TeamFiltration

TeamFiltration TeamFiltration は、O365 EntraID アカウントの列挙、スプレー攻撃、データ流出、バックドア処理を行うためのクロスプラットフォームフレームワークです。 TeamFiltration の動作の概要については TeamFiltration ウィキページを、セットアップ方法については Quick Start Guide を参照してください。 このツールは、2021年1月から TrustedSec 社内で使用されており、DefCON30 での講演 Taking a Dump In The Cloud で公開されました。 ダウンロード...

metasploitable2-exploitation-metasploit

使用Metasploit攻击Metasploitable2：VSFTPD、Samba等 一份利用Metasploit框架进行渗透测试的实操指南——从PostgreSQL数据库设置和dbnmap扫描开始，通过vsftpd、Samba和UnrealIRCd获取三个root shell，再到使用Netcat提取凭据。 概述 本仓库记录了在一个隔离的VirtualBox实验室中对Metasploitable2进行的完整Metasploit攻击过程。涵盖主题： 设置带PostgreSQL后端和工作区的Metasploit 运行dbnmap将扫描结果直接保存到数据库 利用vsftpd...

FakeAuth

FakeAuth FakeAuthは、ユーザーの認証情報を入力要求し、HTTPプロトコルで外部に送信するツールです。 以下のプロジェクトに触発されました 1. hlldz氏のPICKL3 https://github.com/hlldz/pickl3 汚いコードとバグがあるかもしれません ; インストール 特別な要件はありません 使い方 v1.01 root@kitploit: Usage: FakeAuth.exe Example: FakeAuth.exe 1 1 1 10 windowtitle entercreds 10.0.0.0:80\n hide integer - Hid...

agent-vault

HTTPクレデンシャルプロキシ＆ボールト Infisical によるオープンソースのクレデンシャルブローカーで、エージェントとそれらが呼び出すAPIの間に位置します。 エージェントはクレデンシャルを保持すべきではありません。Agent Vaultはブローカーアクセスにより、クレデンシャル流出リスクを排除します。 初めてですか？ローンチブログ記事でAgent Vaultの全貌をご覧ください。 ドキュメント | インストール | チュートリアル | ビデオデモ | Slack Agent Vaultの必要性...

tirith

tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog | Releases Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? root@kitploit: curl -sSL...

WifiPassword-Stealer

WifiPassword-Stealer ターゲットコンピュータから全ての登録済みWiFiパスワードを取得します。 インストール Pythonファイルを使用する場合 root@kitploit: pip install smtplib pip install subprocess pip install glob 使用方法 •テンポラリメールを使用して "https://mailtrap.io/" にアカウントを作成します。 •"main.py" に自身の SMTP ユーザー名と SMTP パスワードを設定します。 •以下のコマンドでEXEを作成します。 root@kitploit:...

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 fails to validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node ). A shared-workflow editor or any user creating/updating a workflow via the REST API, Public API, or MCP can p...

CVE-2026-85166 n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

EUVD-2026-70401

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

CVE-2026-84377

LiteLLM (an AI Gateway/proxy server for LLM APIs) is affected by an authenticated SSRF and provider-credential exfiltration vulnerability prior to versions 1.88.6 and 1.96.2 . The root cause lies in incomplete request validation across multiple proxy files (auth_utils.py, common_request_processin...

Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

MAL-2026-15813 Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook-

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook- On February 13, 2024, Microsoft published a critical security vulnerability in Microsoft Outlook, identified as CVE-2024-21413, known as the Moniker Link Vulnerability. The vulnerability allows an attacker to bypass Outlook's Protected View...

CVE-2023-7231

CVE-2023-7231 – 严重 SSRF → 通过 Audible fetchResource 实现 Memcached/Docker RCE 攻击链 🔥 摘要 此漏洞导致 Audible 的 fetchResource API（位于 .audible.com）存在服务端请求伪造（SSRF） ，使未认证攻击者能够横向渗透至内部基础设施。 通过 SSRF 载荷链式攻击，我们实现了： 🛡 AWS EC2 元数据访问 🐳 对 127.0.0.1:2375 的 Docker 套接字探测 🔐 通过/env、/proc/self/environ 窃取凭证与个人身份信息 ✅...

CVE-2026-71366

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

EUVD-2026-64923

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

CVE-2026-71366

A server-side request forgery (SSRF) vulnerability affects multiple AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) in Red Hat Ansible Automation Platform 2.5 and 2.6 . Notification template URLs are used as direct HTTP request targets without validating against private,...