appsec.fyi

Tools

567 application security resources indexed across 24 tools — guides, tutorials, exploits, and reviews.

Browse by tool

Resources tagged to a specific AppSec tool — Burp Suite, sqlmap, nuclei, Frida, and others. Tools with fewer than 3 resources are not listed. The same resource can appear under multiple topics; topic tags in each row link back to the topic page.

Burp Suite 247 Snyk 102 sqlmap 53 nuclei 20 TruffleHog 18 OWASP ZAP 14 amass 12 Frida 12 nmap 11 gitleaks 10 ffuf 8 Shodan 8 Postman 7 MobSF 6 Trivy 6 Caido 5 Wireshark 5 mitmproxy 4 semgrep 4 BeEF 3 BloodHound 3 checkov 3 dirsearch 3 subfinder 3

Burp Suite portswigger.net RSS #

247 resources across 23 topics: AI, API Sec, AuthN, AuthZ, Bug Bounty, Burp, CSRF, Deser, Fuzzing, golang, GraphQL, IDOR, JWT, Python, RCE, Recon, Secrets, SQLi, SSRF, SSTI, Talks, XSS, XXE.

DateResourceTopics
2026-09-18 2026[tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
Tool for automating novel HTTP desync attack discovery; utilizes an autonomous system, the HTTP Terminator, that fragments RFCs and generates vectors tested against live websites via a Burp extension. The system invented a new dual Content-Length desync pattern, the dangling-byte technique, and identified response forking, with a significant discovery of Shared Parser Confusion originating from analyzing its own findings.
AI
2026-08-17 2026Introducing Session Switcher. Swap Burp Sessions with One Click!
Library for managing Burp Suite HTTP sessions, Session Switcher streamlines authorization testing by allowing users to save and switch between multiple named sessions with a single click directly from the request editor. It automates the tedious process of copying and pasting cookies and headers, reducing errors and improving focus during privilege escalation and IDOR testing. The extension can also auto-update saved sessions by monitoring proxy traffic, ensuring authentication data remains valid throughout an engagement.
AuthZBurpIDOR
2026-07-29 2026Unprotected admin functionality — PortSwigger Access control vulnerabilities Lab 1
Writeup detailing the exploitation of Broken Access Control (BAC-Portswigger-001) in a PortSwigger lab, where an unprotected administrator panel was discoverable via the `robots.txt` file. An unauthenticated attacker can access the `/administrator-panel` endpoint, allowing sensitive actions like deleting user accounts, leading to full application compromise. Remediation involves enforcing authentication, implementing authorization checks, and avoiding reliance on `robots.txt` for security.
AuthZBug BountyIDOR
2026-07-28 2026Unprotected admin functionality with unpredictable URL — PortSwigger Access Control Lab 2
Writeup of PortSwigger Access Control Lab 2, detailing Broken Access Control where an unprotected admin panel's unpredictable URL is disclosed via client-side JavaScript. Attackers can exploit this by inspecting the home page source, identifying the admin endpoint, and gaining unauthorized access to perform actions like deleting users, leading to full application compromise. Remediation involves enforcing authentication, implementing proper authorization checks, and avoiding security through obscurity.
AuthZRecon
2026-07-09 2026Dev: SSRF: Your ticket to internal networks & cloud metadata! Misconfigs in web apps let you fetch backend resources. Check URL params API endpoints. Ffuf & Burp are your friends. Master it! #SSRF #BugBounty
This content explains Server-Side Request Forgery (SSRF) vulnerabilities. SSRF attacks exploit web application misconfigurations to allow attackers to access internal networks and cloud metadata by fetching backend resources. Key areas to investigate for SSRF include URL parameters and API endpoints. Tools like Ffuf and Burp Suite are recommended for identifying these vulnerabilities. The post encourages mastering SSRF for bug bounty hunting. No specific payout amount is mentioned.
SSRF
2026-07-03 2026ZOWEH: SSRF LAB 2 SOLVED: Basic SSRF against another back-end system Goal: Find internal admin server IP via SSRF Method: Automated IP scanning with Burp Intruder #SSRF #BugBounty
ZOWEH: SSRF LAB 2 SOLVED: Basic SSRF against another back-end system Goal: Find internal admin server IP via SSRF Method: Automated IP scanning with Burp Intruder #SSRF #BugBounty https://ift.tt/zm3UX...
SSRF
2026-06-25 2026I Wasted 3 Days Intercepting a Flutter App. Here’s What Actually Works.
The author spent three days attempting to intercept traffic from a Flutter app for security assessment using various tools and techniques like Burp Suite, Objection, ReFlutter, custom CA installation, VPN interception, and Frida scripts. Despite these efforts, all methods resulted in the app displaying a "no internet" error, rather than typical SSL or certificate warnings. The author found that none of the common approaches were successful in capturing the app's traffic.
Burp
2026-06-12 2026How I Built a Burp Extension Efficiently with Claude
Claude significantly streamlined Burp extension development for security researchers. The author used Claude to create an extension that flags non-standard HTTP headers, aiding in the discovery of injection vulnerabilities. By prompting Claude, the author generated an idea and a prototype, demonstrating how AI can overcome the coding hurdles previously associated with extension building. The extension leverages the IANA registry of common HTTP headers as a filtering mechanism.
AIBurp

Showing the newest 8. Browse all 247 →

Snyk snyk.io RSS #

102 resources across 13 topics: AI, API Sec, AuthN, Bug Bounty, Fuzzing, golang, JWT, Python, Secrets, SSRF, Supply Chain, Talks, XSS.

DateResourceTopics
2026-08-27 2026Why Your AI Application Is Exposed Snyk
Framework for adversarial AI testing that organizes security strategy around three distinct lenses: DAST to map the exposed surface, AI penetration testing to validate exploitability, and AI red teaming to demonstrate business impact. This approach advocates for a unified testing harness over isolated vendor engagements, emphasizing orchestration to bridge visibility gaps and chain risks effectively. The framework addresses known-taxonomy chains and cross-layer behavioral emergence by sharing data and primitives between DAST, AI pentesting, and red team exercises.
AI
2026-08-19 2026Benchmarking Secure-and-Functional Remediation and How Snyk Agent Fix Lifts Frontier-Model Fix Rates by over 14%
Library for benchmarking secure-and-functional vulnerability remediation, evaluating frontier models like Gemini 3.1 Pro and Claude Opus 4.6. Snyk Agent Fix, augmented with Snyk Intelligence, demonstrably lifts fix rates by over 14%, improving performance from 74.6% to 85.4% for Opus 4.6. This enhancement is most pronounced in areas where models struggle, such as Python samples, where Snyk Intelligence boosts fixes from 64% to 88%.
Python
2026-08-17 2026Secure at Inception: Announcing the Snyk Studio Integration for Snowflake Cortex Code
Library integrating Snyk Studio with Snowflake Cortex Code provides real-time scanning of AI-generated Python code, dependency analysis for Snowpark Container Services, and direct security feedback to developers. This "secure at inception" approach addresses vulnerabilities in application logic, including injection flaws in dynamic SQL, and mitigates risks from third-party packages and poisoned dependencies. The integration aims to accelerate secure innovation, eliminate shadow AI risks, reduce costs by catching bugs early, and offer unified governance for Snowflake application development.
AISupply Chain
2026-06-30 2026Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?
Library of tests for Snyk VulnBench JS 1.0, evaluating LLM security review repeatability by measuring consistency of findings on JavaScript code. The benchmark uses small Express applications and compares LLM outputs against Snyk Code SAST reference vulnerabilities, revealing that LLM-generated findings are inconsistently repeatable, particularly those outside the established reference set, unlike the deterministic output of traditional SAST tools.
AI
2026-06-24 2026What nearly 10,000 developer environments reveal about agentic development risk
Analysis of nearly 10,000 developer environments reveals significant risks in agentic development, with 43% of developers using multiple AI coding tools and 50.8% employing MCP servers. These configurations, along with agent skills (used by 22.8%), introduce a new supply chain layer where prompt injection findings and malicious code patterns are already present in active tooling. Traditional AppSec controls need expansion to govern these developer environments, as risks emerge before code commitment, impacting tools like Claude, Cursor, and VS Code extensions.
AISupply Chain
2026-06-24 2026Announcing Agentic Development Security (ADS)
Library for Agentic Development Security (ADS) that secures AI-driven software development by embedding security directly into workflows. It provides visibility, governance, and control over tools agents use, their actions, and generated code. ADS addresses risks from dynamic, multi-step workflows and autonomous agent behavior, moving security from post-code analysis to real-time evaluation of agent supply chains, behavior, and generated code, preventing issues like the deletion of a production database by an AI agent with improper credentials and no guardrails.
AI
2026-06-23 2026Secure your software supply chain with the new Snyk Vulnerability Intelligence for SBOM ServiceNow integration
Integration that brings Snyk package vulnerability intelligence to SBOMs stored in ServiceNow. This tool identifies vulnerability severity within application and software package contexts, offering fix information and remediation guidance. It automates the creation of application vulnerable items in ServiceNow Vulnerability Response, enabling task assignment, progress tracking, and stakeholder notification. The integration aids in managing risks from zero-day vulnerabilities, such as recent http2 or curl vulnerabilities, and facilitates the analysis of third-party SBOMs for pre-deployment vulnerability assessment.
Supply Chain
2026-06-23 2026Exploring WebExtension security vulnerabilities in React Developer Tools and Vue.js devtools
Writeup detailing WebExtension security vulnerabilities discovered in React Developer Tools (CVE-2023-5654) and Vue.js devtools (CVE-2023-5718). The research highlights risks such as unverified external messages allowing arbitrary URL fetching via `fetch()`, and unauthorized access to page capture APIs enabling sensitive data leakage through base64 encoded screenshots. The analysis explores the WebExtension architecture and specific pitfalls leading to these findings.
Bug Bounty

Showing the newest 8. Browse all 102 →

sqlmap sqlmap.org RSS #

53 resources across 10 topics: AuthN, AuthZ, Bug Bounty, Fuzzing, GraphQL, Mobile, Python, RCE, SQLi, Talks.

