pentesting_scripts

Einführung Dieses Repository enthält eine zufällige Auswahl an Penetrationstest-Tools, die Berater bei ihren Engagements nützlich finden könnten. Sie können gerne Änderungen vornehmen, Funktionen vorschlagen oder Kommentare abgeben. Kontaktinformationen Facebook: https://www.facebook.com/vonahise...

paragon

Avviso di Deprecazione Questo progetto è stato deprecato, fate riferimento al nostro nuovo Realm project, che si basa su molte delle idee che avevamo quando abbiamo creato questo repository. Paragon Paragon è una piattaforma per engagement di Red Team. Mira a unificare strumenti offensivi dietro...

phantomstars

phantomstars Détection et suivi automatisés des faux engagements sur GitHub Un projet de JS Labs — faisant partie de l'initiative AI Slop Intelligence. Tourne chaque jour. Attribue un score à chaque compte suspect. Détecte les campagnes de bots coordonnées. Ouvre des issues directement sur les...

CVE-2026-79668

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

EUVD-2026-65446

Ech0 before 4.7.3 contains an authentication bypass vulnerability in the PUT /api/echo/like/:id endpoint that allows unauthenticated attackers to increment engagement metrics without identity verification or rate limiting. Attackers can send repeated requests to arbitrarily inflate the favcount...

tricorne

Tricorne Ein Fedora-Remix für offensive Sicherheit. „Mein Schatz? Wenn du ihn haben willst, gebe ich ihn dir. Such ihn! Ich habe alles an diesem Ort zurückgelassen!“ Gol D. Roger Die Kurzfassung Kali besitzt Debian. BlackArch besitzt Arch. Parrot besitzt die Nische des „sicherheitsorientierten...

Why Authentication UX Deserves More Attention on B2B Platforms

Better authentication UX helps B2B platforms reduce security fatigue, simplify account recovery, protect sensitive data, and keep business users engaged...

Buying TikTok views or followers? Here’s what you’re really getting

A whole industry has sprung up around selling TikTok "growth." Cheap views by the hundred, pre-made ad accounts, and polished sales pages promising a repeatable path to serious revenue. None of it is officially sanctioned by TikTok, and depending on what you're buying, you could end up wasting...

GO-2026-5623 Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0

Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation in github.com/lin-snow/ech0...

MAL-2026-6291 Malicious code in @outmarket/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7241a2e167db383267fa82ce9660a44f7bcca4b6d4f11bb7ca85eaa6b432a47e package.json declares a postinstall script that runs automatically on npm install and performs require'https'.get... to a Burp Collaborator subdomain...

Scammers Use TikTok and Instagram Reels to Spread Vidar Infostealer

ReversingLabs reveals how hackers exploit social media engagement metrics to deliver Vidar infostealer malware to thousands of unsuspecting users...

The-Full-Attack-Chain

⚔️ The Full Attack Chain — Capstone Red Team Engagement Int...

offensive-claude-533

Offensive Security Research Config for Claude Code !TIP...

offensive-claude-604

Offensive Security Research Config for Claude Code !TIP...

offensive-claude-813

Offensive Security Research Config for Claude Code !TIP...

offensive-claude-490

Offensive Security Research Config for Claude Code !TIP...

CVE-2026-7510

A vulnerability was determined in OWAP DefectDojo up to 2.55.4. Affected by this vulnerability is an unknown functionality of the component Benchmark/Engagement/Product/Survey. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The exploit has been...

Malicious code in hiura-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ebb60061f29d4f4279bca1129ebfccefb928bd22364f26961205935ff71393f This is a fork of the Baileys WhatsApp library that adds undocumented behavior abusing the consumer's authenticated WhatsApp account for the author's...

MAL-2026-4578 Malicious code in hiura-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ebb60061f29d4f4279bca1129ebfccefb928bd22364f26961205935ff71393f This is a fork of the Baileys WhatsApp library that adds undocumented behavior abusing the consumer's authenticated WhatsApp account for the author's...

GHSA-RGJ7-VG8V-J4WR Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

Summary No authentication is required to invoke PUT /api/echo/like/:id. The handler is registered on the public router group. The service increments favcount for the given echo without checking identity, without a per-user limit, and without CSRF tokens. A remote client can arbitrarily inflate li...