web moins connues telles que l'injection d'objets, XSSI, la désérialisation PHAR, les variables variables, etc. Les write-ups sont les bienvenus. Ma propre procédure pas à pas e...

dvwassl

Application Web Vulnérable avec SSL Exécutez une application Web vulnérable avec SSL. Pourquoi ? Vous pourriez vouloir tester la détection d'attaques web via SSL. Construire l'image docker build -t dvwassl:latest . Exécuter le conteneur docker run -d -p 443:443 dvwassl:latest Certificat et clé SS...

Network-Analysis-Tools

Outil d'analyse de fichiers de capture Pcap v.1 !CONTACT! | Email: [email protected] | | Github: github/azizaltuntas | | Twitter: @esccopyright | Fonctionnalités 1-Top 10 Visited Sites 2-Emails 3-All Request Urls 4-User-Agents List 5-String Grep Mode 6-Connection details 7-Ports Used 8-ALL I...

whale-sentinel-services

🐋 Services Whale Sentinel 🔧 Aperçu Whale Sentinel Services est le backend centralisé de l'écosystème de détection des menaces Whale Sentinel. Ces microservices effectuent une détection des menaces en temps réel, la coordination des agents, l'analyse DGA et l'inspection des attaques web, permettan...

payloads

payloads Git All the Payloads! Une collection de charges utiles d'attaque web. Les pull requests sont les bienvenues ! Utilisation exécutez ./get.sh pour télécharger les charges utiles externes et décompresser les fichiers de charges utiles qui sont compressés. Crédits des charges utiles fuzzdb -...

payloads

payloads Git All the Payloads! A collection of web attack payloads. Pull requests are welcome! Usage run ./get.sh to download external payloads and unzip any payload files that are compressed. Payload Credits fuzzdb - https://github.com/fuzzdb-project/fuzzdb SecLists -...

GPEWebDefender

GPEWebDefender A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you when a site is being probed or exploited. If this process dies, the site keeps serving. It is not Wazuh, not OSSEC, and not a WAF. The command is gpewebdefender. Hosts, tokens, map pins,...

GPEWebDefender — Updated!

GPEWebDefender A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you when a site is being probed or exploited. If this process dies, the site keeps serving. It is not Wazuh, not OSSEC, and not a WAF. The command is gpewebdefender. Hosts, tokens, map pins,...

EUVD-2026-47386

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Product Quality Management. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2026-62549

Vulnerability in the Oracle HRMS UK product of Oracle E-Business Suite component: UK Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS UK. While the vulnerability...

PT-2026-63052

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description A security flaw in the Oracle Agile PLM product of Oracle Supply Chain allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a...

CVE-2026-56359

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth...

PT-2026-50070

Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

-Web-Attack-Detection-Lab

!Kali Linuxhttps://img.shields.io/badge/KaliLinux-557C94?sty...

Cross-site Scripting (XSS)

Overview TinyMCE is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the media plugin when handling crafted data-mce- attributes. An attacker can execute arbitrary scripts in the context of the user's browser by...

Context-Aware Web Attack Detection in Open-Source SIEM Systems Via MITRE ATT&CK-Enriched Behavioral Profiling

Security Information and Event Management SIEM systems aggregate log data from heterogeneous sources to detect coordinated attacks. Traditional rule-based correlation engines struggle to classify multi-step web application attacks because they examine each event without reference to the behaviour...

splunk-web-attack-detection

🔍 Web Application Attack Detection & Threat Hunting Using Splu...

CVE-2026-42368

A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability...

CVE-2026-28741

Mattermost CVE-2026-28741 concerns CSRF token validation bypass on an authentication endpoint, enabling an attacker to update a user’s authentication method via a CSRF attack when a user visits a malicious page. Affected versions are Mattermost 10.11.x ≤ 10.11.12, 11.5.x ≤ 11.5.0, 11.4.x ≤ 11.4.2...