DateResourceTopics
2026-09-17 2026From Bug to Schema: Exploring Error-Based SQL Injection on an Authenticating Portal
This paper details the discovery of an error-based SQL injection vulnerability within a production environment, identified through a Vulnerability Disclosure Program (VDP). The analysis focuses on how the vulnerability was found and exploited. The content emphasizes that this case study is for educational purposes, and all sensitive organizational data has been anonymized. No specific bounty payout amount is mentioned.
AuthNSQLi
2026-08-24 2026SQL injection remains a persistent cyber threat after two decades
Survey of SQL injection vulnerabilities, detailing how the persistent threat, despite being well-understood for over two decades, continues to impact organizations globally. This entry highlights significant past incidents like the Heartland Payment Systems breach (2008-2009), Sony attacks (2011), TalkTalk (2015), and the 2023 MOVEit Transfer breach, underscoring the severe consequences including data theft, financial losses, and reputational damage. It emphasizes that implementation weaknesses, inadequate governance, and insufficient developer awareness, rather than a lack of available security measures, allow SQLi to persist.
SQLi
2026-08-18 2026They patched their SaaS and left the self-hosted OSS version vulnerable - AppFlowy Authenticated SQL Injection
Writeup detailing an authenticated SQL injection vulnerability in the self-hosted open-source version of AppFlowy. The vulnerability exists in the `search_term` parameter for the `/api/workspace/{workspace-id}/quick-note` endpoint, allowing authenticated users to exfiltrate, modify, or delete database contents via unsanitized input embedded into JSON path queries. The AppFlowy team confirmed the issue was patched in their commercial cloud offering but remained silent regarding the open-source version.
AuthZSQLi
2026-08-12 2026Critical SQL Injection in Metabase via Password Reset: CVE-2026-72898
Writeup of CVE-2026-72898, a critical unauthenticated SQL injection in Metabase's password reset endpoint. This vulnerability, tracked as GHSA-vwf4-m7j8-wcjf with a CVSS score of 10.0, allows attackers to execute arbitrary SQL against the Metabase application database by exploiting undeclared fields in the reset password request body. Successful exploitation can lead to administrative access, data exfiltration, and compromise of connected databases, with active exploitation confirmed in the wild.
AuthN
2026-08-07 2026Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access
Library of scripts and techniques for attackers to compile post-exploitation toolkits like khunt directly within Oracle databases. This method bypasses traditional endpoint detection by creating Java stored procedures that execute arbitrary commands on the Windows host, leveraging SQL injection flaws in web applications to gain initial access and then using Oracle's embedded JVM to achieve SYSTEM-level code execution. The toolkit includes components for command execution, credential theft, file manipulation, and archive unpacking.
SQLi
2026-08-06 2026Attackers hid malware inside Oracle Database after SQL injection breach
Analysis of a campaign detailing attackers exploiting SQL injection to hide custom Java malware, dubbed Khunt, within Oracle databases. The technique leverages Oracle's embedded Java Virtual Machine (OJVM) to upload, compile, and execute malicious code directly from database objects, enabling persistent footholds and facilitating post-exploitation activities like credential theft and SYSTEM-level command execution by blending with legitimate database functionality. Huntress recommends monitoring for unexpected Java source objects and compiled classes in Oracle environments.
SQLi
2026-08-06 2026Oracle SQL Injection Attack Enables Remote Code Execution
Writeup detailing an Oracle SQL injection attack that achieved remote code execution by abusing `CREATE JAVA SOURCE` functionality. Threat actors deployed the `khunt` toolkit within the Oracle database, leveraging modules like `KhuntCmd` for OS command execution and `KhuntHash` for credential theft. This technique highlights how legitimate database features can be weaponized, underscoring the need for secure coding, least-privilege access, enhanced Oracle monitoring, and robust incident response.
SQLi
2026-08-05 2026Hackers Smuggle Post-Exploitation Toolkit Into Oracle Database Via Classic SQL Injection Flaw
Library that details how a SQL injection vulnerability in a public-facing web application was used to smuggle a custom post-exploitation toolkit named "khunt" into an Oracle database. The attackers abused the `CREATE JAVA SOURCE` command to store and compile Java code as database objects, allowing them to run arbitrary OS commands from within the database, pivot to the underlying Windows server, and exfiltrate registry hives and system information. This technique, sometimes called "oraexec," exploits a blind spot in traditional endpoint security tooling.
SQLi

Showing the newest 8. Browse all 53 →

nuclei github.com/projectdiscovery RSS #

20 resources across 9 topics: AuthZ, Bug Bounty, Fuzzing, Mobile, Recon, SQLi, SSRF, Supply Chain, XSS.

DateResourceTopics
2026-06-18 2026Breaking the Chain: Wiz Uncovers a Signature Verification Bypass in Nuclei, the Popular Vulnerability Scanner (CVE-2024-43405)
Writeup detailing CVE-2024-43405, a critical signature verification bypass discovered in Nuclei, the popular open-source vulnerability scanner from ProjectDiscovery. This vulnerability, uncovered by Wiz, could enable arbitrary code execution by allowing malicious templates to bypass the existing signature verification mechanism, which relies on ASN.1 encoded ECDSA signatures. The bypass exploits subtle issues within the regex-based signature extraction and removal logic, potentially compromising systems running untrusted Nuclei templates.
Supply Chain
2026-06-08 2026Otto Support - Testing MCP Servers
Tool for testing MCP servers; utilizes nmap for discovery, a Nuclei template to identify MCP endpoints, and MCP Inspector to enumerate services and exploit an authorization gap. This bypass allows an unprivileged user to delete other users' tickets by directly calling the `delete_ticket` JSON-RPC method, demonstrating that MCP servers share familiar security fundamentals with traditional web services.
AuthZ
2026-04-17 2026Recon-Script: automation with Nuclei (s1d6point7bugcrowd)
Library for automating Nuclei vulnerability scans, integrating features like voice notifications via espeak, proxychains support, and optional cloud uploads to ProjectDiscovery Cloud Platform (PDCP). It allows for out-of-scope filtering, custom bug bounty headers, and detailed scan logging with timestamps, supporting tools such as subfinder, dnsx, and httpx.
Recon
2026-04-17 2026The Ultimate Guide to Finding Bugs With Nuclei (ProjectDiscovery)
Library for efficient, extensible vulnerability scanning using YAML-based templates. Nuclei supports HTTP, DNS, SSL, and raw TCP protocols, allowing detection of CVEs, misconfigurations, and sensitive file exposures. It integrates into workflows with other tools and offers features like custom template creation, fuzzing, advanced DSL for matchers, and various scan modes including headless and network. Advanced options include rate limiting, template filtering by technology, severity, or name, and resuming interrupted scans.
Recon
2026-04-17 2026Automate Your Nuclei Recon Pipeline with VPN + Discord Alerts
Script automates bug bounty reconnaissance by enumerating subdomains with subfinder, probing live hosts via httpx, rotating NordVPN IPs, and running Nuclei scans with specific templates and filters. It sends Discord alerts for any found vulnerabilities, detailing the count, severity, template ID, matched target, and current IP. The process is designed for repeatable, single-command execution on a list of target domains.
Recon
2026-04-16 2026From Recon to Sensitive Key Exposure Using Nuclei
From Recon to Sensitive Key Exposure Using Nuclei
Recon
2026-04-16 2026Automating Bug Bounties with Nuclei
Automating Bug Bounties with Nuclei
Bug Bounty
2026-04-16 2026Advanced Techniques & Use Cases of Nuclei for Bug Bounty
Advanced Techniques & Use Cases of Nuclei for Bug Bounty
Bug Bounty

Showing the newest 8. Browse all 20 →

TruffleHog github.com/trufflesecurity RSS #

18 resources across 4 topics: Bug Bounty, OSINT, Secrets, Supply Chain.

