sleuthkit

The Sleuth Kit INTRODUCTION The Sleuth Kit is an open source forensic toolkit for analyzing Microsoft and UNIX file systems and disks. The Sleuth Kit enables investigators to identify and recover evidence from images acquired during incident response or from live systems. The Sleuth Kit is open...

CyberStrike

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt | हिन्दी 攻撃的セキュリティのために作られた、初のオープンソース AI エージェント。 ターミナルからの自律ペネトレーションテスト —...

oneiromancer

oneiromancer "ソフトウェア開発における欠陥の大部分は、プログラマーが自分のコードが実行され得るすべての状態を完全に理解していないことに起因する。" -- John Carmack "Can it run Doom?" -- https://canitrundoom.org/ Oneiromancer は、Hex-Rays の擬似コード向けにファインチューニングされたローカル実行の LLM...

sh00t

A Testing Environment for Manual Security Testers Sh00t is a task manager to let you focus on performing security testing provides To Do checklists of test cases helps to create bug reports with customizable bug templates Features: Dynamic Task Manager to replace simple editors or task management...

msidump

msidump MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner. On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we...

doona

Doona - Network fuzzing tool .:: About ::. Doona is a fork of the Bruteforce Exploit Detector Tool BED. BED is a program which is designed to check daemons for potential buffer overflows, format string bugs etc. Doona is Australian for duvet. It adds a significant enough number of features/change...

fuzzowski

Fuzzowski █ █ ████████ ██████████ ██ ████ ██ ██ ████ ██ ████ ████ █ ████████████ █ █ ██████████ █ Fuzzowski Network Fuzzer █ █ █ █ 🄯 Fuzzers, inc. ██ ██ by Mario Rivas このアイデアは、私たちが使いたい と思うネットワークプロトコルファザーになることです。...

pentest-guide

OWASP + Extraに基づくペネトレーションテストガイド このガイドは、ペネトレーションテストプロジェクト中に必要とされる適切なテストケースを求めるペネトレーションテスターを対象としています。OWASP Testing Guide...

Johnny-You-Are-Fired

Johnny-You-Are-Fired USENIX 発表の成果物 | 全文はこちら 概要 OpenPGP と S/MIME は、電子メールを暗号化しデジタル署名するための 2 大標準規格です。デジタル署名は、メッセージの真正性と完全性を保証するものとされています。本研究では、OpenPGP および S/MIME の電子メール署名検証のさまざまな実装に対する実用的な偽造攻撃を、5 つの攻撃クラスに分類して示します。1 S/MIME のコンテナ形式におけるエッジケースを分析します。2 最も広く使用されている OpenPGP 実装である GnuPG API...

appsec-forge

appsec-forge 专为开发人员、DevOps、AppSec、DevSecOps 和安全工程师 打造。 一个以仓库为先的安全知识库，涵盖安全开发、应用安全、基础设施、软件供应链、AI 和 DevSecOps。 像经验丰富的工程团队那样研究安全问题：理解功能、定位根因、分析漏洞利用、对比修复方案，并探索支撑性的安全工程实践。 目录 1. 开始之前 关于 当前可用的案例 Pro 访问权限 可以期待什么？ 如何学习 appsec-forge 2. 仓库结构 仓库布局 如何浏览案例 每个案例的内部结构 3. 继续学习 Public 与 Pro 许可协议 1. 开始之前 关于...

bug-bounty-standards

这个仓库是什么？ 这个仓库列出了漏洞赏金项目中会出现的情景以及应当如何处理这些情景。目前，其中许多情景都是逐案处理的，这给黑客、项目所有者和平台带来了大量的不确定性和困扰。本仓库的目标是统一所有赏金平台和项目处理这些边界情况的方式。希望标准化能让各方更频繁地满足彼此的期望。 这是一份草案 本文档是一份草案，尚未被任何漏洞赏金平台实施。在此阶段，我请求所有相关方提出意见。 如何贡献 请通过提交 GitHub issue 来贡献。所有合理的已提交 issue 将至少保持开放 30 天以供评论。 你的 issue 应当陈述一种观点，例如：...

CVE-2026-81933: Improper Neutralization of Special Elements used in an SQL Command

IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Analytic Grid Service Handler. A low-privileged authenticated user can inject SQL statements through the analytic cases grid endpoint, potentially resulting in unauthorized access to sensitive data and impact ...

CVE-2026-90806: Missing Authorization

A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulkviews.py of the component Bulk Case Update. The manipulation leads to missing authorization. The attack is possible to be carried out remotel...

AZL-98487 CVE-2026-73276 affecting package erlang for versions less than 26.2.5.21-6

Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7,...

Kibana 8.x < 8.19.20 / 9.0.x < 9.3.5 / 9.4.x < 9.4.2 Denial of Service (ESA-2026-136)

The version of Kibana installed on the remote host is 8.x prior to 8.19.20, 9.0.x prior to 9.3.5, or 9.4.x prior to 9.4.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-136 advisory. - Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input...

PT-2026-79932

Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected...

PT-2026-79873

Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected...

CVE-2026-49096

Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected...

CVE-2026-49096

Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected...

CVE-2026-49096 Uncaught Exception in Kibana Cases Leading to Denial of Service

Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected...