CVE-2024-50961

Sensitive Data Exposure CVE-2024-50961 Description In DonWeb Ferozo Hosting v1.1, a remote attacker can exploit URL parameters to access sensitive data, including database credentials. Attack vectors include network sniffing, server logs, and browser history, potentially exposing organizations to...

OneRuleToRuleThemStill

OneRuleToRuleThemStill An revamped and optimised version of OneRuleToRuleThemAll. OneRuleToRuleThemStill now has a 5% 6.9% reduction in rules 52,000 down to 49,465 48,414 with 0% performance loss against the Lifeboat and LastFM data breaches. Updates: De-duplication of resulting candidate...

WhatBreach

WhatBreach WhatBreach is an OSINT tool that simplifies the task of discovering what breaches an email address has been discovered in. WhatBreach provides a simple and effective way to search either multiple, or a single email address and discover all known breaches that this email has been seen i...

data-breach

Latest Data Breaches Repository This repository provides a comprehensive and continuously maintained list of confirmed data breaches from around the world. Each breach entry includes the breach name, which typically reflects the affected organization, along with the date of the incident. These tw...

XposedOrNot

XposedOrNot XposedOrNot XoN tool is to search an aggregated repository of xposed passwords comprising of 850 million real time passwords. Usage of such compromised passwords is detrimental to individual account security. Screenshot What is Xposed Passwords? The main aim of this project is to give...

Whoisleak

Whoisleak This tool queries the emails that registered the domain and verifies if they were leaked in some data leak. To install $ apt-get install nodejs-legacy $ pip install -r requirements.txt Usage Example python whoisleak.py -u securityattack.com.br Contact / Blog Eddy Oliveira SecurityAttack...

RSVPMaker <= 9.2.5 - SQL Injection

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from t...

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

Dolibarr Unauthenticated Contacts Database Theft

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. id: CVE-2023-33568 info: name: Dolibarr Unauthenticated Contacts Database Theft...

Jenkins <=2.196 - Cookie Exposure

Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue. id: CVE-2019-10405...

Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection

The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...

buster

설명 Buster는 고급 OSINT 도구로, 다음과 같은 작업을 수행합니다: 여러 출처gravatar, about.me, myspace, skype, github, linkedin, 이전 침해 사고를 통해 이메일의 소셜 계정 획득 Google, Twitter, DarkSearch, Paste 사이트를 통해 이메일이 발견된 위치 링크 획득 이메일 침해 사고 확인 이메일로 등록된 도메인 확인 역방향 whois 특정 인물의 가능한 이메일 및 사용자명 생성 소셜 미디어 계정에서 이메일 찾기 사용자명으로 이메일 찾기 특정 인물의 업무...

mosint

기능 • 설치 • 서비스 • 사용법 • Docker • 설정 • 화면 Mosint은 Go로 작성된 자동화된 이메일 OSINT 도구로, 대상 이메일을 빠르고 효율적으로 조사할 수 있게 해줍니다. 여러 서비스를 통합하여 보안 연구자들이 풍부한 정보에 신속하게 접근할 수 있도록 합니다. 기능 빠르고 간단한 이메일 기반 스캐닝 사용 편의성 최적화 및 가벼운 리소스 사용 이메일 확인 및 검증 소셜 미디어 계정 확인 데이터 유출 및 비밀번호 유출 확인 관련 이메일 및 도메인 찾기 Pastebin 덤프 스캐닝 Google 검색 DNS/IP...

godehashed

Godehashed dehashed.com API를 사용하여 손상된 자산을 검색하는 golang 도구입니다. 결과는 CSV로 컴파일하여 추가 분석에 사용할 수 있습니다. 스크린샷 Dehashed API 도구에 API 키를 제공해야 합니다. 예시는 apikeytemplate.txt 파일을 참조하세요. 설치 CLI에서 도구를 설치하려면 다음 명령을 실행하세요. $GOPATH가 설정되어 있어야 합니다. go get https://github.com/an00byss/godehashed 사용법 ./godehashed -s email -...

pwndb

pwndb.py pwndb.py is a python command-line tool for searching leaked credentials using the Onion service with the same name. Usage usage: pwndb.py -h --target TARGET --list LIST --output OUTPUT --proxy PROXY optional arguments: -h, --help show this help message and exit --target TARGET Target...

PwnedCheck

PwnedCheck PwnedCheck is a command-line tool for checking whether passwords have appeared in known data breaches using theHave I Been Pwned API and supports encrypted Bitwarden vaults exports. Features Check single passwords from the command line Process passwords from a file Accept pre-hashed...

CyberCodex

🌐 CyberCodex v3.2 - 22ソース・フルスペクトラム版 -00FF41?style=for-the-badge&logo=python&logoColor=white CyberCodex は、自律的で自己更新型の 22ソース・ゼロコストOSINT、データ侵害/リーク＆脅威インテリジェンスエンジン 、公平なサイバー戦争百科事典（インシデント・コーデックス） 、MITRE ATT &CKナレッジベース、および 二視点テクニカルレキシコン であり、Windows CMD、PowerShell、Linuxターミナル 向けに 外部依存ゼロ で設計されています。 📡...

FBI agents’ blood tests and doctors’ notes surface after breach

BBC News reports it has seen samples of stolen FBI agents’ medical examinations. The “fitness-for-work” reports identify FBI agents by name and address, and reveal even more personal details. They include blood and urine test results and doctors’ notes mentioning high cholesterol, blood in the...

MOVEit-Transfer-Data-Breach-Analysis.

MOVEit-Transfer-Data-Breach-Analysis. ​CS50 Cybersecurity 과정을 위한 2023년 MOVEit Transfer 데이터 침해 사고CVE-2023-34362에 대한 상세 분석입니다. 이 프로젝트는 인증되지 않은 SQL 인젝션의 기술적 영향과 전 세계 데이터 프라이버시에 미치는 결과를 탐구하며, 2,700개 이상의 조직에 영향을 미쳤습니다. David J. Malan 교수님과 CS50 스태프에게 특별한 감사를 드립니다...

ShinyHunters claims FBI breach was revenge for “false” report

Extortion group ShinyHunters is not afraid to make enemies. Now it claims to have breached the FBI. After reportedly taking over ransomware group Clop’s leak site, ShinyHunters says it attacked the FBI to punish the agency for spreading what it calls false information about the group. In a very...