DateResourceTopics
2026-08-18 2026Git repo forensics: a seven-phase process for investigating suspicious commits
Library automating Git repository investigations into suspicious commits, employing a seven-phase process. It details preserving the repository, collecting platform-held information via a Python script interacting with GitHub and GitLab APIs, and analyzing patches for obfuscation, outbound calls, or CI definition edits. The library also helps validate committer identity against linked accounts, scrutinizes timestamps, verifies signature provenance beyond the "Verified" badge, and determines commit ref inclusion and arrival method, considering repository forks versus mirror clones.
OSINT
2026-07-13 2026What CISA Got Right After Its GitHub Leak: Lessons Every Organization Should Copy
Reference detailing lessons learned from CISA's GitHub leak incident, advocating for continuous secrets scanning, developing dedicated leak-response playbooks, simplifying reporting channels, strengthening development guardrails, and testing credential rotation. It highlights the importance of treating external reports seriously and provides practical steps for security teams to implement, drawing from CISA's experience with exposed developer secrets and simplifying relations with security researchers.
Supply Chain
2026-06-17 2026Want to avoid a data breach? Employ secrets detection
Library for detecting secrets like API keys, passwords, and tokens in application code. It employs sophisticated patterns and regex to identify potentially exposed sensitive data, preventing data breaches. The library integrates with IDEs for real-time feedback and can be incorporated into CI/CD pipelines to fail builds upon secret detection, mitigating risks like unauthorized access, regulatory non-compliance, and loss of competitive advantage.
Secrets
2026-05-08 2026How to mitigate secrets risk and prevent future breaches
Library for detecting and managing secrets risk in code. It details how leaks of credentials, tokens, and signing keys in open source and proprietary repositories are a growing concern, with millions exposed on platforms like GitHub and npm. The library aids in situational awareness by identifying exposed secrets, understanding their purpose, and assessing their potential impact. It emphasizes investing in advanced tooling to filter false positives and prioritize active tokens, alongside evolving development practices to mitigate risks from the design stage forward, ultimately aiming to prevent future breaches.
Secrets
2026-04-19 2026Shai-Hulud: A Persistent Secret Leaking Campaign — GitGuardian
Analysis of the Shai-Hulud campaign details a persistent supply chain attack targeting NPM packages like @ctrl/tinycolor, using malicious GitHub Actions to exfiltrate secrets from local environments and repositories. Similar to the s1ngularity and GhostActions campaigns, this attack injects compromised workflows to steal credentials, including GitHub tokens, NPM tokens, and AWS Keys. GitGuardian's HasMySecretLeaked service allows developers to check for compromised secrets without exposing their values.
Supply Chain
2026-04-17 2026TruffleHog: Deep Dive on Secret Management (Jit)
Library for detecting hardcoded secrets in code. TruffleHog uses hundreds of patterns and strings to identify exposed credentials for services like AWS, GCP, and Azure, and integrates with tools like Slack and Stripe. It offers automation via pre-commit hooks and GitHub Actions, remote scanning capabilities, customizable rules, and secret verification by making API calls. The library also assists in remediating exposed secrets by providing guidance on rotating credentials and cleaning Git history using tools like BFG Repo-Cleaner.
Secrets
2026-04-17 2026TruffleHog Open Source v3 vs GitGuardian
Library comparing TruffleHog Open Source v3 and GitGuardian's code security platform for secrets detection. TruffleHog is a CLI tool for finding hardcoded secrets in repositories, while GitGuardian offers an integrated platform with automated detection, Honeytoken capabilities, alerting, incident prioritization, and remediation workflows across various version control systems. GitGuardian aims to reduce false positives through its detection engine and provides enhanced collaboration, enterprise-grade features, and dedicated support, contrasting with TruffleHog's open-source limitations in scalability and built-in functionality.
Secrets
2026-04-17 2026git-secret-scanner: Find secrets with TruffleHog & Gitleaks
Tool for finding secrets in Git organizations and groups, combining TruffleHog's classification strengths with Gitleaks' broader detection capabilities. It supports GitHub and GitLab, utilizes specific tokens with required scopes, and offers features for ignoring secrets via annotations or fingerprint files, as well as baseline scanning to detect new secrets.
Secrets

Showing the newest 8. Browse all 18 →

OWASP ZAP zaproxy.org RSS #

14 resources across 9 topics: AI, API Sec, AuthZ, Bug Bounty, Deser, IDOR, JWT, Talks, XSS.

DateResourceTopics
2026-06-15 2026What Changed in OWASP Top 10 2025? Full Breakdown & Recommendations
Analysis of the OWASP Top 10 2025 identifies two new categories: Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10). Security Misconfiguration has jumped to #2, highlighting risks from continuous deployment without continuous scanning. Broken Access Control (A01) now explicitly includes BOLA and BFLA, crucial for API security. While OWASP's recommendations are sound, their application requires mature SDLC discipline and unified tooling. Software Supply Chain Failures (A03) shows a high incidence rate but low CVE coverage, indicating current attacks with limited scanner detection. Addressing these shifts by category can improve an organization's security posture.
AuthZ
2026-04-11 2026OWASP Top 10 for LLMs 2025: Key Risks and Mitigation Strategies
Survey of the OWASP Top 10 for LLM Applications (2025), detailing evolving technical and socio-technical risks like prompt injection and excessive agency. This updated list guides enterprises in securing generative AI ecosystems, from training pipelines to plugins, addressing data disclosure and systemic vulnerabilities relevant to GDPR, HIPAA, CCPA, and the EU AI Act. Invicti's proof-based scanning and LLM-specific checks are presented as tools to validate real risks and strengthen defenses.
AI
2026-04-10 2026OWASP WSTG: Testing JSON Web Tokens
Reference detailing OWASP's Web Security Testing Guide (WSTG) procedures for testing JSON Web Tokens (JWTs). It covers analyzing JWT headers and payloads for sensitive data, testing for tampering vulnerabilities, and verifying signature integrity. Specific attack vectors discussed include exploiting the "none" algorithm, the ECDSA "psychic signatures" vulnerability (CVE-2022-21449), weak HMAC key cracking using tools like crackjwt.py and John the Ripper, and HMAC vs. public key confusion attacks.
JWT
2026-04-10 2026BLA9:2025 Broken Access Control - OWASP
Reference detailing BLA9:2025 Broken Access Control, a critical OWASP Top 10 vulnerability. It explains how missing role checks, flawed logic trusting client-supplied parameters, overly broad permissions, and identifier tampering (BOLA) enable attackers to perform unauthorized operations. Examples include Gitlab branch deletion vulnerabilities and privilege escalation in hay-kot mealie v2.2.0, mapping to CWEs like CWE-863 and CWE-862, and referencing CVEs such as CVE-2021-39931 and CVE-2023-3290.
AuthZ
2026-04-10 2026OWASP A01: Broken Access Control Risks and Prevention
Library detailing OWASP A01: Broken Access Control risks and prevention. This resource clarifies the distinction between authentication and authorization, highlights the importance of the principle of least privilege (PoLP) and Role-Based Access Control (RBAC), and provides a Python Flask code snippet demonstrating secure RBAC implementation. It further explains how vulnerabilities manifest through techniques like URL manipulation and parameter tampering, and identifies common failure scenarios such as Insecure Direct Object References (IDOR) and missing function-level access control.
AuthZ
2026-04-10 2026OWASP-TOP-10 A01:2025 Broken Access Control
Library detailing Broken Access Control, a critical OWASP Top 10 risk where applications fail to enforce user restrictions. This resource highlights how attackers can exploit missing or client-side enforced authorization checks, using tools like Burp Suite to directly access backend administrative endpoints. It demonstrates the vulnerability through a case study of an application trusting client-side role validation, leading to unauthorized data access, privilege escalation, and account compromise, and emphasizes implementing server-side authorization and the principle of least privilege for mitigation.
AuthZ
2026-04-10 2026IDOR - OWASP Foundation
Reference detailing Insecure Direct Object Reference (IDOR) vulnerabilities, a class of Broken Access Control (OWASP Top 10 A01:2025). IDOR occurs when applications expose internal object references, like database keys or file names, without verifying user authorization, allowing attackers to access unauthorized resources by modifying these references in URL path parameters, query strings, or request bodies. Prevention strategies include enforcing server-side authorization, using non-sequential identifiers, applying the principle of least privilege, and validating access at the data layer.
IDOR
2026-04-03 2026Insecure Deserialization | OWASP
Reference on Insecure Deserialization, a vulnerability that allows attackers to execute code or manipulate objects by abusing an application's deserialization process with untrusted data. This vulnerability can lead to remote code execution, denial-of-service, and privilege escalation. Mitigations include avoiding deserialization of untrusted data, implementing integrity checks, enforcing strict type constraints, isolating deserialization code, logging exceptions, monitoring the process, and using alternative formats like JSON.
Deser

Showing the newest 8. Browse all 14 →

amass github.com/owasp-amass RSS #

12 resources across 2 topics: Bug Bounty, Recon.

