CVE-2023-26818

免责声明 此漏洞利用工具仅用于研究目的和开发有效的防御技术。它不应用于任何恶意或未经授权的活动。脚本的作者和所有者对因使用本软件而导致的任何误用或损害不承担任何责任。用户应负责任地使用本软件，并仅遵守适用法律法规。禁止非道德使用。 CVE-2023-26818 CVE-2023-26818 利用 MacOS TCC 绕过漏洞配合 Telegram。您可以阅读第1部分和第2部分的沙箱绕过漏洞分析。 视频 手动编译与使用 摄像头 root@kitploit: gcc -dynamiclib -framework Foundation -framework AVFoundation...

cameradar

Cameradar RTSP ストリームアクセスツール Cameradar は、許可されたターゲット上の RTSP エンドポイントをスキャンし、辞書攻撃を使用してその認証情報とルートをブルートフォースします。 Cameradar の機能 アクセス可能なターゲット上のオープンな RTSP ホストを検出します。 RTSP フィードをストリーミングするデバイスモデルを検出します。 辞書ベースのストリームルート（例：/live.sdp）の探索を試みます。 辞書ベースのカメラ認証情報の探索を試みます。 調査結果のレポートを生成します。 目次 Docker によるクイックスタート バイナリのインスト...

hm-surf

HM-Surf 评估器 评估常见 macOS 浏览器对 CVE-2024-44133 的受影响程度。 同时包含用于截图并下载截图以及提取位置的 HTML。 使用方法 - 评估器 要运行评估器（它会评估所有常见 macOS 浏览器对 CVE-2024-44133 的受影响程度），请运行： root@kitploit: python3 -m pip install -r ./requirements.txt ./hm-surf-eval.py 执行后，该工具会评估所有常见 macOS 浏览器的 TCC 绕过能力。 使用方法 - HTML 文件 hm-surf.html 是一个示例 HTML...

r4ven

このGitHubリポジトリが役立つと思われたら、星を付けることをご検討ください！ ⭐️ ▶️ 動画を見る - 使い方 このプロジェクトは、ユーザーが明示的に許可を与えた場合に、最新のWebブラウザがどのようにして位置情報、カメラアクセス、IPアドレス、デバイス情報 を露出させる可能性があるかを示すために設計された、セキュリティ研究および啓発ツールです。 このツールは、デモンストレーション目的で正当なコンテンツを埋め込んだ制御されたWebページを提供します。ユーザーが自発的にブラウザの許可を与えると、アプリケーションはGPS座標、IP情報、デバイスの詳細、カメラ入力...

androrat

国际化正在进行中，欢迎加入。 Androrat（分支/静默版） 适用于 Android 的远程管理工具 Androrat 是一款客户端/服务器应用程序，客户端使用 Java Android 开发，服务器使用 Java/Swing 开发。 名称 Androrat 是 Android 与 RAT（远程访问工具）的混合词。 该项目由 4 人团队在大学项目中开发，用时一个月。应用程序的目标是远程控制 Android 系统并从中获取信息。 技术细节 Android 应用程序是客户端，服务器接收所有连接。 Android...

android-c-sharp-rat-server

Android C R.A.T Server 这是一个为 C R.A.T Server 插件系统构建的插件。 1. 要安装此插件，请将 AndroidExtension/bin/Debug 中的 AndroidExtension.dll 文件放到 /TutServer/bin/Debug/scripts 2. 然后启动服务器并选择“插件”选项卡。 3. 从列表中选择 AndroidExtension.dll 并点击“执行”。 4. 输入服务器端口（与客户端使用的相同），默认为 101。 你需要 Android R.A.T 客户端 来连接服务器。 确保已在客户端程序中更换服务器 IP 地址...

Astra Linux – Vulnerability in Firefox

When a user has already allowed a website to access the microphone and camera, disabling camera sharing does not completely prevent the website from re-enabling them without an additional prompt. This is only possible if the website continues to record with the microphone until the camera is...

Flying Eagle Android RAT Traces Found on 170 Servers as Source Code Circulates

Source code for the Flying Eagle Android remote access trojan RAT framework is circulating through criminal Telegram channels. Hunt.io and independent researcher NetAskari traced matching control panels and certificates to 170 internet servers. They linked the framework to a fake "公安一网通办" Public...

CVE-2026-12989

A lack of authentication in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization...

Shark vacuum flaw exposes cameras, home maps and Wi-Fi passwords

Shark’s cloud-connected robot vacuums are currently exposed by an unpatched AWS Amazon Web Services IoT Internet of Things policy flaw that could turn one compromised device into a remote-control skeleton key for many others in the same region, with access to cameras, maps, and Wi‑Fi passwords. A...

CVE-2026-12060

Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining...

CVE-2026-12060 Hepta Platforms｜Heptabase - Exposed Dangerous

Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining...

CVE-2026-12060 Hepta Platforms｜Heptabase - Exposed Dangerous

Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining...

EUVD-2026-36390

Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining...

CVE-2026-12060

CVE-2026-12060 concerns Heptabase (Hepta Platforms) with an Exposed Dangerous Method or Function vulnerability. The description indicates unauthenticated remote attackers can leverage social engineering to persuade a victim to open or load a malicious webpage inside the Heptabase application, res...

PT-2026-48831

Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers to leverage social engineering techniques to trick a victim into opening or loading a malicious webpage within the Heptabase application, thereby gaining...

CVE-2026-39309

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission...

CVE-2026-39309

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission...

CVE-2026-39309 Trilium Notes: macOS TCC Bypass via Prompt Spoofing

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. In versions 0.102.1 and prior, the Electron configuration is vulnerable to TCC Bypass via Prompt Spoofing, allowing local attackers to trigger misleading macOS permission...

Yarbo responds to robot flaws that could mow down their owners

A researcher found that Yarbo yard robots came with a host of vulnerabilities which, among others, allowed an attacker to harvest WiFi passwords. Security researcher Andreas Makris found he could remotely hijack thousands of Yarbo yard robots worldwide, and proved it by having his mower run him...