randomrobbiebf/super-secret-finderAutomated secret matching plugin for Burp Suite that detects exposed API keys, tokens, and credentials in HTTP requests and responses for security…
dark-warlord14/jsscannerYou can read the writeup on this script here
coffinxp/gemini-api-key-hunterScans websites and JS files for exposed Gemini API keys, verifies them live, enumerates accessible services, and provides a browser client for direct…
sebastian-mora/aws-lootEnumerates AWS environments for secrets by scanning EC2 userdata, Lambda environment variables and source code, and CodeBuild instances for…
saturate/cve-2025-55183Scans web applications for React Server Actions source code exposure, extracting and detecting hardcoded secrets, API keys, and credentials.
h33tlit/secret-regex-listList of regex for scraping secret API keys and juicy information.
sam00/poc-cve-2026-42826-2026-42826-microsoft-azure-devops-information-disclosure-vulnerabilityExploits CVE-2026-42826 to enumerate and extract sensitive Azure DevOps data via unauthenticated REST API requests: pipeline YAML, variable groups,…
cappricio-securities/appspec-yaml-leaksScans web applications for exposed AWS AppSpec YAML files containing sensitive data like API keys and secrets, aiding bug bounty hunters and…
anshumanbh/kubebotA security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform
gquere/pwn_jenkinsExploit Jenkins instances via CVE-specific PoCs: RCE through Groovy scripts and deserialization, dump builds for cleartext secrets, password…
sdushantha/doraFind exposed API keys based on RegEx and get exploitation methods for some of keys that are found
vagnerd/cve-2023-27587-pocProof-of-concept exploit for CVE-2023-27587, demonstrating Google Cloud API key leakage via error messages in a Rust web application. Includes…
cappricio-securities/behat-config-leaksAutomated vulnerability scanner that detects exposed BeHat configuration files and sends Telegram notifications. Ideal for bug bounty hunters and…
synacktiv/sccmsqlclientMSSQL client for SCCM environments, enabling reconnaissance, remote PowerShell execution on managed clients, and extraction of sensitive secrets such…
h33tlit/jbin-website-secret-scraperJbin will gather all the URLs from the website and then it will try to expose the secret data from them such as API keys, API secrets, API tokens and…
arpsyndicate/kenzerautomated web assets enumeration & scanning [DEPRECATED]
m4ll0k/secretfinderRegex-based scanner that discovers API keys, tokens, JWTs, and other secrets in JavaScript files, with support for URL extraction, custom regex, and…
jenish-sojitra/jsanalyzerBurp Suite extension for JavaScript static analysis: extracts API endpoints, URLs, secrets, and emails with noise filtering for web security testing.