DateResourceTopics
2026-04-17 2026Complete Guide to Amass Tool (2025 Edition)
Library for comprehensive Amass recon and subdomain enumeration, covering installation on Kali Linux, Termux, and Windows WSL. It details Amass modules like Enum, Intel, Viz, Track, and DB, and provides basic usage examples for discovering subdomains, mapping DNS, and performing passive and active recon. The guide also includes pro tips for bug bounty hunters and installation via GitHub binary.
Recon
2026-04-10 2026Amass Cheat Sheet: 70+ Commands for Recon & Bug Bounty
Cheatsheet of 70+ Amass commands for reconnaissance and bug bounty hunting, detailing installation on Kali Linux, beginner and advanced techniques, and real penetration testing scenarios. This resource helps cybersecurity professionals discover subdomains, exposed infrastructure, and attack surfaces by leveraging open-source intelligence, DNS queries, and brute force methods. It also covers Amass's legal usage, its inclusion in Kali Linux, and alternatives like Subfinder and Sublist3r for comprehensive domain enumeration.
Recon
2026-04-06 2026Using OWASP Amass with Netlas Module
Library for reconnaissance and attack surface mapping, OWASP Amass integrates with the Netlas module. This guide details Amass installation via pre-built packages, source compilation, or Homebrew, and its configuration to leverage Netlas API keys within `datasources.yaml` for enhanced subdomain enumeration. Users can then execute `amass enum -d <domain> -include Netlas` to specifically query Netlas data or `amass enum -d <domain> -o <output_file>` to combine Netlas with other configured sources.
Recon
2026-04-03 2026How to Use Amass for Subdomain Enumeration and Recon Like a Pro
Library for comprehensive subdomain enumeration and attack surface discovery. Amass employs passive OSINT techniques, leveraging Certificate Transparency logs, Shodan, Censys, and public datasets, alongside active methods like DNS brute-forcing, permutations, and scraping. It supports DNS resolution and validation, brute-forcing with custom wordlists, reverse WHOIS and ASN lookups, and infrastructure mapping via graph databases, enabling visualization with `amass viz` and change detection with `amass track`.
Recon
2025-08-14 2025amass — Automated Attack Surface Mapping | Daniel Miessler
Tool for mapping attack surfaces, amass automates information gathering across multiple dimensions, integrating data from DNS enumeration, scraping various search engines, certificate transparency logs, and numerous APIs. It offers subcommands like `intel` for initial reconnaissance, `enum` for subdomain discovery and attack surface mapping, `viz` for visualizing results (including D3 and Maltego formats), `track` for historical analysis, and `db` for database management. Amass prioritizes diverse input sources and consistent developer attention, making it a robust solution for both offensive and defensive security operations.
Bug Bounty
2021-10-28 2021Haklukes Guide to AmassHow to Use Amass More Effectively for Bug Bounties
Haklukes Guide to AmassHow to Use Amass More Effectively for Bug Bounties
Bug BountyRecon
2021-10-28 2021OWASP Amass - An Extensive Tutorial
Library for passive and active reconnaissance, Amass facilitates subdomain discovery and external attack surface mapping using over 80 data sources. Its three subcommands, `intel`, `enum`, and `db`, support techniques like brute-forcing, DNS zone transfers, and certificate transparency log analysis, with findings stored in a graph database.
Recon
2021-10-28 2021Amass/config.ini at master OWASP/Amass
Amass/config.ini at master OWASP/Amass
Recon

Showing the newest 8. Browse all 12 →

Frida frida.re RSS #

12 resources across 1 topic: Mobile.

DateResourceTopics
2026-04-22 2026Reverse engineering and modifying Android apps with JADX and Frida
Library for reverse engineering and modifying Android applications, utilizing JADX for code extraction and Frida for dynamic instrumentation. This resource details how to decompile APKs, analyze Java source code generated by JADX, and write custom Frida scripts to bypass security measures like certificate pinning, enabling traffic interception with tools like HTTP Toolkit. It covers techniques applicable to understanding and altering app behavior beyond standard certificate pinning implementations.
Mobile
2026-04-22 2026Bypassing iOS Frida Detection with LLDB and Frida
Writeup details bypassing iOS Frida detection using LLDB and Frida. The process involves jailbreaking an iPhone, setting up development tools like `libimobiledevice`, `frida-tools`, and LLDB, and then using `debugserver` for remote debugging. The author demonstrates how to find and breakpoint `FridaInTheMiddle.systemSanityCheck()` with LLDB to bypass detection, trace the `dummyFunction(flag:)` Swift function using `frida-trace` to get its mangled name, and finally hook this function with a Frida script to intercept and decode the Swift string argument, ultimately revealing the flag.
Mobile
2026-04-22 2026frida-interception-and-unpinning: Scripts to MitM all HTTPS traffic
Library of Frida scripts automates HTTPS MitM interception on mobile devices by redirecting traffic to a proxy, injecting CA certificates into trust stores, and patching certificate pinning and transparency checks. It also handles fallback patching for obfuscated certificate pinning on Android, disables root/jailbreak detection, and blocks HTTP/3 connections. The scripts can be used independently or together to intercept HTTP(S) traffic on Android and iOS.
Mobile
2026-04-16 2026Frida's Impact on Mobile Security and How to Fight Back
Frida's Impact on Mobile Security and How to Fight Back
Mobile
2026-04-16 2026From an Android Hook to RCE: $5000 Bounty
From an Android Hook to RCE: $5000 Bounty
Mobile
2026-04-11 2026Frida CodeShare: iOS Jailbreak Detection Bypass
Frida CodeShare: iOS Jailbreak Detection Bypass
Mobile
2026-04-11 2026iOS Jailbreak Detection Bypass with Frida - Full Guide
Library for bypassing iOS jailbreak detection using Frida. This guide details how to leverage Corellium's virtualized platform to identify and hook specific methods within applications like DVIA-2. It covers setup, class and method enumeration, and modifying boolean return values to circumvent detection mechanisms, enabling dynamic analysis and security testing of iOS applications.
Mobile
2026-04-10 2026Frida - OWASP Mobile Application Security Tool
Library for dynamic instrumentation, Frida enables JavaScript execution within native Android and iOS applications. It utilizes QuickJS for code injection via modes like Injected, Embedded, and Preloaded. Key APIs include Interceptor for inline hooking and Stalker for transparent, high-granularity tracing using JIT recompilation. Frida also offers specific APIs for Java and Objective-C interaction, alongside terminal tools such as `frida-ps` for process listing and `frida-trace` for function call tracing. Frida 17 introduces breaking changes, including the removal of bundled runtime bridges, necessitating separate installation via `frida-pm`, and API modifications for enhanced readability and performance.
Mobile

Showing the newest 8. Browse all 12 →

nmap nmap.org RSS #

11 resources across 3 topics: AI, RCE, Recon.

DateResourceTopics
2026-04-17 2026Mastering Network Scanning: Nmap and Masscan Guide
Mastering Network Scanning: Nmap and Masscan Guide
Recon
2026-04-14 2026Microsoft Patch Tuesday for April 2026 - Snort Rule and Prominent Vulnerabilities
Snort rules detect exploitation attempts for Microsoft's April 2026 Patch Tuesday, which includes 165 vulnerabilities. Critical issues addressed by the rules include CVE-2026-23666 (.NET DoS), CVE-2026-33824 (Windows IKE RCE), CVE-2026-33826 (Active Directory RCE), and CVE-2026-33827 (Windows TCP/IP RCE). The update also covers several "more likely" to be exploited important vulnerabilities, such as CVE-2026-0390 (UEFI Secure Boot bypass) and CVE-2026-32201 (SharePoint spoofing).
RCE
2026-02-16 2026How I Built a 5-Path AI “Recon Beast” with n8n and Gemini (2026 Guide)
In 2026, the bug bounty landscape requires more than just speed, with AI enhancing attacker capabilities. The article discusses building a 5-Path AI "Recon Beast" using n8n and Gemini. This innovative approach leverages automation and AI to enhance reconnaissance processes for bug bounty hunting. The focus is on utilizing technology to improve efficiency and effectiveness in identifying vulnerabilities.
AI
2025-04-11 2025Nmap for Beginners: Easy Tips to Scan Networks Like a Pro
So, Think this :::: one night when you are trying to sleep , suddenly you imagine what’s happening on your network .. what devices are connected? What services are they running? {JUST 2 AM THOUGHTS…
Recon
2025-03-22 2025A Deep Dive into Nmap Scripts for Web Application Testing | by Khaleel Khan | System Weakness
A Step-by-Step Guide to Leveraging Nmap’s Most Advanced Scripts for Comprehensive Web Application Security Analysis This scenario showcases how an experienced penetration tester could leverage Nmap’s…
Recon
2025-01-29 2025GitHub - Chleba/netscanner: Terminal Network scanner & diagnostic tool with modern TUI
Tool for terminal-based network scanning and diagnostics featuring a modern TUI. It lists hardware interfaces, allows switching active interfaces for scanning and packet-dumping, scans WiFi networks and signal strength with charts, and performs IPv4 pinging of CIDRs with hostname, OUI, and MAC address resolution. The tool also supports IPv4 and IPv6 packet dumping (TCP, UDP, ICMP, ARP, ICMP6), pausing packet dumps, scanning open TCP ports, filtering packet logs, exporting scanned data to CSV, and traffic counting with DNS records. It relies on Ratatui and libpnet libraries.
Recon
2025-01-28 2025GitHub - aceberg/WatchYourLAN: Lightweight network IP scanner. Can be used to notify about new hosts and monitor host online/offline history
Tool for lightweight network IP scanning, WatchYourLAN detects new hosts, monitors online/offline history, and logs all devices. It supports data export to InfluxDB2 or Prometheus for Grafana dashboards. While lacking built-in authentication, it can integrate with SSO tools like Authelia or ForAuth. Installation is available via Docker, with binary packages for various Linux distributions and architectures, and dependencies include `arp-scan` and `tzdata`.
Recon
2023-06-02 2023The Ultimate Guide to Port Scanning using Nmap | Nmap Notes
Library for port scanning with Nmap, detailing target specification, host discovery methods like ARP, ICMP, and TCP SYN pings, and port specification techniques. It covers service and version detection, along with leveraging the Nmap Scripting Engine (NSE) for advanced exploitation.
Recon

Showing the newest 8. Browse all 11 →

gitleaks github.com/gitleaks RSS #

10 resources across 1 topic: Secrets.

