nuclei-burp-plugin

Nuclei Template Generator Burp Plugin A Burp Suite plugin intended to help with nuclei template generation...

DeepZero

Automated vulnerability research pipeline engine Define pipelines as YAML. DeepZero handles orchestration, parallelism, fault tolerance, and state. English | 简体中文 | Français 🔗 Pipeline-as-YAML - chain ingest, filter, transform, and LLM-assess stages declaratively ⚡ Parallel execution -...

wprecon

WPRecon A powerful, template-driven WordPress reconnaissance and vulnerability scanning tool Features • Installation • Usage • Architecture • Templates 📋 Overview WPRecon is a modern WordPress security reconnaissance tool built with Go that helps security engineers identify vulnerabilities,...

cve-2021-21425

Exploit for: GravCMS 1.10.7 - Arbitrary YAML Write/Update Unauthenticated Usage: root@kitploit: python3 exploit.py --url http://192.168.204.12/grav-admin Expected behaviour Do not use this exploit on systems you are not authorized! Happy hacking...

metta

Metta Metta is an information security preparedness tool. This project uses Redis/Celery, python, and vagrant with virtualbox to do adversarial simulation. This allows you to test mostly your host based instrumentation but may also allow you to test any network based detection and controls...

sigmalite

github.com/runreveal/sigmalite Package sigmalite provides a parser and an execution engine for the Sigma detection format. root@kitploit: rule, err := sigmalite.ParseRulebyte title: My example rule detection: keywords: - foo - bar selection: EventId: 1234 condition: keywords and selection if err ...

erebus

Fast and customisable parameter based vulnerability scanner based on simple YAML Rules...

snakeyaml_cve_poc

snakeyamlcvepoc SnakeYAML-CVE-2022-1471-POC build Either build the jar on your host with mvn clean compile assembly:single Or use docker to build an image with docker build -t snakeyaml . run Run the container with docker run --rm -p8080:8080 snakeyaml or the jar if you built on your host with ja...

dwn

🥽 dwn dockerpwn - a docker attack tool manager introduction dwn is a "docker-compose for hackers". Using a simple YAML "plan" format similar to docker-compose, image names, versions and volume / port mappings are defined to setup a tool for use. features With dwn you can: Configure common pentest...

CVE-2020-1947

CVE-2020-1947 Apache ShardingSphere UI YAML Parsing Remote Code Execution Vulnerability Reproduction and Analysis Overview ShardingSphere is an open-source ecosystem under Apache, a set of distributed database middleware solutions composed of three independent frameworks: Sharding-JDBC,...

Query-Hub

CQL-Hub | CrowdStrike SIEM & LogScale Queries Welcome to the CQL-Hub Backend Repository This repository powers cql-hub.com: A free, community-driven hub for CrowdStrike Falcon SIEM queries. All queries stored here are automatically published and made visible on the CQL-Hub website, making it easi...

commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input

A flaw was found in Apache Commons Configuration. When processing an untrusted configuration file, a remote attacker could provide specially crafted YAML input with cycles. This could lead to an uncontrolled recursion, causing a StackOverflowError and resulting in a Denial of Service DoS for the...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

AutoPiff

AutoPiff Automated Patch Intelligence and Finding Framework A semantic analysis engine for detecting vulnerability fixes in Windows kernel driver patches. AutoPiff uses conservative YAML rules to identify security-relevant code changes with high precision and explainability. Overview AutoPiff...

automatic-api-attack-tool

Automatic API Attack Tool Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API...

aerleon

Aerleon Generate firewall configs for multiple firewall platforms from a single platform-agnostic configuration language through a command line tool and Python API. Aerleon is a fork of Capirca with the following major additions: YAML policy and network definition files and pol2yaml, a converter...

threagile

Threagile Agile Threat Modeling Toolkit Threagile see threagile.io for more details is an open-source toolkit for agile threat modeling: It allows to model an architecture with its assets in an agile fashion as a YAML file directly inside the IDE. Upon execution of the Threagile toolkit all...

yaml2yara

Introduction Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by David Cannings @edeca [email protected] http://www.github.com/nccgroup/yaml2yara This project is released under the AGPL license. Please see LICENSE for more information. Overview This repository...

appspec-yaml-leaks

Badges License MIT Installation 1...

rayder

Rayder Una herramienta ligera para orquestar y organizar tus flujos de trabajo en línea de comandos Acerca de • Instalación • Uso • Configuración del flujo de trabajo • Ejecución paralela • Flujos de trabajo Acerca de Rayder es una herramienta de línea de comandos diseñada para simplificar la...