SIPI

简易IP信息工具 sIPI 用于IP声誉数据分析 @st2labs 简易IP信息工具 @st2labs 作者 : Julian J. Gonzalez Caracuel - Twitter: @rhodius | @seguriadxato2 | @st2labs 版本 : 0.1 摘要 此工具面向事件响应团队以及任何想要了解可疑IP地址行为的人员。该工具从一组开源威胁情报源中搜索声誉信息，获取与该IP相关的信息，如恶意软件活动、恶意活动、黑名单、垃圾邮件和僵尸网络活动。 依赖 : request shodan 安装 : root@kitploit: pip install reques...

Sooty

概述 Sooty 是一款旨在帮助 SOC 分析师自动化部分工作流程的工具。Sooty 的目标之一是尽可能多地执行常规检查，使分析师在相同时间内有更多时间进行深入分析。以下详细介绍了 Sooty 的许多功能。 Sooty 现已获得 Tines.com 的赞助！Tines 是企业安全团队的 SOAR 平台。 目录 当前功能 要求与安装 开发 更新日志 路线图 贡献者 Sooty 目前能够： 净化 URL，使其可安全用于电子邮件 执行反向 DNS 和 DNS 查询 从以下来源执行信誉检查： VirusTotal BadIP's Abuse IPDB...

crowdsec

CrowdSec is an open-source and participative security solution offering crowdsourced server detection and protection against malicious IPs. Detect and block with our Security Engine, contribute to the network, and enjoy our real-time community blocklist. Features & Advantages Versatile Security...

ARTIF

ARTIF ARTIF 是一个先进的实时威胁情报框架，它在 MISP 之上增加了一个抽象层，用于基于 IP 声誉和历史数据识别威胁和恶意网络流量。它还通过收集、处理和关联基于不同因素的可观测指标，执行自动丰富和威胁评分。 ARTIF 的关键特性包括： 评分系统：为 IP 地址添加威胁元数据，包括威胁评分，可作为安全团队采取行动的阈值。 容器化：ARTIF 使用容器部署，因此易于部署。 模块化架构：项目基于插件，只需修改 MISP 中的威胁源即可轻松扩展。由于这些是内联更新，实际服务不会停机。 警报：扩展功能，与 Slack 无缝集成以实现主动警报。同时提供更好的攻击分析和可视化。 一些用...

geo-recon

Geo-Recon 一款OSINT CLI工具，旨在为安全分析师快速追踪IP声誉和地理位置查询。 Linux 前置要求 Python3 bash sudo apt install python3 Pip3 bash sudo apt install python3-pip 如果你不使用Debian或Ubuntu，请搜索对应平台（如yum和pacman）。 设置 此工具兼容于： 任何Linux操作系统（Debian、Ubuntu、CentOS） Termux Linux 设置 root@kitploit: git clone...

geo-recon

Geo-Recon An OSINT CLI tool desgined to fast track IP Reputation and Geo-locaton look up for Security Analysts. Pre-requirements for Linux Python3 bash sudo apt install python3 Pip3 bash sudo apt install python3-pip If you don't use Debian or Ubuntu, search for their respective platforms like yum...

pulledpork

PulledPork PulledPork for Snort and Suricata rule management from Google code Find us on Libera.Chat IRC pulledpork Copyright C 2009-2021 JJ Cummings, Michael Shirk and the PulledPork Team! Thank you for choosing to use PulledPork! This file provides some basic guidance on the usage of PulledPork...

CVE-2026-41575

In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting XSS vulnerability was identified in an IP Reputation Checker application. Unsanitized user input was directly rendered in the browser, allowing attackers to execute arbitrary JavaScript. This issue has been...

FortressWAF

FortressWAF — Web Application Firewall !Licensehttps://im...

CVE-2026-41575

In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting XSS vulnerability was identified in an IP Reputation Checker application. Unsanitized user input was directly rendered in the browser, allowing attackers to execute arbitrary JavaScript. This issue has been...

CVE-2026-41575

Summary (CVE-2026-41575): The issue affects the th30d4y/IP IP Reputation Checker app, where a DOM-based XSS vulnerability exists in versions 1.0.1 through before 2.0.1 due to unsanitized input being rendered in the browser, enabling arbitrary JavaScript execution. The vulnerability impact is limi...

CVE-2026-41575 th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability

In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting XSS vulnerability was identified in an IP Reputation Checker application. Unsanitized user input was directly rendered in the browser, allowing attackers to execute arbitrary JavaScript. This issue has been...

CVE-2026-41575 th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability

In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting XSS vulnerability was identified in an IP Reputation Checker application. Unsanitized user input was directly rendered in the browser, allowing attackers to execute arbitrary JavaScript. This issue has been...

CVE-2026-41575

In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting XSS vulnerability was identified in an IP Reputation Checker application. Unsanitized user input was directly rendered in the browser, allowing attackers to execute arbitrary JavaScript. This issue has been...

PT-2026-39139

In th30d4y/IP from version 1.0.1 to before version 2.0.1, a DOM-Based Cross-Site Scripting XSS vulnerability was identified in an IP Reputation Checker application. Unsanitized user input was directly rendered in the browser, allowing attackers to execute arbitrary JavaScript. This issue has been...

EUVD-2025-27472

Malicious code in bioql PyPI...

CVE-2025-34176

In pfSense CE /suricata/suricataipreputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the fi...

CVE-2025-34176

In pfSense CE /suricata/suricataipreputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the fi...

CVE-2025-34176 Netgate pfSense CE Suricata Package v7.0.8_2 Directory Traversal Information Disclosure

In pfSense CE /suricata/suricataipreputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. This value is directly used in a file existence check operation. While the contents of the file cannot be read, the server reveals whether the fi...

CVE-2025-34173 Netgate pfSense CE Snort package v4.1.6_25 Directory Traversal Information Disclosure

In pfSense CE /usr/local/www/snort/snortipreputation.php, the value of the iplist parameter is not sanitized of directory traversal-related characters/strings before being used to check if a file exists. While the contents of the file cannot be read, the server reveals whether a file exists, whic...