#1Tools for gathering information about targets and identifying attack surfaces.
Kitploit recommended
emrekybs/veiled-eyeOSINT identity investigation tool. Pivot from an e-mail, username, phone or wallet across 46 sources into one profile and relationship graph.
tridents10/vader-pro-vdrAI-assisted Vulnerability Detection & Remediation platform featuring a Go endpoint agent, centralized dashboard, and vulnerability intelligence…
abraxas/openmeetings-calendar-save-idorApache OpenMeetings 9.1.0 - High - Remote - IDOR - LOGIN calendar save overwrites appointment and closes public room
fazmin/cve-intelLocal security intelligence for CVE triage — 31 tools, 25 sources, risk scores and an MCP server for AI agents, all in native Rust. Private by…
gmh5225/mirageMicroservice OSINT platform in Rust that automates intelligence collection, correlation, and visualization for threat intelligence and attack surface…
abraxas/jellyfin-playlist-itemidsJellyfin Server 12.2 - High - Remote - IDOR - public playlist ItemIds leftover of GHSA-9x85 then unauth stream
abraxas/jellyfin-suggestions-idorJellyfin Server 12.2 - High - Remote - IDOR - GET /Items/Suggestions omit-userId dumps hidden library Path and IDs
abraxas/jellyfin-svg-gzipJellyfin Server 12.2 - High - Remote - SSRF - gzip data:image/png leftover of GHSA-cf3c still fetches http and file
lascc/dfirhubSearch artifact paths, build collection scripts, and convert Sigma rules. All in one place.
kaandemir993/amadey-loader-multi-stage-malware-with-keylogging-clipboard-hijack-privilege-escalation-analysisReverse engineering Amadey Loader with x64dbg: dynamic API resolution, token privilege escalation, keylogger hooks, clipboard capture, and…
abraxas/openmeetings-invite-recording-aclApache OpenMeetings 9.1.0 - High - Remote - IDOR - Type.USER invitation recording MP4 ACL
abraxas/openmeetings-kms-unauthApache OpenMeetings 9.1.0 - High - Remote - Unauth KMS - docs docker publishes Kurento JSON-RPC on 8888
abraxas/openmeetings-wb-fileid-idorApache OpenMeetings 9.1.0 - High - Remote - IDOR - WHITEBOARD fileId plant then room file resource serves bytes
oscerd/cve-2026-78164Runnable proof-of-concept for CVE-2026-78164, demonstrating secret leakage when Apache Camel HTTP producers resolve property placeholders in…
yslxotwod/imsistingGTK4 and CLI cellular security toolkit with 57 modules for 2G GSM, 3G UMTS, 4G LTE and 5G NR air interface, core network, SIM identity, RF tracking,…
abraxas/pfsense-rss-file-redirectpfSense CE 2.9.0-DEVELOPMENT - Medium - Remote - File read - RSS file:// redirect
pennacle-security/summitOpen-source web security testing platform: proxy, scanner and fuzzer in one CLI. By Pennacle Security.
capture0x/confirmescLinux privesc enumerator that confirms exploitability and gives you the exact root shell command - no GTFOBins searching. MCP server + AI-agent…
