matano

面向 AWS 的开源安全数据湖 Matano 开源安全数据湖是一个开源的云原生安全数据湖 ，专为 AWS 上的安全团队构建。 !NOTE Matano 提供商业托管式云 SIEM，适用于完整的企业安全运营平台。了解更多。 文档 | 网站 | 社区 功能特性 安全数据湖： 将非结构化安全日志规范化，在您的 AWS 账户中构建结构化的实时数据湖。 收集所有日志： 开箱即用集成 50+ 数据源 用于安全日志，并可轻松通过自定义数据源扩展。 检测即代码： 使用 Python 将实时检测构建为代码。支持自动导入 Sigma 检测到 Matano。 日志转换管道： 支持自定义 VRL（Vector...

matano

Open source security data lake for AWS Matano Open Source Security data lake is an open source cloud-native security data lake , built for security teams on AWS. !NOTE Matano offers a commercial managed Cloud SIEM for a complete enterprise Security Operations platform. Learn more. Docs | Website ...

EDD

CodeFactor EDD Enumerate Domain Data is designed to be similar to PowerView but in .NET. PowerView is essentially the ultimate domain enumeration tool, and we wanted a .NET implementation that we worked on ourselves. This tool was largely put together by viewing implementations of different...

NodeGoat

NodeGoat 由于轻量、快速且可扩展，Node.js 正成为开发 Web 应用程序的广泛采用平台。本项目提供了一个环境，用于学习 OWASP Top 10 安全风险如何适用于使用 Node.js 开发的 Web 应用程序，以及如何有效解决这些风险。 开始使用 适用于 Node.js Web 应用程序的 OWASP Top 10： 了解它！ 此应用程序附带了一个教程页面，解释了 OWASP Top 10 漏洞以及如何修复它们。 一旦应用程序运行，您可以在 http://localhost:4000/tutorial（或您配置的端口）访问教程页面。 实践它！ 为忍者打造的易受攻击...

FalconEye

FalconEye: Real-time detection software for Windows process injections FalconEye is a windows endpoint detection software for real-time process injections. It is a kernel-mode driver that aims to catch process injections as they are happening real-time. Since FalconEye runs in kernel mode, it...

smolvm

smolvm Ship and run software with isolation by default. This is a CLI tool that lets you: 1. Manage and run custom Linux virtual machines locally with: sub-second cold start, cross-platform macOS, Linux, Windows, elastic memory usage. 2. Pack a stateful virtual machine into a single file...

arducky

Arducky - Arduino Ducky Script Interpreter This project aims to create a cheap alternative but not less efficient to Hak5's USB Rubber Ducky. Introduction The USB Rubber Ducky is a HID Human Interface Device programmable with a simple scripting language allowing penetration testers to quickly and...

DNS_Tunneling

Intro Inspired by recent work I did involving Cobalt Strike DNS beacons, in conjunction with a mission statement to try and evade Microsoft Defender for Endpoint, I spent some time looking into how DNS might be used to transfer a payload to a target machine. I further wanted to challenge myself b...

CVE-2023-26360

Uso Usage: python3 script.py endpoint proxyurl Lectura de archivos...

GETROBARB

GETROBARB XSS Scanner is an automated framework for reconnaissance and detection of XSS Cross-Site Scripting vulnerabilities written in Bash, designed for authorized web security audits. It integrates several popular utilities from the bug bounty and pentesting ecosystem to automate the entire...

Recon-Scan

Recon-Scan ReconScan is a open-source passive recon scanner with a FastAPI backend, async worker pipeline, and a single-page frontend. You can check the deployed site at https://recon-scan.vercel.app/ The point is fast signal: run a scan, get module-by-module findings, and get an AI summary that...

XSS2Shell

XSS2Shell XSS2Shell es una prueba de concepto educativa para CVE-2026-64638 , que demuestra el impacto de un problema de XSS pre-autenticación en instalaciones WordPress vulnerables. Con la participación explícita de un administrador, la PoC captura una Contraseña de aplicación de WordPress,...

CVE-2026-75887

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in Bitbucket Data Center webhook receiver enumerates webhook-enabled job templates

A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the endpoint to return HTTP 200 for a...

automation-controller: automation-controller: WorkflowJobNode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via ORM-traversal count-oracle

A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestorartifacts database column, which stores the raw merged setstats artifacts propagated between workflow nodes, is not wrapped in preventsearch and is therefore accepted for arbitrary field lookups...

automation-controller: automation-controller-container: automation-controller: Project scm_url argument injection into `git ls-remote --upload-pack` yields RCE on the controller-task control-plane pod

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scmurl field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument an...

automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-CA certificates for caller-chosen (and case-variant impersonating) hostnames

A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the Common Name, DNS...

automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and X-Forwarded-For spoofing of provisioning-callback host match

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret hostconfigkey is exposed to users holding only the read-level viewjobtemplate permission -- both in the job template API representation and in the activity stream -- and the...

automation-controller: automation-controller-container: automation-controller: bulk job launch allows setting a workflow node's job reference to an arbitrary unified job, enabling a low-privileged user to cancel and read metadata of jobs in other organizations

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job --...