149 matches found
cicd-goat
一个故意存在漏洞的CI/CD环境。 破解CI/CD管道，夺取旗帜。🚩 由Cider Security创建 被Palo Alto Networks收购。 目录 描述 下载与运行 Linux & Mac Windows Powershell 使用说明 说明 接受挑战 故障排除 解决方案 贡献 描述 CI/CD Goat 项目让工程师和安全从业者通过一系列11个挑战来学习和实践CI/CD安全，这些挑战是在一个真实的、完整的CI/CD环境中进行的。每个场景难度不同，且每个场景侧重于一个主要的攻击向量。 这些挑战涵盖了 Top 10 CI/CD...
CTFd
¿Qué es CTFd? CTFd es un framework de Capture The Flag centrado en la facilidad de uso y la personalización. Incluye todo lo que necesitas para organizar un CTF y es fácil de personalizar con plugins y temas. Características Crea tus propios retos, categorías, pistas y flags desde la interfaz de...
capture-the-flag
Capture The Flag! Remasteriza imágenes de Live CD de Linux con el propósito de crear wargames de seguridad listos para usar con vulnerabilidades preinstaladas para explotar. Requisitos Necesitarás lo siguiente para construir el Live CD con los scripts de este proyecto: Linux, con acceso root...
page_table_walk
物理内存中的夺旗挑战 你已经读过关于分页的内容。图表看起来也合理。四级页表，每级9位，页框，偏移量。没错。但当你遇到一个真正需要手动遍历页表的挑战时，你意识到你并不真正理解它。你只是知道它。区别很大。 对我来说有效的方法是坐在QEMU和gdb前，亲自手动完成遍历：计算每个索引，从物理内存中读取每个条目，手动跟踪每个指针。一个下午的实践比几个小时的讲座学到更多。 这是我当时记录的笔记集合。如果你仍然缺少概念方面的理解，先看Zardus的关于内核内存管理的讲座。那是理论。这是实践。...
CVE-2021-4034-Capture-the-flag
CVE-2021-4034-夺旗赛 夺旗赛视频演示： https://www.youtube.com/watch?v=1N3x23X4FMk&t=103s...
caronte
caronte$ Caronte is a tool to analyze the network flow during capture the flag events of type attack/defence. It reassembles TCP packets captured in pcap files to rebuild TCP connections, and analyzes each connection to find user-defined patterns. The patterns can be defined as regex or using...
ctf-party
ctf-party 这是什么...
CVE-2025-55182-React2Shell-Lab
CyberSec Blog CTF - React2Shell PoC 该仓库提供了一个基于使用Next.js和React Server Components的网络安全博客的易受攻击的CTF（夺旗赛）环境。 CVE-2025-55182 : 在React Server Components 19.0.0、19.1.0、19.1.1和19.2.0版本中的预认证远程代码执行（RCE）漏洞。易受攻击的代码不安全地反序列化HTTP请求到Server Function端点的payload。 CVE-2025-66478 : 影响使用App Router的Next.js应用程序。 CTF 描述...
offensive-security-labs
Offensive Security Labs A collection of hands-on offensive cy...
Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations
Anthropic on Thursday became the latest artificial intelligence AI company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the...
Mr-Robot-CTF-Automation-Scripts
No d...
Malicious code in ect-472839-ctf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a67248cb7373817da18e0edf4a019e2e6c9ded239e93a2e477ac168f7f45eeaa package.json declares a preinstall hook "preinstall": "node index.js" that auto-executes on npm install. index.js issues an HTTP GET to the hardcoded...
Kernel-Exploit-Dojo-499
Kernel-Exploit-Dojo-499 CTF kernel exploitation notes, PoCs,...
Kernel-Exploit-Dojo-283
Kernel-Exploit-Dojo-283 CTF kernel exploitation notes, PoCs,...
MAL-2026-5096 Malicious code in cscc-glass-house (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 20f53888d08d0aa70146b50e8dc761373490363f9081ea0adb9fb93cfd2b6240 Package implements exfiltrating credentials from cloud environments to a hardcoded location. Some code parts suggest it may be part of a CTF. --- Category:...
GodSearch
GodSearch v20.0 — THE SOVEREIGN 💀 Universal Exploit Sear...
Metasploitable3-pentest-lab
🛡️ Metasploitable3 — Home Lab Penetration Test Report Aut...
Exploit for CVE-2026-42945
CVE-2026-42945 NGINX Rift - HTB-Ready Exploit Standalone ex...