Tools

baarai/artex

LLM multi-agent autonomous penetration testing platform with planner/worker agents, asset and exploration graphs, MITM traffic recording, and…

mordavid/bruteforceai

Advanced LLM-powered brute-force tool combining AI intelligence with automated login attacks

guila95/cve-2026-86426

Proof-of-concept and recon framework for CVE-2026-86426, a LibreNMS API authentication bypass via type confusion, extracting SNMP credentials and…

abraxas/ats-magick-unsigned

Apache Traffic Server 10.2.0 - High - Remote - File write - unsigned magick convert writes as nobody

nxploited/cve-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

yehia-mamdouh/xssya-v-2.0

Python XSS scanner that confirms reflected and encoded-payload injection, executes payloads to capture cookies, detects WAFs, and tests XST with a…

abraxas/openmeetings-calendar-save-idor

Apache OpenMeetings 9.1.0 - High - Remote - IDOR - LOGIN calendar save overwrites appointment and closes public room

abraxas/jellyfin-suggestions-idor

Jellyfin Server 12.2 - High - Remote - IDOR - GET /Items/Suggestions omit-userId dumps hidden library Path and IDs

abraxas/jellyfin-svg-gzip

Jellyfin Server 12.2 - High - Remote - SSRF - gzip data:image/png leftover of GHSA-cf3c still fetches http and file

abraxas/openmeetings-invite-recording-acl

Apache OpenMeetings 9.1.0 - High - Remote - IDOR - Type.USER invitation recording MP4 ACL

abraxas/openmeetings-wb-fileid-idor

Apache OpenMeetings 9.1.0 - High - Remote - IDOR - WHITEBOARD fileId plant then room file resource serves bytes

abraxas/pfsense-rss-file-redirect

pfSense CE 2.9.0-DEVELOPMENT - Medium - Remote - File read - RSS file:// redirect

owasp/secretsifter

OWASP Incubator project: detects credentials exposed in browser-delivered content (JavaScript, config responses, live traffic).

abraxas/pfsense-api-snort-file-join

pfSense Plus MIM API toolkit b4acd7ca - High - Remote - File read - Snort rules {file} decode-then-join

affolter-engineering/xssearch

Rust-based XSS scanner with context-aware payload selection, WAF detection and bypass, crawling, blind XSS callbacks, and static DOM sink analysis.

abraxas/spark-history-zip-symlink

Apache Spark 4.2.0 - High - Remote - File read - History zip follows planted symlink

abraxas/spark-rpc-stream-unauth

Apache Spark 4.2.0 - High - Remote - File read - unauth RPC StreamRequest File join

abraxas/n8n-databricks-path-join

Proof-of-concept for an n8n path-traversal (CWE-22) in Databricks nodes: unauthenticated webhook input escapes the Genie path to leak workspace PAT…