mud-visualizer

Manufacturer Usage Description MUD Visualizer Warning: mud-visualizer is currently beta. Use at your own risk. This tool can be used to visualize the MUD files in JSON format. Table of Contents Motivation Installation Supported MUD Abstractions Contribution Support Citation License Motivation MUD...

mud-visualizer

制造商使用描述（MUD）可视化工具 警告：mud-visualizer 目前处于测试阶段，使用风险自负。 该工具可用于可视化 JSON 格式的 MUD 文件。 目录 动机 安装 支持的 MUD 抽象 贡献 支持 引用 许可证 动机 MUD 文件是包含设备 ACL 规则的 JSON 格式纯文本文件。一个 MUD 文件可能包含数十或数百条 ACL 规则，这使得手动阅读和验证文件变得困难。mud-visualizer 将帮助您阅读、验证（并在不久的将来修改）MUD 文件。 安装 使用以下命令安装并运行 mud-visualizer： $ git clone...

CVE-2017-12635

CVE-2017-12635 Caso de estudio y PoC de CVE-2017-12635 Apache CouchDB 1.7.0 / 2.x 2.1.1 - Escalada de privilegios remota Presentación CouchDB Apache CouchDB es una base de datos NoSQL orientada a documentos, implementada en Erlang. CouchDB utiliza múltiples formatos y protocolos para almacenar,...

ShredHound

ShredHound Resumen Divide un archivo JSON grande de BloodHound en varios archivos más pequeños para una importación más rápida. Sígueme en Twitter Mike Felch - @ustayready Uso básico usage: shred.py -h --output OUTPUT --filename FILENAME --chunks CHUNKS optional arguments: -h, --help show this he...

PyJFuzz

LOGO PyJFuzz 是一个小巧、可扩展且开箱即用的框架，用于模糊测试 JSON 输入 ，例如移动端 REST API、JSON 实现、浏览器、CLI 可执行文件等。 版本 | 1.1.0 ---|--- 主页 | http://www.mseclab.com/ Github | https://github.com/mseclab/PyJFuzz 作者 | Daniele Linguaglossa @dzonerzy 许可证 | MIT - 参见 LICENSE 文件 安装 依赖 PyJFuzz 需要一些依赖才能正常工作：bottle 、netifaces 、GitPython 和...

LEAKEY

LEAKEY 🔑 LEAKEY 是一个用于验证渗透测试和红队演练中发现的泄露 API 令牌/密钥的工具。 该脚本对漏洞猎手非常有用，可用于验证和确定泄露凭据的影响。 LEAKEY 使用位于 /.leakey/signatures.json 的基于 JSON 的签名文件。 LEAKEY 的理念是使其高度可定制，并能轻松添加新发现的服务/检查项。 LEAKEY 通过签名文件加载服务/检查列表，如果您想添加更多检查项/服务，只需将其附加到 signatures.json 文件中。 要求： jq 安装： curl...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

evilgophish

Table of Contents evilgophish A Word About Sponsorship Credits Prerequisites Disclaimer Why? Background Infrastructure Layout setup.sh Cloudflare Turnstile Setup Cloudflare Turnstile HTML Template Guide replacerid.sh Email Campaign Setup QR Code Generator SMS Campaign Setup Live Feed Setup A Word...

ip-finder-cli

IPFinder CLI Command Line Interface https://ipfinder.io/ Supports Single IP Address, asn, ranges, firewall as Input Supports Bulk Exports Results to Screen or to An Output File Supports IPv4 and IPv6 Supports ASN number , RANGES , Firewall Getting Started sign up for a free account at...

joy

| |/ | | | | | | | || |/ |/ , | |/ | / 一个用于捕获和分析网络流数据及流内数据的包， 适用于网络研究、取证和安全监控。 TLS 指纹识别 附录：关于我们最新的网络指纹识别工具和数据，请参阅 Mercury。 概述 Joy 是一个采用 BSD 许可的基于 libpcap 的软件包，用于从实时网络流量或数据包捕获（pcap）文件中提取数据特征，使用类似于 IPFIX 或 Netflow 的流导向模型，然后将这些数据特征表示为 JSON。它还包含可应用于这些数据文件的分析工具。Joy 可用于大规模数据探索，尤其是与安全和威胁相关的数据。 选择 JSON...

skanuvaty

Skanuvaty 极快的DNS/网络/端口扫描器，一体化。 从一个域名开始，我们将找到关于它的一切。 特点： 从根域名发现子域名 发现子域名的IP地址 检查那些IP上开放了哪些端口（注意：尚未实现） 输出一个方便的.json文件，包含所有数据，用于进一步调查。 运行速度快如你的计算机/网络/DNS解析器所允许。测试运行了10,000个子域名 在拥有16个（逻辑）核心的机器上，concurrency设置为16，测试了所有子域名，耗时约20秒。 使用方法 skanuvaty --target nmap.org --concurrency 16 --subdomains-file...

git-vuln-finder

git-vuln-finder Finding potential software vulnerabilities from git commit messages. The output format is a JSON with the associated commit which could contain a fix regarding a software vulnerability. The search is based on a set of regular expressions against the commit messages only. If CVE ID...

klar

Klar Integration of Clair and Docker Registry supports both Clair API v1 and v3 Klar is a simple tool to analyze images stored in a private or public Docker registry for security vulnerabilities using Clair https://github.com/coreos/clair. Klar is designed to be used as an integration tool so it...

nexfil

NExfil is an OSINT tool written in python for finding profiles by username. The provided usernames are checked on over 350 websites within few seconds. The goal behind this tool was to get results quickly while maintaining low amounts of false positives. Available In Featured The Privacy, Securit...

roca

ROCA detection tool This tool is related to ACM CCS 2017 conference paper 124 Return of the Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli. It enables you to test public RSA keys for a presence of the described vulnerability. Update 4.11.2017 : Python 2.7, 3.4+ supported...