DateResourceTopics
2026-04-22 2026GitHub Secret Scanning 2026: New Patterns, Push Protection
Library for GitHub Secret Protection offers enhanced detection of leaked secrets with 28 new patterns across 15 providers, expanded push protection for 39 token types, and AI-powered generic password detection via Copilot. Available to GitHub Team plan customers at $19 per month per active committer, it includes validity checks and improved API visibility. This solution aims to prevent credential-related breaches, which cost an average of $4.88 million, by blocking pushes of sensitive information like Supabase service keys and Vercel API tokens before they reach repositories.
Secrets
2026-04-19 2026Pre-Commit Hooks for Secret Detection: Setup in 10 Minutes
Library for implementing pre-commit hooks to prevent secrets from entering Git history. It details the setup process for tools like gitleaks, detect-secrets, and TruffleHog, offering solutions for immediate detection and blocking of credential leaks. The library emphasizes catching secrets at the cheapest point in the lifecycle, preventing the need for costly history rewrites and incident response by integrating these tools seamlessly into the Git commit workflow.
Secrets
2026-04-19 2026Understanding Your Organization's Exposure to Secret Leaks — GitHub
Library for assessing an organization's exposure to secret leaks, highlighting that over 39 million secrets were detected on GitHub in 2024 alone. This resource details how secrets like API keys and passwords are leaked through repository commits or misconfigurations, referencing the $4.88 million average cost of credential compromise breaches and the 2022 LastPass breach. It provides methods for quantifying risk, including inventory audits and benchmarking against OWASP ASVS and NIST guidelines, and mentions GitHub's secret risk assessment tool for enterprise customers.
Secrets
2026-04-19 2026Exposed Developer Secrets Surge: AI Drives 34% Increase in 2025
Report detailing a 34% surge in exposed developer secrets during 2025, fueled by AI-assisted coding and expanded use of tools like Claude Code. GitGuardian's analysis highlights significant increases in leaked AI service credentials, including DeepSeek API keys, and identifies internal repositories as a six-fold greater risk. The report also notes that 28% of exposures occur outside code in platforms like Slack and Jira, with 64% of discovered secrets remaining unrevoked.
Secrets
2026-04-19 2026GitHub Found 39M Secret Leaks in 2024 — The GitHub Blog
Library for GitHub Advanced Security, featuring Secret Protection and Code Security, addresses the pervasive issue of exposed secrets, which led to 39 million leaks on GitHub in 2024. It emphasizes built-in push protection for public repositories and introduces affordable standalone products and a free point-in-time scan for organizations to identify and manage secret exposures effectively, partnering with vendors like AWS and Google Cloud Platform to enhance detection accuracy.
Secrets
2026-04-11 2026Secret Scanning in CI Pipelines using Gitleaks
Tool for integrating Gitleaks into GitLab CI pipelines for secret scanning. It details setting up a CI job to run Gitleaks against the OWASP Juice Shop application, demonstrating how to detect and prevent secret leaks like API keys, usernames, and secret keys from being committed. The entry also mentions the use of Git hooks as a pre-commit security measure.
Secrets
2026-04-11 2026Add a Local Gitleaks Pre-Commit Hook
Library for a local Gitleaks pre-commit hook that prevents accidental secrets from entering Git history. It utilizes files within `.git/` for a fast, easily removable safety net, supporting custom configurations via `.gitleaks.toml` and optional team-wide enforcement with Lefthook or GitHub Actions.
Secrets
2026-04-10 2026Top 8 Git Secrets Scanners in 2026
Library of eight Git secrets scanners, including Jit, Gitleaks, GitGuardian, HawkScan, AWS Git Secrets Scanner, Spectral, Trufflehog, and GitHub Secret Scanning, designed to detect and neutralize exposed sensitive data like API keys and credentials within code repositories. These tools employ pattern-based and ML detection, custom rules, historical and pre-commit scanning, CI/CD integration, and remediation guidance to prevent data breaches and unauthorized access by shifting security left in the development lifecycle.
Secrets

Showing the newest 8. Browse all 10 →

ffuf github.com/ffuf RSS #

8 resources across 4 topics: API Sec, Bug Bounty, Fuzzing, Recon.

DateResourceTopics
2026-08-21 2026Web fuzzing for hackers
Library for web fuzzing techniques, detailing its importance for discovering unreferenced API endpoints, unexpected behavior, and security vulnerabilities. It emphasizes the criticality of crafting specific wordlists and outlines popular tools like ffuf, Burp Suite Intruder, OWASP Amass, Arjun, and Param Miner for various fuzzing objectives, including content discovery, subdomain bruteforcing, and parameter discovery.
Fuzzing
2026-04-22 2026FFuF Fuzzer Guide: Fuzz Faster u Fool for Bug Bounty Hunters
Tool for web fuzzing: FFuF (Fuzz Faster u Fool) assists bug bounty hunters by rapidly discovering directories, files, and hidden parameters. It supports GET and POST requests, authenticated testing via cookies, recursive directory scanning, and allows customization of request delay, threading, and response code filtering. Installation involves obtaining the Go programming language and then using "go get" to install FFuF from its GitHub repository.
Recon
2026-04-11 2026Fuzzing Web Apps using FFUF: Complete Guide
Library for fuzzing web applications using FFUF, covering directory discovery, subdomain enumeration, virtual host fuzzing, multi-layer extension hunting, recursive scanning, authentication testing, and API endpoint discovery. It also details workflow optimizations like rate limiting and Burp Suite integration, while warning against common pitfalls such as unauthorized testing and aggressive scanning.
Fuzzing
2025-08-14 2025A ffuf Primer | Daniel Miessler
Tool for command-line web attacks, ffuf emulates functionality similar to Burp Intruder and Dirbuster. This Go-based utility leverages input files to fuzz parts of URLs, including GET parameters and POST data, for discovering vulnerabilities like disallowed paths and credential stuffing. It offers extensive options for matching responses based on HTTP codes, line counts, or size, and can be used with wordlists such as curated.txt from the RobotsDisallowed project to enhance the likelihood of finding sensitive information.
Bug Bounty
2023-09-03 2023ffuf advanced tricks - ACCEIS
Library for advanced web application fuzzing, `ffuf` goes beyond simple directory enumeration. It supports injecting wordlists into URLs, GET/POST parameters, and HTTP headers, and can read from STDIN or use external generators like Radamsa. This resource details `ffuf`'s configuration file, enabling persistent settings for colorization, custom headers, proxy usage, and multiple simultaneous wordlists, enhancing its capabilities for penetration testing.
API SecFuzzing
2022-01-16 2022How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes
How I Found multiple SQL Injection with FFUF and Sqlmap in a few minutes
Recon
2022-01-10 2022ffuf - Fuzz Faster U Fool
Library for fast web fuzzing written in Go. `ffuf` supports fuzzing URLs, headers, and POST data using the `FUZZ` keyword, and can filter responses by size (`-fs`) or status code (`-fc`). It offers features like recursive scanning, maximum runtime limits (`-maxtime`, `-maxtime-job`), and integrates with mutators via `--input-cmd`, enabling complex fuzzing scenarios such as JSON payload generation with Radamsa. Prebuilt binaries are available, and installation can be done via Homebrew or `go install`.
FuzzingRecon
2021-02-16 2021A ffuf Primer | Daniel Miessler
Tool, ffuf, is a flexible CLI-based web attack utility written in Go, often compared to Burp Intruder on the command line. It excels at fuzzing by injecting input from wordlists into various parts of a web application, including URLs, GET parameters, and POST data. ffuf can emulate tools like Dirbuster and even perform password guessing, making it a versatile addition to a web tester's toolkit, especially when combined with curated wordlists like those found in RobotsDisallowed.
Bug Bounty

Shodan shodan.io RSS #

8 resources across 3 topics: OSINT, Recon, SSRF.

