HaE

赋能白帽，高效作战！ 网络版： overspace-labs/HaENet 文件版： overspace-labs/HaEFile README 版本: English | 简体中文 项目介绍 HaE 是一款网络安全（数据安全）领域 下的框架式项目，采用了乐高积木式 模块化设计理念，实现对本地文件和HTTP消息（包含WebSocket）精细化的标记和提取。 当前仓库作为 HaE 项目的品牌主仓使用，src/ 下的产品目录以 Git submodule 形式挂载，实际源码在下方列出的独立仓库中维护。...

upx

ooooo ooo ooooooooo. ooooooo ooooo 888' 8' 888 Y88. 8888 d8' 888 8 888 .d88' Y888..8P 888 8 888ooo88P' 8888' 888 8 888 .8PY888. 88. .8' 888 d8' 888b YbodP' o888o o888o o88888o The Ultimate Packer for eXecutables Copyright c 1996-2026 Markus Oberhumer, Laszlo Molnar & John Reiser...

pcileech

PCILeech Summary: PCILeech uses PCIe hardware devices to read and write target system memory. This is achieved by using DMA over PCIe. No drivers are needed on the target system. PCILeech also works without hardware together with a wide range of software memory acqusition methods supported by the...

macos_sandbox

macOS 入门 - 应用沙盒 继续我的 macOS 迁移系列博文，我想稍微讨论一下 macOS 应用沙盒。 强烈建议先阅读 macOS 应用结构 这篇博文——我会假定读者了解应用（App）与进程（任务）之间的区别，对 launchd 及其与应用启动的关系有一定了解。 沙盒示例 我第一次了解 macOS 沙盒时，天真地尝试创建一个恶意的 Word 宏。 这在 Windows 生态系统中（至今）仍然是一个非常常见的攻击向量，所以我想看看我是否能够直接启动进程并肆意破坏。 好吧，在 macOS 上事情并没有那么简单——例如，我确实能够运行进程，但似乎它们做不了太多事情。...

Log4Jolokia

Log4Jolokia 描述： Python3 实现，用于通过 Jolokia 利用和攻击 Log4J MBean。 用法： 通用帮助： usage: log4jolokia.py -h -u USER -p PASSWD --proxy PROXY -H HEADER execjar,writefile,readfile,execscript execjar,writefile,readfile,execscript ... target target ... positional arguments: execjar,writefile,readfile,execscript...

CVE-2026-66493

文件操作中的路径遍历（删除 / 复制 / 移动） PhocaCommander ≤ 6.1.3 — 已认证管理员可在 Web 根目录之外操作文件 摘要 PhocaCommander 的文件操作处理器从攻击者可控的 base64 编码参数（pathfrom、pathwhere）构造源路径和目标路径，且未进行任何路径包含验证。已认证的管理员可以删除、复制和移动 Web 服务器进程可访问的文件系统中的任意文件。 已在实验室中确认：可以删除 /tmp/（Web 根目录之外）中的文件，并将 /etc/passwd 复制到 PhocaCommander...

CVE-2026-92820

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

EUVD-2026-91175

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

CVE-2026-92820 Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's filepath, whi...

CVE-2026-92820

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to and including 3.3.34 . The root cause is that the plugin trusts an attacker-supplied file path from form submissions during the External File Upload (Amazon S3) flow. This unvalida...

windows-api-function-cheatsheets

Windows API 函数速查表 联系方式 🌨️ Tetsuo: https://www.x.com/tetsuo 目录 Windows API 函数速查表 文件操作 进程管理 内存管理 线程管理 动态链接库（DLL）管理 同步 进程间通信 Windows 钩子 加密 调试 Winsock 注册表操作 错误处理 资源管理 Unicode 字符串函数 字符串长度 字符串复制 字符串拼接 字符串比较 字符串搜索 字符分类与转换 Win32 结构体速查表 常用结构体 Win32 套接字结构体速查表 winsock.h Win32 套接字结构体速查表 winsock2.h Win32...

PT-2026-104083

The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34 via the external Amazon S3 upload flow. The plugin trusts an attacker-supplied file path from the form submission and stores it as the upload's file path,...

IOBitUnlockerUnlocker

简介 （0 day）移动或复制任意文件。通过校验和技巧绕过之前的补丁。 Writeup：https://nathan2.com/files/iobit.pdf 总体信息：https://nathan2.com/posts/iobit/ 我是在不知道已有其他先前漏洞利用的情况下发现此漏洞的。不过，此漏洞绕过了 IObit 所做的补丁。适用于 1.3.0 版本。 用法： C:\Users\nathan\source\repos\driverhandlerchecker\x64\Release\driverhandlerchecker.exe "C:\copied.txt" "C:\t.txt...

CVE-2026-97662

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow context-dependent threat actors to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value supplied to...

CVE-2024-4577

lol CVE-2024-4577 1. 利用命令 RCE 值 python3 cek.py --target http://target/index.php --ls --dir /path/to/directory python3 cek.py --target https://target/index.php --dir /path/to/directory python3 cek.py --target https://target/index.php --cat /path/to/directory 查找可写目录 python3 cek.py --target...

CVE-2026-22812

CVE-2026-22812 概述 一个针对 OpenCode 远程代码执行（RCE）漏洞的 Python 利用工具，影响版本 v1.0.216。该工具提供多种攻击向量，包括命令执行、文件读写、文件上传/下载以及交互式 Shell。 免责声明 ⚠️ 仅限授权测试使用 ⚠️ 本工具仅用于合法的安全测试和授权的渗透测试 仅可在您拥有或获得明确许可的系统上使用 作者不对因使用本工具造成的任何滥用或损害负责 未经授权访问计算机系统是违法的，将受到法律制裁 功能特性 漏洞检测 ：检查目标是否存在漏洞 命令执行 ：在目标上执行任意命令 文件操作 ：读取、写入、上传和下载文件 交互式 Shell ：支持...

CVE-2026-103754

A flaw was found in ansible-runner. The unstreamdir function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod and utime to an...

PT-2026-103965

Name of the Vulnerable Software and Affected Versions AWS security-agent-mcp-server versions prior to 0.2.0 Description An argument injection issue exists in the diff scan operation. A threat actor can provide a crafted reference value to the diff scan operation to create, overwrite, or truncate...

windows-api-function-cheatsheets

Windows API 函数速查表 联系方式 🌨️ Snowcrash: [email protected] 目录 Windows API 函数速查表 文件操作 进程管理 内存管理 线程管理 动态链接库 DLL 管理 同步 进程间通信 Windows 钩子 加密 调试 Winsock 注册表操作 错误处理 资源管理 Unicode 字符串函数 字符串长度 字符串复制 字符串连接 字符串比较 字符串搜索 字符分类与转换 Win32 结构体速查表 常用结构体 Win32 Sockets 结构体速查表 winsock.h Win32 Sockets 结构体速查表 winsock2.h...

CVE-2026-92371

TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording CSR functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged...