Giter Club home page Giter Club logo

findsploit's Introduction

Bug Bounty Profiles

Public Exploits

Open Source Security Tools

Certifications

  • OSCE
  • OSCP
  • CISSP
  • Security+
  • CNA
  • MCP
  • Network+
  • A+
  • PCI-ASV
  • SecurityTube Android Security For Penetration Testers

Public Exploits/PoC's/CVE's/Bug Bounties/CTF's

2024:

2021:

  • Nutanix Stored DOM Cross-Site Scripting (XSS) & Reflected Cross-Site Scripting (XSS) 0day

2020:

2018:

2017:

  • Recieved Offensive Security Certified Expert (OSCE) cerfication 12/2017
  • Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WEMO HomeKit Bridge ($3,000 bounty) 9/2017
  • Stored Cross-Site Scripting (XSS) vulnerability in WEMO HomeKit Bridge ($500 bounty) 9/2017
  • Systemic Stored XSS vulnerability in WEMO HomeKit Android Application ($1,500 bounty) 9/2017
  • Systemic Local File Inclusion in WEMO HomeKit Android Application ($3,000 bounty) 9/2017
  • Placed 7th in ToorConCTF CTF 8/2017
  • Stored XSS in ModSecurity App for Splunk (Full Disclosure) 8/2017
  • Directory Traversal in PSPDFKit/Atlassian Jira Cloud Android application Bug Bounty 7/2017
  • Recieved Android Security For Penetration Testers (ASFP) certification from SecurityTube 5/2017
  • Gave talk at ISSA/OWASP Phoenix to 90+ attendees titled "Man In The Browser Advanced Client Side Exploitation" (https://www.slideshare.net/1N3/man-in-the-browser-advanced-client-side-exploitation-using-beef) 4/2017
  • PSV-2017-0227: Cross-Site Tracing Vulnerability in NETGEAR Arlo CVE 2/2017
  • Directory traversal + multiple CSRF + multiple stored and reflected XSS in NETGEAR M4300-8X8F switches ($3,000+ bounty) 3/2017
  • Recieved Department of Defense HackerOne Challenge coin for the Hack The Army Bug Bounty Program 2/2017
  • Listed on the BugCrowd 2016 MVP list 1/2017

2016:

2015:

2014:

findsploit's People

Contributors

1n3 avatar 3mrgnc3 avatar abdulr7mann avatar lyz-code avatar ook-io avatar paralax avatar riramar avatar spaddex avatar xer0dayz avatar zawadidone avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

findsploit's Issues

Dynamic management of installed browser

findsploit code has firefox as default browser. For avoiding a user having another browser should install also Firefox, you can replace those BROWSER_CMD by xdg-open. In this manner, you can make Findsploit compatible with all browsers.

Question about purpose of this tool

Not an issue, just want to know is it necessary when there is already the "Searchsploit" from ExploitDB, or did you make "Findsploit" so that you only pull exploit you need instead of having everything locally ?

Just out of curiosity i tried : 'searchsploit wps 3' and 'findsploit wps 3', and i found 11 "ExploitDB" exploits,
and comparing against findsploit which was 11 "ExploitDB" exploits and 1 "Metasploit Exploits", i thought maybe there is more to it than just being a copy of "Searchsploit", so if you don't mind explaining ?

Thanks for all the works.

Better Update Method

If you utilize GitHub releases it is possible to implement a simpler update process. Inside of the findsploit bashfile allow the use of an option something like -u which will query the GitHub api for the latest release tag.

Then compare this release version to the current version if the latest release is greater then, it should ask the user if they want to update. If they say yes it can clone the repository to a temp directory, git checkout to the newsest stable release, run your install script and then remove the temperary directory.

I did something similar for a bash script I wrote. I looked into your code and it seems like it shouldn't be to bad to implement since you don't seem to use the bash options at all so it wouldn't change old functionality.

If im not making sense I'd love to explain further or possibly implement a version of it into your code.

License?

Under what license is this software available? We want to cover the tool, but can't find it.

Thanks!

New path to searchsploit script

When tried to run the script I got the error /usr/share/exploitdb/searchsploit Not found
It seems like searchsploit has changed its path to /usr/bin/searchsploit

How to use compilesploit?

Hi, I used ur system for compiling exploit.

kakaotalk_20170705_222236522
kakaotalk_20170705_222256223

I confronted error above.. Please help me, What should I do?

Update "$BROWSER_CMD" to xdg-open

By default $BROWSER_CMD= should be set to xdg-open, instead of iceweasel. On most desktops this will open the configured web browser

console.error: fx_pnh:

I get the following error twice when running the "search online" function at the end of the script on Kali 1.10, iceweasel as browser:

console.error: fx_pnh: 
Object
    - message = Component returned failure code: 0x80520012 (NS_ERROR_FILE_NOT_FOUND) [nsIXPCComponents_Utils.import]
    - fileName = undefined
    - lineNumber = 15
    - stack = @undefined:15:NaN|CuddlefishLoader/options<.load@resource://gre/modules/commonjs/sdk/loader/cuddlefish.js:129:9|@resource://jid1-cz1beofm9mmlzg-at-jetpack/fx_pnh/lib/config.js:28:7|CuddlefishLoader/options<.load@resource://gre/modules/commonjs/sdk/loader/cuddlefish.js:129:9|@resource://jid1-cz1beofm9mmlzg-at-jetpack/fx_pnh/lib/main.js:10:1|CuddlefishLoader/options<.load@resource://gre/modules/commonjs/sdk/loader/cuddlefish.js:129:9|run@resource://gre/modules/commonjs/sdk/addon/runner.js:149:9|startup/<@resource://gre/modules/commonjs/sdk/addon/runner.js:113:7|Handler.prototype.process@resource://gre/modules/Promise-backend.js:863:11|this.PromiseWalker.walkerLoop@resource://gre/modules/Promise-backend.js:742:7|
    - toString = function () /* use strict */ toString

Any ideas what this could be?

Thanks,
Chase

Cannot update due to seachsploit's location

I used the Pentest Framework to install/manage my utilities. So my searchploit script is installed in /pentest/exploitation/exploit-db/searchsploit, therefore Findsploit's update fails because it is looking for it in /usr/bin/searchsploit. I tried symlinking but it complained about that as well. Is there a way around this without changing the source code?

Add support for OSX

Right now install.sh uses apt-get to install dependencies which is not supported by OSX.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.