longofo Goto Github PK

0day

各种CMS、各种平台、各种系统、各种软件漏洞的EXP、POC ,该项目将持续更新

address

apache-dubbo-hessian2-cve-2021-43297

Apache Dubbo Hessian2 CVE-2021-43297 demo

apacheaxis1.4vuldemo

Apache Axis1.4漏洞demo

apacheaxis2vuldemo

Apache Axis2漏洞Demo

awesome-java-security

Java安全☞代码审计/漏洞研究/武器化

beanshooter

JMX enumeration and attacking tool.

blasting_dictionary

爆破字典

bounty-targets-data

This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports

bug-bounty-reference

Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature

codeql

《深入理解CodeQL》Finding vulnerabilities with CodeQL.

ct

简单易用的域名爆破工具

cyberbrain

python持久可视化跟踪调试

darkangel

DarkAngel 是一款全自动白帽漏洞扫描器，从hackerone、bugcrowd资产监听到漏洞报告生成、漏洞URL截屏、企业微信通知。

decrypt-jar

有时候会遇到某些jar包中某些.class内容可能被加密，项目中提供了一个解密jar中所有被加密.class的大体结构

deobfuscator

The real deal

dongtai-agent-java

“火线～洞态IAST”是一款专为甲方安全人员、甲乙代码审计工程师和0 Day漏洞挖掘人员量身打造的辅助工具，可用于集成devops环境进行漏洞检测、作为代码审计的辅助工具和自动化挖掘0 Day。

dotnet-deserialization

dotnet 反序列化学习笔记

dotnet-deserialization-scanner

.NET Deserialization Passive Scanner

drissionpage

基于python的网页自动化工具。既能控制浏览器，也能收发数据包。可兼顾浏览器自动化的便利性和requests的高效率。功能强大，内置无数人性化设计和便捷功能。语法简洁而优雅，代码量少。

easyxsspayload

XssPayload List . Usage:

fastjson-blacklist

fastjson-remote-code-execute-poc

fastjson remote code execute poc 直接用intellij IDEA打开即可 首先编译得到Test.class，然后运行Poc.java

fastjson_denyhashcode_fuzzer

fastjsonchecker

burp手工检测fastjson辅助

flask-demo

A blog with flask

flask-zhihuser

使用flask实现的知乎用户搜索

gadgetinspector

A byte code analyzer for finding deserialization gadget chains in Java applications

gittools

A repository with 3 tools for pwn'ing websites with .git repositories available

hsqldb-source