BlueBook

Exploring a machine learning project focused on airline passenger satisfaction prediction. The workflow includes data preprocessing, exploratory analysis, and classification models such as Random Forest, XGBoost, and LightGBM to predict customer satisfaction levels. A solid demonstration of how analytics can support operational and business decision-making. github.com/aliabyar1998/airl…

Join to my Telegram Channel. t.me/exploitdeveloper

Love it.

ready for another big project?

it's an advanced CVE intelligence with exploit tracking, risk scoring, and threat analysis. - Search about a CVE - Find Exploit about a CVE - Explain about vulnerabilities - Package lookup : ex. npm, PyPI, Go, Maven via OSV. - Known Exploited Vulnerabilities Catalog

Almost done.

I'm building a tool that automates every possible OWASP WSTG 4.2 test on a target. Because the best pentesters don't waste time on repetition, they focus on what machines can't do.

Fuck @claudeai , just Mimo Code by @Xiaomi .

mattew crawls target websites, extracts hidden attack surface, runs security analysis, fingerprints technology, and generates professional reports , all in one command. github.com/exploitcve/mattew

Raven is a powerful and customizable web crawler written in Go. github.com/exploitcve/Raven

How to Perform Session Hijack with XSS + Session Fixation When the Session Cookie is HttpOnly 1. Create a session cookie with an unauthenticated session value on the /login path using JavaScript. 2. Force the user to log out. 3. When the user logs back in, they will use the unauthenticated session. The attacker creates a session cookie on another browser, then injects that session into the victim's account by overriding the existing HttpOnly cookie with a similar cookie name but a different value on a different path. sess=aaaa; path=/login; expires=Fri, 17 Jun 2024 10:00:00 When the login form is submitted, it will contain two cookies. The one created with JavaScript on the /login path will be first, followed by the HttpOnly cookie on the different path /. Cookie: sess=aaaa; sess=bbbb; Since the website has a Session Fixation bug, no new session will be generated when the user logs in. Because there are two session cookies, only the first one from the attacker (sess=aaaa) will be used, and the logged-in user will be attached to it. The final step is to use the unauthenticated session that was previously created on the attacker's browser for all website actions from the attacker's side.

The following payload demonstrates an effective Akamai WAF bypass under specific conditions. It relies on a combination of URL-encoded and Unicode-encoded characters, making it suitable for applications that invoke decodeURIComponent before the input is evaluated within a JavaScript or JSON context. During the decoding process, the Unicode sequences are reconstructed, allowing the malicious JavaScript to execute and successfully achieve XSS. html <a href=javascript:'%5C\u0075003C'+svg/'+'onload%5C\u0075003Dalert%5C\u00750028)\\u003E'>Click

FavFreak uses favicon hashes to help identify the technologies and products running behind a target, turning a tiny icon into valuable reconnaissance. github.com/devanshbatham/Fav…

That’s all.

People lie with words. Shoes, however, never do.

Cariddi is where the interesting part begins. github.com/edoardottt/caridd… It crawls web applications, extracts endpoints, JavaScript references, API routes, parameters, secrets, and other hidden attack surface, turning scattered data into something you can actually investigate.

Good operators don’t waste time repeating the same steps. They automate them, Osmedeus turns reconnaissance into a repeatable operation, linking discovery, enumeration, and validation into a single workflow. github.com/j3ssie/osmedeus

Recon isn’t about running more tools. It’s about building a process you can trust.

Less time clicking. More time thinking.