rootsecurity

traefik

The Cloud Native Application Proxy

apollo

Apollo is a reliable configuration management system suitable for microservice configuration management scenarios.

fastjson

FASTJSON 2.0.x has been released, faster and more secure, recommend you upgrade.

FastGPT

FastGPT is a knowledge-based platform built on the LLMs, offers a comprehensive suite of out-of-the-box capabilities such as data processing, RAG retrieval, and visual AI workflow orchestration, letting you easily develop and deploy complex question-answering systems without the need for extensive setup or configuration.

dex2jar

Tools to work with android .dex and java .class files

CMAK

CMAK is a tool for managing Apache Kafka clusters

metersphere

MeterSphere 是新一代的开源持续测试工具，让软件测试工作更简单、更高效，不再成为持续交付的瓶颈。

sonarqube

Continuous Inspection

jmeter

Apache JMeter open-source load testing tool for analyzing and measuring the performance of a variety of services

Archery

SQL 审核查询平台

linux-kernel-exploits

linux-kernel-exploits Linux平台提权漏洞集合

Biny

Biny is a tiny, high-performance PHP framework for web applications

Fastjson

Fastjson姿势技巧集合

DongTai

Dongtai IAST is an open-source Interactive Application Security Testing (IAST) tool that enables real-time detection of common vulnerabilities in Java applications and third-party components through passive instrumentation. It is particularly suitable for use in the testing phase of the development pipeline.

Hosts_scan

这是一个用于IP和域名碰撞匹配访问的小工具，旨意用来匹配出渗透过程中需要绑定hosts才能访问的弱主机或内部系统。

NextScan

飞刃是一套完整的企业级黑盒漏洞扫描系统，集成漏洞扫描、漏洞管理、扫描资产、爬虫等服务。 拥有强大的漏洞检测引擎和丰富的插件库，覆盖多种漏洞类型和应用程序框架。

ScopeSentry

ScopeSentry-网络空间测绘、子域名枚举、端口扫描、敏感信息发现、漏洞扫描、分布式节点

DongTai-agent-java

Java Agent is a Java application probe of DongTai IAST, which collects method invocation data during runtime of Java application by dynamic hooks.

nuclei_poc

Nuclei POC，每日更新 | 自动整合全网Nuclei的漏洞POC，实时同步更新最新POC，保存已被删除的POC。通过批量克隆Github项目，获取Nuclei POC，并将POC按类别分类存放，使用Github Action实现（已有11wPOC，已校验有效性并去重）

blazehttp

BlazeHTTP 是一款简单易用的 WAF 防护效果测试工具。BlazeHTTP stands as a user-friendly WAF protection efficacy evaluation tool.

Hyacinth

一款java漏洞集合工具

cube

内网渗透测试工具，弱密码爆破、信息收集和漏洞扫描

Komo

🚀Komo, a comprehensive asset collection and vulnerability scanning tool. Komo 一个综合资产收集和漏洞扫描工具，集成了20余款工具，通过多种方式对子域进行获取，收集域名邮箱，进行存活探测，域名指纹识别，域名反查ip，ip端口扫描，web服务链接爬取并发送给xray，对web服务进行POC漏洞扫描，对主机进行主机漏洞扫描。

lc

LC（List Cloud）是一个多云攻击面资产梳理工具

fscan-POC

强化fscan的漏扫POC库

info_scan

自动化漏洞扫描系统，一键完成相关漏洞扫描和信息收集、资产处理、IP基础信息探测，系统采用B/S架构，系统分为源码安装和配置好环境的虚拟机，项目会持续更新，欢迎在Issues中提交需求，如果对您有所帮助，欢迎留下宝贵的star！！！

CVE-2023-25157

CVE-2023-25157 - GeoServer SQL Injection - PoC

2023_Hvv

CVE-2024-37032

Path traversal in Ollama with rogue registry server

IIS_exploit

Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with "If: <http://" in a PROPFIND request, as exploited in the wild in July or August 2016.