DateResourceTopics
2026-04-22 2026Shodan and Censys for beginners: How to find more vulnerabilities
Guide for beginners on utilizing Shodan and Censys for vulnerability discovery, focusing on reconnaissance techniques. It details how to use specific search operators like `org`, `asn`, `http.status`, `ssl.cert.subject.CN`, `http.favicon.hash`, and `http.html` to identify exposed hosts, forgotten assets via expired certificates, and authentication panels. The guide also explains filtering by technologies such as PHP and finding directory listings.
Recon
2026-04-17 2026Beyond Google: Navigating the Hidden Internet with Shodan and Censys
Beyond Google: Navigating the Hidden Internet with Shodan and Censys
OSINT
2026-04-17 2026sarenka: OSINT tool (Shodan/Censys) (GitHub)
Tool for OSINT and attack surface discovery, SARENKA gathers information from Shodan, Censys, and Criminal IP, mapping CVEs to CWEs. It also retrieves local machine data, including installed software and network information, alongside utilities for hash calculation, Shannon entropy, and port scanning. Future plans include more cryptography tools and reconnaissance scripts.
OSINT
2025-09-21 2025Flask 3.1.1 SSRF Zero-Day Shodan dork exposed 500 targets 0day PoC (CWE-918) Full Article: nullsecurityx.codes/ssrf-vulnerabi Video: youtube.com/watch?v=Levx_p Responsible disclosure & defensive demo only. #infosec #vulnerability #SSRF #BugBounty
A zero-day vulnerability in Flask 3.1.1 related to SSRF was exposed through a Shodan dork, revealing 500+ potential targets. A proof of concept (PoC) for this vulnerability (CWE-918) was shared. The full article and a video demonstrating the issue were provided. The disclosure was done responsibly, and a defensive demo was included. The content emphasizes information security, vulnerability, SSRF, and Bug Bounty programs. The details can be found at nullsecurityx.codes/ssrf-vulnerabi and the video is available on YouTube.
SSRF
2025-09-21 2025New video: Flask 3.1.1 SSRF Zero-Day Shodan dork exposed 500 targets 0day PoC (CWE-918). Watch now youtube.com/watch?v=Levx_p Responsible disclosure & defensive demo only. #infosec #vulnerability #SSRF #BugBounty
A new video exposes a Flask 3.1.1 SSRF Zero-Day vulnerability using a Shodan dork that revealed 500+ targets with a 0day Proof of Concept (CWE-918). The content emphasizes responsible disclosure and includes a defensive demo. The video can be watched on YouTube. The focus is on information security, vulnerability, SSRF, and Bug Bounty programs.
SSRF
2025-09-21 2025PREMIERE TONIGHT: Flask 3.1.1 SSRF Zero-Day (CWE-918) 8:00 PM (03) In this video: Discover 500 potential targets via Shodan dork PoC demo Turn on notifications so you dont miss it! Watch here: youtube.com/watch?v=Levx_p #BugBounty #CyberSecurity #SSRF
A video premiering tonight at 8:00 PM showcases a Flask 3.1.1 SSRF Zero-Day vulnerability (CWE-918). The content includes a demonstration of discovering 500 potential targets using Shodan dork. Viewers are encouraged to turn on notifications to not miss the premiere. The video link is provided for watching. The focus is on Bug Bounty, Cybersecurity, and SSRF.
SSRF
2025-04-04 202510 Rare and Worthy Websites and Services for Security Professionals
While platforms like Shodan, OWASP, and VirusTotal are staples for security professionals, there are many lesser-known websites and services that offer equally valuable tools and resources. These…
OSINT
2024-12-14 2024🚀 Introducing ShodanSpider v2: Your Ultimate Free Tool for CVE Searching and Shodan Data Analysis…
In today’s fast-paced cybersecurity world, staying ahead of vulnerabilities is critical. ShodanSpider v2 takes your security research to…
Recon

Postman postman.com RSS #

7 resources across 3 topics: API Sec, Bug Bounty, SSRF.

DateResourceTopics
2026-08-12 2026How Postman Embeds Wiz Risk Data Into Dev Workflows
Library integration embeds Wiz risk data into Postman's API Catalog, surfacing known exploitable vulnerabilities, secrets, and misconfigurations within developers' existing workflows. This approach provides one-click remediation commands directly in the interface, improving security KPIs by enabling developers to address risks quickly and efficiently, representing genuine "shift-left" security.
API Sec
2026-08-12 2026How Postman Embeds Wiz Risk Data Into Dev Workflows
Library for embedding Wiz risk data into developer workflows, specifically Postman's API Catalog. This integration surfaces known exploitable vulnerabilities, secrets, and misconfigurations within developer environments, offering one-click remediation commands. The approach enhances security KPIs by allowing developers to quickly address risks directly within their existing tools, representing a genuine shift-left security practice.
API Sec
2026-07-18 2026Shawkat Emad: 5 SSRFs in Postman. Different services. Different techniques. Different impacts. One of them was marked Informative because the internal team found it just 1 day before mebut I'll happily take that as proof I was on the right track. #BugBounty #SSRF #CyberSecurity #HackerOne
Shawkat Emad discovered five Server-Side Request Forgery (SSRF) vulnerabilities in Postman, each utilizing different techniques and impacting various services. While one finding was marked "Informative" as the internal team had discovered it a day prior, Emad views this as validation of their investigative approach. The researcher participated in a bug bounty program for this work.
SSRF
2025-02-10 2025GitHub - usebruno/bruno: Opensource IDE For Exploring and Testing Api's (lightweight alternative to postman/insomnia)
Library for API exploration and testing, Bruno offers a privacy-focused, offline-first alternative to Postman and Insomnia. It stores API collections in local filesystem folders using the Bru markup language, facilitating collaboration via Git or other version control systems. Bruno is available for Mac, Windows, and Linux, with installation options including binary downloads and package managers like Homebrew, Chocolatey, Scoop, Snap, Flatpak, and Apt.
API Sec
2024-12-13 2024Server SSL certificate verification - HTTPie 3.2.4 (latest) docs
Library for interacting with HTTP services from the command line, designed for human-friendly testing and debugging. It supports intuitive syntax, formatted output, JSON, forms, uploads, HTTPS, proxies, authentication, custom headers, persistent sessions, downloads, and a plugin system. Installation instructions are provided for various package managers and operating systems, including standalone executables. The documentation details usage for custom methods, headers, JSON data, form submissions, offline requests, authentication, file uploads/downloads, sessions, and URL parameters.
API Sec
2022-06-09 2022Favorite tweet by @fardeenahmed411
Favorite tweet: API Bug-Bounty Tools Check list (Part - 1) - Postman (It is like Burpsuite for API) - APISec - AppKnox - Synopsis API Scanner - Data Theorem API Secure #cybersecuritytips #bugbountyti...
API SecBug Bounty
2021-08-25 2021API Testing with HTTPie
API Testing with HTTPie
API Sec

MobSF github.com/MobSF RSS #

6 resources across 1 topic: Mobile.

DateResourceTopics
2026-09-09 2026Payment Bypass Flaw in TechPSC HUB
A security researcher discovered a payment bypass vulnerability in the TechPSC HUB Android app. While set 4 of a quiz is supposed to trigger a subscription payment, disabling the internet connection during quiz selection allowed users to access it without paying. The researcher identified leaked APIs by decompiling the app.
Mobile
2026-04-22 2026Reversing Android Apps: Bypassing Detection Like a Pro
Library for bypassing common Android app detection mechanisms like Frida, root checks, and SSL pinning. Techniques include utilizing Magisk DenyList, employing Frida codeshare scripts, attaching Frida after app launch, static analysis with Jadx to identify and patch detection code, using Objection's `patchapk` feature, dumping loaded classes, tracing method calls, reversing native JNI code, and patching SSL pinning with `apk-mitm` for network traffic analysis.
Mobile
2026-04-11 2026Mobile Security Framework - MobSF Documentation
Mobile Security Framework - MobSF Documentation
Mobile
2026-04-11 2026MobSF: Mobile Security Framework (GitHub)
Library for mobile application security, penetration testing, malware analysis, and privacy analysis on Android, iOS, and Windows Mobile. MobSF supports static analysis of APK, IPA, and APPX binaries, as well as dynamic analysis with instrumented testing, runtime data, and network traffic analysis for Android and iOS. It integrates with DevSecOps pipelines via REST APIs and CLI tools.
Mobile
2026-04-03 2026OWASP Mobile Top 10 and MobSF
Library for addressing the OWASP Mobile Top 10 risks, including M1 (Improper Credential Usage) with examples like hardcoded credentials and insecure transmission, M2 (Inadequate Supply Chain Security) concerning malware injection, M3 (Insecure Authentication/Authorization) detailing hidden service requests, M4 (Insufficient Input/Output Validation) leading to remote code execution, M5 (Insecure Communication) through lack of certificate inspection, M6 (Inadequate Privacy Controls) via improper log sanitization, M7 (Insufficient Binary Protections) exposing API keys, and M8 (Security Misconfiguration) from insecure default settings.
Mobile
2021-06-11 2021mobsfscan
Library for static analysis of Android and iOS source code, mobsfscan detects insecure patterns in Java, Kotlin, XML, Swift, and Objective C. It leverages MobSF static analysis rules, semgrep, and libsast, identifying vulnerabilities like CWE-295 Improper Certificate Validation and CWE-532 Insertion of Sensitive Information into Log File. Supported output formats include JSON, SARIF, SonarQube, and HTML, enabling integration into automated security assessment workflows.
Mobile

Trivy trivy.dev RSS #

6 resources across 4 topics: Python, RCE, Secrets, Supply Chain.

