CVE-2023-24055_PoC

CVE-2023-24055 PoC KeePass 2.5x In discussione e in fase di analisi... https://sourceforge.net/p/keepass/discussion/329220/thread/a146e5cf6b/ https://sourceforge.net/p/keepass/feature-requests/2773/ Un attaccante che ha accesso in scrittura al file di configurazione di KeePass può modificarlo e...

Pachine

Pachine Implementazione Python per CVE-2021-42278 Escalation dei Privilegi di Active Directory. Installazione $ pip3 install impacket Utilizzo Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation usage: pachine.py -h -scan -spn SPN -impersonate IMPERSONATE -domain-netbios NETBIOSNAME...

PKINITtools

Strumenti PKINIT Questo repository contiene alcune utilità per giocare con PKINIT e i certificati. Gli strumenti sono basati su minikerberos e impacket. Post del blog di accompagnamento con più contesto: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/ Installazione Questi strumenti...

otseca

Open source security auditing tool to search and dump system configuration. Introduction | Description | Requirements | Output | Parameters | Reports | How it works | Other Introduction The main goal The main assumption of creating this tool was easier and faster delivery of commands sets to be...

zscan

Zscan un set di strumenti di scansione e brute force 📄Documento in inglese Vedi il log per gli aggiornamenti log Formato di output dei risultati - Screenshot parziale dei risultati di output, diviso in due fasi: la prima fase è l'output durante la scansione, a partire dalla fine del rilevamento...

noPac

Informazioni Sfruttamento di CVE-2021-42278 e CVE-2021-42287 per impersonare DA da un utente di dominio standard Modificato da sam-the-admin. Utilizzo SAM THE ADMIN CVE-2021-42278 + CVE-2021-42287 chain positional arguments: domain/username:password Account used to authenticate to DC. options: -h...

wpbullet

wpBullet A static code analysis for WordPress Plugins/Themes and PHP Installation Simply clone the repository, install requirements and run the script $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r requirements.txt $ python wpbullet.py Usage...

wpbullet

wpBullet Eine statische Code-Analyse für WordPress-Plugins/Themes und PHP Installation Klonen Sie einfach das Repository, installieren Sie die Abhängigkeiten und führen Sie das Skript aus. $ git clone https://github.com/webarx-security/wpbullet wpbullet $ cd wpbullet $ pip install -r...

fscan

Fscan 中文 Comprehensive intranet scanning tool for automated vulnerability assessment. Version : 2.2.0 Features Scanning Host Discovery - ICMP/Ping alive detection, B/C segment statistics for large networks Port Scanning - TCP connect scan, 133 built-in ports, port groups web/db/service/all...

Cybersecurity-Projects

Cybersecurity Projects 🐉 70 Cybersecurity Projects, Certification Roadmaps & Resources View Complete Projects: Currently building: DDoS Mitigation Tool Schnellnavigation Projekte Praktische Cybersecurity-Projekte mit vollständigem Quellcode, organisiert in vier Stufen — Grundlagen Vor-Anfänger,...

targetedKerberoast

targetedKerberoast targetedKerberoast è uno script Python che, come molti altri ad esempio GetUserSPNs.py, può stampare gli hash "kerberoast" per gli account utente che hanno un SPN impostato. Questo strumento offre la seguente funzionalità aggiuntiva: per ogni utente senza SPN, tenta di impostar...

criticality_score

Open-Source-Projekt-Kritikalitätsscore Beta Dieses Projekt wird von Mitgliedern der Securing Critical Projects WG gepflegt. Ziele 1. Einen Kritikalitäts-Score für jedes Open-Source-Projekt generieren. 2. Eine Liste kritischer Projekte erstellen, von denen die Open-Source-Community abhängt. 3. Die...

krbrelayx

Krbrelayx - Toolkit per il relaying Kerberos e l'abuso della delega non vincolata Toolkit per abusare di Kerberos. Richiede impacket, ldap3 e dnspython per funzionare. Si consiglia di installare impacket direttamente da git per avere l'ultima versione disponibile. Maggiori informazioni su questo...

krbrelayx

Krbrelayx - Kerberos relaying and unconstrained delegation abuse toolkit Toolkit for abusing Kerberos. Requires impacket, ldap3 and dnspython to function. It is recommended to install impacket from git directly to have the latest version available. More info about this toolkit available in my blo...

gotestwaf

GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...

massdns

MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution

WordPress XML Sitemap Generator for Google plugin before 2.0.4 contains a cross-site scripting vulnerability that can lead to remote code execution. It does not validate a parameter which can be set to an arbitrary value, thus causing cross-site scripting via error message or remote code executio...

JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler plgajaxhelix3 accessible via the Joomla comajax component. The onAjaxHelix3 plugin method processes dataaction=save requests without any authentication check or CSRF token validation...

Flowise - Path Traversal

Flowise 3.0.6 contains a path traversal vulnerability caused by improper validation of the chatId parameter in /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints, letting unauthenticated attackers read arbitrary files including sensitive database files. id: CVE-2025-713...