93 matches found
CVE-2025-58434-AND-59528-POC
PoC double CVE Flowise — CVE-2025-58434 + CVE-2025-59528 ⚠️ Uniquement à des fins éducatives et de recherche en sécurité autorisée. Exécuter cet outil contre des systèmes dont vous n'êtes pas propriétaire ou pour lesquels vous n'avez pas d'autorisation écrite de test est illégal. Table des matière...
ad-autopwn
AD AutoPwn Zéro-Auth vers Administrateur de domaine — Chaîne d'attaque Active Directory automatisée Un outil de test d'intrusion entièrement automatisé qui enchaîne plus de 25 techniques d'attaque pour compromettre des environnements Active Directory. Conçu pour des évaluations de sécurité...
SniperRoost
SniperRoost используется для генерации валидной цепочки атак с целью эксплуатации CVE-2017-11774, связанной с иранской APT. Только исследовательский PoC, пожалуйста, не используйте во вред...
CyberStrikeAI
CyberStrikeAI 中文 | English The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation improves the next. CyberStrikeAI connects planning, execution, human oversight, evidence, and replay in one auditable...
whiskeysamlandfriends
WhiskeySAML والأصدقاء TicketsPlease TicketsPlease: مكتبة بايثون للمساعدة في إنشاء تذاكر Kerberos، واسترداد إعدادات تكوين ADFS عن بُعد، وإنشاء رموز Golden SAML، واسترداد رموز الوصول إلى Azure. WhiskeySAML WhiskeySAML: أداة إثبات مفهوم لهجوم Golden SAML مع استخراج تكوين ADFS عن بُعد. تستغل هذه الأد...
CVE-2021-3456
CVE-2021-3456 Une chaîne pratique qui commence par un fichier PDF anodin et aboutit à un shell inversé sur une instance AWS EC2 Le début : création d’une charge utile PDF Tout commence sur le front de l’attaque. En utilisant l’objet WScript intégré de PowerShell, nous intégrons un script dans un...
redsun-bluehammer-undefend-detection-pack
Pack de détection RedSun, BlueHammer, UnDefend et CrossFamily IMPORTANT : Tout le code et la logique de détection de ce dépôt sont générés par IA. Rien ne garantit que ces scripts sont corrects, complets, sûrs ou adaptés à un quelconque environnement. Utilisez ces scripts entièrement à vos propre...
CVE-2026-10170-RCE
Visitor Management System 1.0 — SQLi до удалённого выполнения кода цепочка атак Информация об уязвимости...
Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
SonicWall has released security updates to address two security flaws impacting its Secure Mobile Access SMA 1000 series VPN appliances that have been exploited in zero-day attacks. The vulnerabilities, discovered internally by SonicWall's William Perry and Adam Babis, are listed below -...
soc-investigation-powershell-edrfreeze
تحقيق في أداة PowerShell EDRFreeze دراسة حالة LetsDefend يحتوي هذا المستودع على تحقيق موثّق في SOC استنادًا إلى سيناريو LetsDefend يتضمن نشاط PowerShell مشبوهًا وحمولة مستضافة على GitHub وتنفيذ أداة EDRFreeze. ما يتضمنه هذا المستودع التقرير الكامل: report.md الخط الزمني: timeline.md مؤشرات...
Zero-Day-Legacy
🎓 مشروع التخرج — جامعة عجلون الوطنية ANU كلية تكنولوجيا المعلومات · الأمن السيبراني والحوسبة السحابية · العام الدراسي 2026 🏆 أعلى معدل في الجامعة: 97% 📖 نظرة عامة Zero-Day Legacy هو جهاز مختبر اختراق من نوع Boot-to-Root CTF التقاط العلم ضعيف بشكل متعمد وواقعي، تم بناؤه كمشروع تخرج في جامعة عجلون ...
PYSEC-2026-1348 Fides' Admin UI User Password Change Does Not Invalidate Current Session
Summary Admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors such as XSS can maintain access even after password reset. This issue is not directly...
AI is accelerating cyberattacks—here’s how to stay ahead
In March, we wrote that identity security has become the new pressure point for modern cyberattacks. Since then, AI has only increased that pressure. AI helps cyberattackers move faster across the attack chain: personalizing social engineering at scale, automating reconnaissance, analyzing leaked...
claude-security-scanner
🇨🇳 ⚡ bash git clone https://github.com/290298661...
HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics
Modern alert-triage systems reduce SOC burden by filtering false positives, but flagging a high-risk alert is only the start of incident response. Threat hunting requires reconstructing causal attack chains across heterogeneous, partially corrupted logs. Against APTs using anti-forensics parent-P...
When prompts become shells: RCE vulnerabilities in AI agent frameworks
In this article 1. A representative case study: Semantic Kernel 2. CVE-2026-26030: In-Memory Vector Store 3. CVE-2026-25592: Arbitrary file write through SessionsPythonPlugin 4. The vulnerability 5. Attack chain overview 6. Defending the agentic edge 7. Not bugs, but developed by design 8. CTF...
When prompts become shells: RCE vulnerabilities in AI agent frameworks
In this article 1. A representative case study: Semantic Kernel 2. CVE-2026-26030: In-Memory Vector Store 3. CVE-2026-25592: Arbitrary file write through SessionsPythonPlugin 4. The vulnerability 5. Attack chain overview 6. Defending the agentic edge 7. Not bugs, but developed by design 8. CTF...
CVE-2026-40175
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This...
CVE-2026-40175
Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header values into outbound requests. This...