nightHawkResponse

nightHawk Response Elasticsearch 백엔드에서 비동기식 포렌식 데이터를 제시하기 위해 맞춤 제작된 애플리케이션입니다. 이 애플리케이션은 Mandiant Redline "collections" 파일을 수집하여 검색/스택 및 태깅에 유연성을 제공하도록 설계되었습니다. 이 애플리케이션은 단일 창에서 여러 조사또는 수백 개의 엔드포인트를 제어할 수 없는 문제를 해결하기 위해 탄생했습니다. Redline 감사 데이터를 수집하기 위해 우리는 nightHawkResponse를 만들었습니다. 이는 이 프레임워크를...

CVE-2024-22120-RCE-with-gopher

사용법 python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime 예제 시나리오 IP 192.168.1.100에서 실행 중인 Zabbix 서버를 발견했으며, 다음과 같은 세부 정보를 가진 낮은 권한의 사용자에 접근할 수 있습니다: 세션 ID sid: d82bf6715e1d3c1f25 호스트 ID hostid: 10107 PHP 세션 ID phpsessid: a4g7f48d9j3r7h8s9g 이 스크립트를 사용하여 RCE 취약점을 악용하려고 합니다. 스크립트...

CVE-2024-22120-RCE-with-gopher

사용법 python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime 요약 이 익스플로잇은 XXEXML External Entity를 악용하기 위해 만들어졌습니다. 이를 통해 웹 서비스의 백엔드 코드를 읽었고, 원격 코드 실행에 취약한 Zabbix 6.0.27 버전에 gopher를 사용하여 내부 요청을 보낼 수 있는 엔드포인트를 찾았습니다. 정찰 단계에서 외부 웹 서버에 무차별 대입brute-force 공격을 수행하여 docker-compose.yml 파일을...

gopher47

gopher47 The Havoc Framework 用のサードパーティ製 Gopher Assassinです。Havoc Framework まるでビデオゲームみたいだね :D これは何？ 🤔 これはGolangで書かれたHavoc C2用のサードパーティ製エージェントで、主に学習プロジェクトとして書かれましたが、それでも役に立つと確信しています。 これが公開される頃には、これが何なのか、なぜ作ったのかについて私のブログで読むことができます：ここ コントリビューション歓迎！...

CVE-2024-22120-RCE-with-gopher

사용법 python exploit.py --ip --sid --hostid --phpsessid --falsetime --truetime 예시 시나리오 IP 192.168.1.100에서 실행 중인 Zabbix 서버를 식별했으며, 다음 세부 정보를 가진 낮은 권한의 사용자에 접근할 수 있습니다: 세션 ID sid: d82bf6715e1d3c1f25 호스트 ID hostid: 10107 PHP 세션 ID phpsessid: a4g7f48d9j3r7h8s9g 이 스크립트를 사용하여 RCE 취약점을 익스플로잇하려고 합니다. 스크립트 ...

Gopherus

Gopherus SSRF に脆弱な場所をご存知なら、このツールは SSRF（Server Side Request Forgery）を悪用して RCE（Remote Code Execution）を獲得するための Gopher ペイロードを生成するのに役立ちます。また、被害者サーバー上でリバースシェルを取得するのにも役立ちます。詳細については、同じテーマのブログ Gopherus に関するブログ をご覧ください。 概要 このツールは以下のペイロードを生成できます: 1. MySQL Port-3306 2. PostgreSQLPort-5432 3. FastCGI Port-900...

AlmaLinux 9.2 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1736503631)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736503631 advisory. - Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc (crlsa-2022_5526)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20225526 advisory. squid: DoS when processing gopher server responses CVE-2021-46784 Tenable has extracted the preceding description block directly from the CIQ security advisory. Not...

Astra Linux – Vulnerability in Squid

Squid is a caching proxy for the Web that supports HTTP, HTTPS, FTP, and other protocols. Due to a NULL pointer dereference bug, Squid is vulnerable to Denial of Service attacks targeting its Gopher gateway. The Gopher protocol was always available and enabled in Squid prior to Squid 6.0.1...

Astra Linux – Vulnerability in Squid

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, a Denial of Service can occur when processing long Gopher server responses due to improper buffer management...

CVE-2026-62234

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

CVE-2026-62234 Grav < 2.0.4 SSRF via Unrestricted cURL Protocols

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

CVE-2026-62234: Server-Side Request Forgery (SSRF)

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

curl:curl_fuzzer_gopher: Heap-buffer-overflow in gid_cb

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5200332595200000 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzergopher Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x7ad33ebeaec0...

curl:curl_fuzzer_gopher: Heap-buffer-overflow in tuple_cb

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5857778623905792 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzergopher Job Type: libfuzzerasancurl Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x7c5ae1deae7e...

CVE-2026-49345

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery SSRF vulnerability exists in Mercator's CVE configuration panel /admin/config/parameters. The testProvider method in ConfigurationController passes...

CVE-2026-49345

CVE-2026-49345 affects Mercator before 2025.05.19. The SSRF flaw resides in the CVE configuration panel (/admin/config/parameters) where ConfigurationController.testProvider() passes user input directly to curl_init() without validating scheme/host/IP. An authenticated user with configure permiss...

CVE-2026-49345 Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF)

Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, a Server-Side Request Forgery SSRF vulnerability exists in Mercator's CVE configuration panel /admin/config/parameters. The testProvider method in ConfigurationController passes...

CVE-2026-43981: Concurrent Execution using Shared Resource with Improper Synchronization

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push and L.PCall execute. Since gopher-lua's LState is explicitly not goroutine-safe, concurrent requests race on the shared state...

JLSEC-2026-398

curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTPS URL, it sets up the connection to the remote server by issuing a CONNECT request to the proxy, and then tunnels the rest of the protocol through. An HTTP proxy might refuse this request HTTP...