dwn

🥽 dwn dockerpwn - Docker攻撃ツールマネージャー はじめに dwn は「ハッカーのためのdocker-compose」です。docker-compose と同様のシンプルなYAML「プラン」形式を用いて、イメージ名、バージョン、ボリューム/ポートマッピングを定義し、ツールを使えるように設定します。 機能 dwn を使用すると、以下のことが可能です: Dockerコンテナ内で使用する一般的なペンテストツールの設定 コンテキスト認識型のボリュームマウント コンテナ再起動なしでの動的なポートバインディングの変更 その他にも多数！ インストール pip3 install d...

openrasp

OpenRASP Introduction Unlike perimeter control solutions like WAF, OpenRASP directly integrates its protection engine into the application server by instrumentation. It can monitor various events including database queries, file operations and network requests etc. When an attack happens, WAF...

context-aware-offensive-intelligence

上下文感知攻击性情报（CAOI） 作者：Indoushka Nekaa Salah Eddine 概述 上下文感知攻击性情报（CAOI）是一种研究驱动的后渗透范式，优先考虑理解和决策而非执行。 本项目引入了一个全新的情报层，其功能包括： 推断运行与安全上下文 按含义而非可利用性分析错误配置 预测权限提升的可行性 量化风险与检测可能性 产生以人为中心的决策，而非漏洞利用 核心原则 不进行漏洞利用 不依赖 CVE 不修改系统 先决策，后行动 为何与众不同 现有框架侧重于 可以做什么 。 CAOI 侧重于 是否应该采取任何行动 。 状态 研究与概念实现（仅设计） 许可证 MIT License...

opa

Open Policy Agent Open Policy Agent（OPA）是一个开源、通用策略引擎，可在整个技术栈中实现统一、上下文感知的策略执行。 OPA 很荣幸成为 Cloud Native Computing Foundation（CNCF）领域的毕业项目。详情请阅读 CNCF 公告。 开始使用 OPA 使用 Rego Playground 编写您的第一条 Rego 策略，或通过它分享您的工作以获取反馈和支持。如果您不确定从何入手，可以查看 访问控制示例。 安装 VS Code 扩展 以在本地开始使用实时诊断、调试和格式化功能。有关其他受支持的编辑器，请参阅 Editor a...

pomerium

Pomerium 是一个身份识别与上下文感知的反向代理。Pomerium 无需企业 VPN，即可为内部 Web 应用和其他服务建立安全、无客户端的连接。 Pomerium 具备以下特点： 更简单 — 借助无客户端访问。 更快速 — 无隧道架构，并部署在您的应用和服务所在之处。 更安全 — 因为每一个操作在执行前都会经过验证。 更贴合 — 通过整合所有数据实现上下文感知访问，满足您组织的需求。 它不是 VPN 的替代品——而是保护您业务的值得信赖、万无一失的方式。想要托管控制平面和管理 GUI？立即试用 Pomerium Zero！ 文档 有关全面的文档和教程，请参阅我们的文档。 贡献...

cerbos

什么是 Cerbos？ Cerbos 是一个与你的产品共同演进的授权层。它让你能够通过简单、直观的 YAML 策略，为应用程序资源定义强大的、上下文感知的访问控制规则；并通过 GitOps 基础设施进行管理和部署。它提供高可用的 API，通过简单的请求来评估策略，并为你的应用程序做出动态访问决策。 这个仓库包含了搭建自托管 Cerbos 策略决策点（PDP）所需的一切。免费注册 Cerbos Hub 账户，以简化你的策略编写和分发工作流，并将其分发到自托管的 PDP。 借助 Cerbos Hub，你可以： 与同事协作，在完全互动的私有 playground 中编写和共享策略...

SUSE CVE-2025-24784

kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. The policy group feature, added to by the 1.17.0 release. By being namespaced, the AdmissionPolicyGroup has a well constrained impact on cluster resources. Hence, it's considere...

Context-Aware Entity-Relation Extraction for Threat Intelligence Knowledge Graphs

Cybersecurity Knowledge Graphs CKGs unify diverse Cyber Threat Intelligence CTI sources into structured, queryable formats, offering scalable solutions for automating proactive and real-time security responses. Their increasing adoption has significantly enhanced the workflow and decision-making...

Context-Aware Web Attack Detection in Open-Source SIEM Systems Via MITRE ATT&CK-Enriched Behavioral Profiling

Security Information and Event Management SIEM systems aggregate log data from heterogeneous sources to detect coordinated attacks. Traditional rule-based correlation engines struggle to classify multi-step web application attacks because they examine each event without reference to the behaviour...

Context-Aware Spear Phishing: Generative AI-Enabled Attacks against Individuals Via Public Social Media Data

We demonstrate how publicly available social-media data and generative AI GenAI can be misused to automate and scale highly personalized, context-aware spear-phishing campaigns. With minimal attacker effort, a small amount of public activity per target is sufficient for GenAI models to extract...

On the Security of Research Artifacts

Research artifacts are widely shared to support reproducibility, and artifact evaluation AE has become common at many leading conferences. However, AE mainly checks whether artifacts work as claimed and can be reproduced. It largely overlooks potential security risks. Since these artifacts are...

AFL-ICP: Enhancing Industrial Control Protocol Reliability Via Specification-Guided Fuzzing

Industrial Control Protocols ICPs are critical to the reliability and stability of industrial infrastructure, yet their security is fundamentally compromised by a specification-blindness bottleneck. Modern fuzzers, constrained by observation-driven inference, struggle to penetrate deep protocol...

ARGUS: Defending LLM Agents against Context-Aware Prompt Injection

The rise of Large Language Model LLM agents, augmented with tool use, skills, and external knowledge, has introduced new security risks. Among them, prompt injection attacks, where adversaries embed malicious instructions into the agent workflow, have emerged as the primary threat. However,...

Wiz Red Agentのご紹介 - AI搭載アタッカー

Red Agentは、アタックサーフェス全体にわたる悪用可能な複雑なリスクを継続的かつ大規模に発見する、AI搭載でコンテキストを認識するアタッカーです。...

Why Security Validation Is Becoming Agentic

If you run security at any reasonably complex organization, your validation stack probably looks something like this: a BAS tool in one corner. A pentest engagement, or maybe an automated pentesting product, in another. A vulnerability scanner feeding an attack surface management platform somewhe...

Webinar: How Modern SOC Teams Use AI and Context to Investigate Cloud Breaches Faster

Cloud attacks move fast — faster than most incident response teams. In data centers, investigations had time. Teams could collect disk images, review logs, and build timelines over days. In the cloud, infrastructure is short-lived. A compromised instance can disappear in minutes. Identities rotat...

AI-Powered Forensics, at Cloud Speed

Reviewing Wiz’s approach to forensics in the cloud era, and announcing the public preview of AI-powered, context-aware forensics capabilities...

CVE-2025-64097

NervesHub is a web service that allows users to manage over-the-air OTA firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens...

CVE-2025-64097

NervesHub (OTA firmware management service) is affected by CVE-2025-64097 due to tokens used for user/API authentication having a predictable format from 1.0.0 up to 2.3.0. The root cause is insufficient entropy in tokens, allowing brute-forcing to gain unauthorized access to user accounts or API...

CVE-2024-39315

Pomerium is an identity and context-aware access proxy. Prior to version 0.26.1, the Pomerium user info page at /.pomerium unintentionally included serialized OAuth2 access and ID tokens from the logged-in user's session. These tokens are not intended to be exposed to end users. This issue may be...