DateResourceTopics
2026-06-10 2026Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack
Library. This entry details the "TeamPCP" supply chain attack that compromised Aqua Security's Trivy vulnerability scanner and related GitHub Actions. The attack involved injecting credential-stealing malware into official releases and workflows, leading to the exfiltration of secrets via typosquatted domains and fallback repository mechanisms. Threat actors also leveraged stolen publish tokens for npm ecosystem compromise and deployed iterative payloads. Organizations should audit Trivy versions and GitHub Action references, and consider pinning actions to full SHA hashes for long-term hardening.
Supply Chain
2026-06-09 2026How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM
Library containing a backdoor that exploited Trivy security scanner vulnerabilities to compromise LiteLLM Python packages, specifically versions 1.82.7 and 1.82.8. The malicious code was delivered via direct source injection or a `.pth` file, leading to credential theft, data exfiltration using AES-256 and RSA encryption, and persistence through systemd services and Kubernetes lateral movement. This attack chain is linked to the threat actor TeamPCP, identified by consistent infrastructure and an RSA public key shared with prior Trivy and KICS compromises.
PythonRCESupply Chain
2026-06-08 2026We hardened zizmor's GitHub Actions static analyzer
Library that hardened zizmor, a static analyzer for GitHub Actions workflows, by fixing parsing bugs related to YAML anchors and surfacing deserialization edge cases. This work addressed issues like malformed findings and silent data mishandling, improving zizmor's analysis of workflows from 6,612 high-value open-source repositories and aligning its expression evaluator with GitHub's test suite. The improvements enhance protection against supply-chain attacks, such as the aquasecurity/trivy-action exploit.
SecretsSupply Chain
2026-04-18 2026Trivy Supply-Chain Attack: Trusted Scanner Compromised Rotate CI/CD Secrets Now
Library for securing CI/CD pipelines against supply-chain attacks, particularly concerning the Trivy scanner compromise (CVE-2026-33634, GHSA-69fq-xp46-6×23). The library details techniques for mitigating risks associated with compromised scanning tools, including mandatory secret rotation, auditing pipeline runs, pinning GitHub Actions tags to immutable SHAs, enforcing least-privilege for runners, and increasing monitoring. It highlights how attackers exploit tag mutability and privileged scanner access to steal credentials and access cloud environments.
Supply Chain
2026-04-04 2026European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack
Writeup detailing the European Commission's data breach, confirming over 300GB of data theft from its AWS environment. Hackers exploited an API key compromised during the TeamPCP-led supply chain attack on Aqua Security's Trivy vulnerability scanner. The attackers leveraged tools like TruffleHog to discover secrets and exfiltrate data related to 71 clients of the Europa web hosting service, with the stolen information later appearing on the ShinyHunters leak site.
Supply Chain
2026-04-03 2026Open Source Security Tool Trivy Hit by Supply Chain Attack Prompting Urgent Industry Response
Tool Trivy was compromised in a supply chain attack, with malicious release v0.69.4 briefly distributed, exfiltrating sensitive data and executing malicious code. Attackers leveraged compromised credentials and manipulated release processes, impacting downstream systems and related tooling like GitHub Actions. This incident highlights the vulnerability of trusted open source scanners and CI/CD pipelines, prompting calls for artifact integrity verification, credential scoping, and zero-trust principles in software supply chains.
Supply Chain

Caido caido.io RSS #

5 resources across 3 topics: API Sec, Burp, XSS.

DateResourceTopics
2026-08-07 2026PimpMyCaido #1: Hunt client-side vulnerabilities with DOMLogger++
This content introduces PimpMyCaido #1, a guide focused on finding client-side vulnerabilities. It specifically highlights the use of a tool called DOMLogger++ for this purpose. The title suggests a practical, hands-on approach to security testing within web applications, emphasizing techniques for uncovering weaknesses accessible from the user's browser.
XSS
2025-12-10 2025Web App Hacking: Finding Web App Vulnerabilities with Caido Scanner
Caido just became a serious Burp killer. Scanner plugin auto-detects vulns as you browse + launches targeted attacks on suspicious endpoints: https://t.co/wkiXeRK5CU
Burp
2025-12-03 2025Web App Hacking: Finding Web App Vulnerabilities with Caido Scanner
Caido just became a serious Burp killer. Scanner plugin auto-detects vulns as you browse + launches targeted attacks on suspicious endpoints: https://t.co/GqmmOXsL75 @three_cube
Burp
2023-10-04 2023A lightweight web security auditing toolkit
Toolkit for web security auditing that enhances manual testing with AI and teamwork. Caido integrates with LLM providers like Anthropic, Google, and OpenAI through OpenRouter, enabling AI-powered plugins and programmatic access via its Client SDK. Features include autonomous agents for payload generation and task execution, precise request/response searching with HTTPQL, and ad-hoc automation via a node-based system. The platform boasts over 6,000 active users, 54+ community plugins, and a Discord community of 4,500+ members.
Burp
2023-07-19 2023Web App Hacking with Caido.io
Web App Hacking with Caido.io https://www.youtube.com/watch?v=lW-u_2EByT4
API SecBurp

Wireshark wireshark.org RSS #

5 resources across 3 topics: Burp, Python, Recon.

DateResourceTopics
2026-08-30 2026Hunting Down Hackers: Incident Response with Wireshark
This content explains how to trace hackers using Wireshark, emphasizing the need for strong networking, protocol, and Wireshark filter knowledge. It uses the "2008 Nitroba University Harassment Scenario" as a demonstration, providing links to the scenario details and a downloadable pcap file for practical application. The core idea is using packet analysis to uncover malicious activity. No bounty payout amount is mentioned.
Recon
2026-05-03 2026GitHub - SharonBrizinov/Holy-Grail-PCAP: "Holy Grail PCAP" is a capture file offering exceptional coverage across nearly all tcpdump/Wireshark encapsulation types and dissectors.
Library for comprehensive Wireshark dissector code coverage analysis and bug hunting, featuring the "Holy Grail PCAP," a meticulously crafted capture file. This library includes over 1,600 dissectors across 186 link-layer types, including Bluetooth, USB, and CAN bus. It utilizes tools like `wirecov` for coverage measurement and `wirefuzz` for targeted dissector fuzzing, enabling bug discovery, CI/CD regression testing, and stress testing of packet processing tools.
Burp
2023-11-05 2023TrafficWatch - TrafficWatch A Packet Sniffer Tool Allows You To Monitor And Analyze Network Traffic From PCAP Files
TrafficWatch - TrafficWatch, A Packet Sniffer Tool, Allows You To Monitor And Analyze Network Traffic From PCAP Files https://ift.tt/c1tg2uv
Recon
2023-01-31 2023Creating an Advanced Network Packet Sniffer in Python: A Step-by-Step Guide
The content is a step-by-step guide on creating an advanced network packet sniffer using Python. It provides detailed instructions on how to build the sniffer tool, which can capture and analyze network packets for various purposes. The guide likely covers topics such as setting up the necessary libraries, capturing packets, analyzing packet data, and potentially implementing additional features for advanced functionality. Overall, the content aims to help readers understand the process of creating a network packet sniffer using Python through a structured and informative guide.
Python
2022-01-15 2022Capturing Network Traffic With Python And TShark
Capturing Network Traffic With Python And TShark
Python

mitmproxy mitmproxy.org RSS #

4 resources across 3 topics: golang, GraphQL, Python.

DateResourceTopics
2026-01-17 2026pwviptbl/ProxyHunter: Aplicação Python com interface gráfica que permite configurar regras de interceptação para modificar parâmetros de requisições HTTP. Quando o navegador envia uma requisição para uma rota configurada, o proxy intercepta, modifica apenas os parâmetros especificados e encaminha a requisição mantendo todos os outros parâmetros originais.
Tool that intercepts HTTP requests to modify specific parameters. ProxyHunter is a Python application with a graphical interface that allows users to configure interception rules for HTTP requests. It intercepts requests to configured routes, modifies only specified parameters, and forwards the request while preserving all other original parameters. Features include a GUI, multiple rule configuration, GET and POST support, individual rule activation/deactivation, JSON persistence, configurable port, manual interception, WebSocket support, an advanced Intruder, and a vulnerability scanner detecting SQL Injection, XSS, CSRF, Path Traversal, and exposed sensitive information.
Python
2025-11-24 2025A Terminal client for HTTP/GraphQL/gRPC with support for SSH tunnels, WebSockets, SSE, workflows, profiling, OpenAPI and response diffs.
#golang https://t.co/sDSO3DWkkl
GraphQL
2024-11-29 2024Python Twisted proxy - how to intercept packets
Library for intercepting and modifying HTTP request and response bodies using Python's Twisted framework. Demonstrates a basic proxy setup using `twisted.web.proxy` and `twisted.internet.reactor`, enabling developers to inspect and alter data as it flows through the proxy. The provided code snippet serves as a starting point for building custom HTTP proxy functionalities.
Python
2021-01-22 2021projectdiscovery/proxify: Swiss Army knife Proxy tool for HTTP/HTTPS traffi
Tool: proxify is a Swiss Army knife proxy for rapid HTTP/HTTPS traffic manipulation. It supports request/response dumping, filtering, and manipulation via a DSL language, and can act as an upstream HTTP or SOCKS5 proxy. Features include TLS MITM support, an embedded DNS server, plugin support for protocol decoding, and the ability to replay dumped traffic into Burp Suite. Proxify can intercept non-HTTP traffic and supports invisible and thick client proxying.

semgrep semgrep.dev RSS #

4 resources across 4 topics: Python, RCE, Secrets, Supply Chain.

DateResourceTopics
2026-07-16 2026HN Security - My Semgrep C/C++ ruleset is ready for prime time again
Library featuring 50+ Semgrep rules for C/C++ vulnerability research, updated to version 2.0.0. It enhances static analysis by detecting dangerous API calls like `str*`, `mem*`, and `*printf` functions, improves pattern matching for memory allocations, and optimizes performance. The ruleset prioritizes identifying potential vulnerability hotspots over eliminating all false positives, serving as an assistant for developers and researchers rather than a fully automated CI/CD tool. It has been tested against NIST SAMATE test cases and is available in the official Semgrep registry.
PythonSecrets
2026-04-16 2026tj-actions/changed-files Compromised - Semgrep
Semgrep rule for detecting compromised GitHub Actions, specifically targeting `tj-actions/changed-files` and `reviewdog/action-setup@v1`. This action, `tj-actions/changed-files`, was previously compromised and may have leaked secrets. The rule helps identify usages of these actions within CI pipelines, enabling prompt remediation and security audits. Users can run this rule locally or within the Semgrep AppSec Platform in blocking mode to prevent further compromise.
Supply Chain
2026-04-03 2026Insecure Deserialization in Python | Semgrep
Library for detecting insecure deserialization vulnerabilities in Python code, focusing on the dangers of libraries like `pickle`, `dill`, `jsonpickle`, and `shelve` when processing untrusted input. It highlights how these libraries can lead to remote code execution and provides examples of exploitation, including a demonstration with `pickle.dumps` and `os.system`. The library's rules identify data flow from untrusted sources to sensitive deserialization functions, offering practical recommendations to avoid risks such as avoiding `pickle` for untrusted data, using safer alternatives like JSON or `PyYAML`'s `safe_load`, and integrating Semgrep scans into CI pipelines. Specific mitigations for Django, NumPy, and PyTorch are also mentioned.
Python
2021-12-13 2021Semgrep
Semgrep
RCESupply Chain

BeEF beefproject.com RSS #

3 resources across 3 topics: Bug Bounty, Recon, XSS.

DateResourceTopics
2023-04-02 2023How to Hack Web Browsers with BeEF Framework
How to Hack Web Browsers with BeEF Framework https://ift.tt/r8zkdW9
XSS
2022-05-11 2022Favorite tweet by @Nickieyey
Favorite tweet: Top XSS (Cross Site Scripting) Tools : 1) BeeF 2) BlueLotus_XSSReceiver 3) xssor2 4) Xsser-Varbaek 5) Xsser-Epsylon 6) Xenotix #pentesting #ethicalhacking #cybersecurity #CyberSec #we...
Bug BountyXSS
2021-12-06 2021How to run BeEF behind an nginx reverse proxy with SSL correctly
Library for configuring BeEF behind an nginx reverse proxy with SSL, addressing "Blocked Mixed Active Content" errors. It details BeEF's `config.yaml` settings for `allow_reverse_proxy`, `public`, and `public_port`, along with Nginx `proxy_pass` directives to correctly handle HTTPS requests and ensure BeEF hooks function on secure pages.
Recon

BloodHound github.com/SpecterOps RSS #

3 resources across 3 topics: AuthN, AuthZ, Recon.

DateResourceTopics
2026-08-20 2026Graphing AWS Attack Paths in Bloodhound
This content likely describes the use of BloodHound, a popular graph theory tool for exploring active directory attack paths, to visualize and analyze attack paths within Amazon Web Services (AWS) environments. It focuses on how BloodHound can be adapted or used in conjunction with AWS data to map potential security vulnerabilities and identify pathways an attacker might exploit to gain privileged access or move laterally within an AWS infrastructure. The goal is to improve security posture by understanding and mitigating these identified attack paths.
Recon
2026-07-19 2026How I Abused a Group Policy Object (GPO) in Active Directory (And How to Fix It)
Writeup detailing Active Directory GPO abuse, demonstrating how misconfigured permissions on Group Policy Objects can lead to privilege escalation. The process involves using BloodHound to identify vulnerabilities like WriteDacl and WriteOwner on the Employees Policy GPO, and then provides steps to remediate by removing these excessive rights from the Delegation tab in Group Policy Management.
AuthZ
2026-07-02 2026Hack Smarter — City Council (Active Directory)
Writeup detailing the compromise of a City Council Active Directory environment, starting with only an IP address. The process involved initial port scanning with rustscan, web enumeration with gobuster, and reverse engineering an application executable with strings to uncover a service account. The service account's password was then extracted by intercepting application traffic with Wireshark. Finally, BloodHound was used to map the Active Directory structure via credentials obtained for the svc_services_portal account.
AuthNAuthZ

checkov checkov.io RSS #

3 resources across 1 topic: Supply Chain.

DateResourceTopics
2026-06-10 2026KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack
Writeup detailing a supply chain attack on the Checkmarx KICS GitHub Action by TeamPCP, compromising 35 tags and distributing credential-stealing malware via a `setup.sh` script. The attack, similar to the Trivy incident, leverages compromised identities and hardcoded RSA keys, with a new Kubernetes persistence mechanism for follow-on operations. The malware exfiltrates secrets from environment variables, runner memory, AWS metadata, and Kubernetes API, encrypting them and uploading them to GitHub repositories or attacker-controlled domains.
Supply Chain
2026-05-14 2026Analyzing TeamPCPs Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft
Library analyzing TeamPCP's supply chain attacks, specifically the Checkmarx KICS and elementary-data incidents. The campaign leverages CI/CD and release workflows to steal credentials like GitHub PATs, npm tokens, and cloud secrets. Techniques include multichannel poisoning across Docker Hub, VS Code extensions, and GitHub Actions, as well as GitHub Actions script injection to produce malicious packages signed by legitimate CI, targeting ecosystems like PyPI and GHCR.
Supply Chain
2026-04-22 2026Malicious KICS Docker Images and VS Code Extensions Hit Checkmarx Supply Chain
Writeup of supply chain attacks targeting Checkmarx, detailing malicious KICS Docker images and VS Code extensions. Threat actors overwrote Docker Hub tags and introduced compromised versions of the `cx-dev-assist` and `ast-results` extensions. The compromised artifacts exfiltrated GitHub tokens, AWS and Azure credentials, and SSH keys to external endpoints. These attacks, potentially by TeamPCP, leveraged stolen credentials to inject malicious GitHub Actions workflows and republish npm packages, creating further propagation paths.
Supply Chain

dirsearch github.com/maurosoria RSS #

3 resources across 3 topics: AuthN, Recon, SSRF.

DateResourceTopics
2025-08-14 2025My First Case of SSRF Using Dirsearch | by Mba-oji Chiagoziem | Medium
The content appears to be a personal account titled "My First Case of SSRF Using Dirsearch" by Mba-oji Chiagoziem on Medium. The author likely shares their experience encountering a Server-Side Request Forgery (SSRF) vulnerability while using the tool Dirsearch. The article may delve into the details of how the SSRF vulnerability was discovered, the implications of such a vulnerability, and potentially offer insights or lessons learned from the experience.
SSRF
2023-10-04 2023Directory Listing
Directory Listing https://ift.tt/hdv6BCV
Recon
2023-09-03 2023GitHub - dirkjanm/adidnsdump: Active Directory Integrated DNS dumping by any authenticated user
Library for Active Directory Integrated DNS dumping, allowing any authenticated user to enumerate and export all DNS records in Domain or Forest DNS zones for internal network reconnaissance. It requires impacket and dnspython for functionality and can be installed via pip or from Git. The tool supports direct network use or operation via an implant using proxychains with the `--dns-tcp` option.
AuthN

subfinder github.com/projectdiscovery RSS #

3 resources across 2 topics: Bug Bounty, Recon.

DateResourceTopics
2026-04-19 2026SubFinder: Automating Subdomain Enumeration for Bug Bounty in 2025
SubFinder: Automating Subdomain Enumeration for Bug Bounty in 2025
Recon
2026-04-03 2026Subfinder Complete Guide 2025: Subdomain Enumeration Mastery
Library for stealthy subdomain enumeration, Subfinder gathers subdomains from passive online sources to map an organization's attack surface. It supports extensive configuration options, including selecting sources, filtering patterns, using custom resolvers, and integrating API keys for services like BinaryEdge, Censys, GitHub, Shodan, and VirusTotal. Subfinder can output results in plain text or JSON, and it integrates well with other ProjectDiscovery tools like httpx and nuclei for comprehensive reconnaissance.
Recon
2019-08-20 2019Automated monitoring of subdomains for fun and profit — Release of Sublert
"Sublert" is a tool released for automated monitoring of subdomains for bug bounty programs. The bug bounty industry is rapidly growing, leading to fierce competition among programs. Sublert aims to assist in identifying security vulnerabilities in subdomains, potentially leading to financial rewards for bug hunters.
Bug Bounty