MalQR.github.io

MalQR About MalQR is a collection of malicious QR codes and barcodes you can use to test the security of your scanners. It gives you the ability to conduct such tests with easiness : you just need to have a smartphone, a tablet or a laptop with an internet connection and browse MalQR.shielder.com...

graphql-threat-matrix

GraphQL Threat Matrix Why graphql-threat-matrix? graphql-threat-matrix was built for bug bounty hunters, security researchers and hackers to assist with uncovering vulnerabilities across multiple GraphQL implementations. The differences in how GraphQL implementations interpret and conform to the...

rakkess

rakkess Review Access - kubectl plugin to show an access matrix for server resources Intro Have you ever wondered what access rights you have on a provided kubernetes cluster? For single resources you can use kubectl auth can-i list deployments, but maybe you are looking for a complete overview?...

agartha

Agartha Payload Injection LFI, RCE, SQLi, with optional BCheck, Auth Issues Access Matrix, HTTP 403, Copy as JavaScript, and Bambdas Agartha, specializes in advance payload generation and access control assessment. It adeptly identifies vulnerabilities related to injection attacks, and...

browser-identity-attacks-matrix

Browser & Identity Attacks Matrix This repository is a collection of browser and identity attack techniques covering SaaS apps, browser-based attacks, identity providers, and phishing. It is intended to be a resource for security researchers, red/blue teams, and penetration testers to learn about...

Ransomware-Tool-Matrix

Matriz de Herramientas de Ransomware Este repositorio contiene una lista de las herramientas que utiliza cada banda de ransomware o banda de extorsión Como defensores, debemos aprovechar el hecho de que muchas de las herramientas utilizadas por estos ciberdelincuentes se reutilizan con frecuencia...

graphw00f

标志致谢 Nick Aleks！ graphw00f - GraphQL 服务器指纹识别 目录 工作原理是什么？ 检测引擎 GraphQL 威胁矩阵 前置条件 安装 配置 使用示例 指纹识别 GraphQL 检测并指纹识别 GraphQL 支持与问题 资源 工作原理是什么？ graphw00f（灵感来源于 wafw00f）是针对 GQL 端点的 GraphQL 指纹识别工具，它通过发送一系列良性和畸形的查询来识别后台运行的 GraphQL 引擎。 graphw00f 将利用 GraphQL 威胁矩阵项目，提供每项技术默认提供的安全防御措施以及它们是默认开启还是关闭的洞察。...

Grid-Mobile

Grid - 加密位置共享 难以被追踪。 mygrid.app Grid 是一款安全、端到端加密（E2EE）的位置共享应用，集成于 Matrix 协议。基于 Flutter 构建，Grid 为与可信联系人共享位置提供了注重隐私的解决方案。 功能特点 端到端加密 E2EE ：通过 Grid 共享的所有位置数据均经过加密，确保隐私与安全。 Matrix 协议集成 ：Grid 利用 Matrix 协议实现安全通信和去中心化数据存储。 跨平台 ：使用 Flutter 开发，Grid 在 Android 和 iOS 设备上均可流畅运行。 实时位置共享...

Risk-Analysis-Editor

Risk Analysis Editor RAE English · Français Standalone tool for building and visualizing risk matrices — inherent gross risk and residual net risk — with an open, documented file format, .rae.json. ▶️ Open the app · 📖 User guide · 🎬 Video tutorials · ⬇️ Download No installation: the tool runs...

CVE-2024-50485

CVE-2024-50485 Exam Matrix = 1.5 - 未经身份验证的权限提升 描述: Exam Matrix WordPress 插件在所有版本（包括 1.5）中均存在权限提升漏洞。这是由于该插件未能正确限制功能，使得未经身份验证的用户能够注册为更高权限的角色。这使得未经身份验证的攻击者能够获取更高的访问权限，例如管理员权限。 root@kitploit: Published: 2024-10-25 00:00:00 CVE: CVE-2024-50485 CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS...

rakkess

rakkess 审查访问权限 - 一个 kubectl 插件，用于显示服务器资源的访问矩阵 简介 你是否曾想过自己在提供的 Kubernetes 集群上拥有哪些访问权限？ 对于单个资源，你可以使用 kubectl auth can-i list deployments，但也许你正在寻找一个完整的概览？ 这就是 rakkess 的用途。 它会列出当前用户对所有服务器资源的访问权限，类似于 kubectl auth can-i --list。 它还可用于查找哪些主体可以访问某个服务器资源。 请查看子命令 rakkess resource，详见 下文。 演示 示例 显示所有资源的访问权限...

graphql-threat-matrix

GraphQL Threat Matrix ¿Por qué graphql-threat-matrix? graphql-threat-matrix fue creado para cazadores de recompensas, investigadores de seguridad y hackers, con el fin de ayudar a descubrir vulnerabilidades en múltiples implementaciones de GraphQL. Las diferencias en cómo las implementaciones de...

matrix-rs

Hipervisor Type-2 Blue Pill del núcleo de Windows en Rust Nombre en clave: Matrix Blog: https://memn0ps.github.io/hypervisors-for-memory-introspection-and-reverse-engineering/ Un hipervisor de investigación tipo 2 basado en Rust, ligero, seguro en cuanto a memoria y extremadamente rápido, con hoo...

CVE-2026-45056 Matrix Rust SDK: Sender-binding gaps in to-device and room-key attribution

matrix-sdk-crypto is a no-network-IO implementation of a state machine that handles end-to-end encryption for Matrix clients. Starting in version 0.12.0 and prior to version 0.17.0, the matrix-sdk-crypto crate was missing a check for the user ID when decrypting an Olm-encrypted event containing t...

CVE-2026-45056

matrix-sdk-crypto (Rust crate, part of the Matrix Rust SDK) versions from 0.12.0 up to the fix are vulnerable to sender spoofing in end-to-end encrypted to-device messages. The root cause is a missing validation of the sender's user ID when decrypting an Olm-encrypted event that contains the send...

CVE-2026-45057

CVE-2026-45057 affects the matrix-sdk-ui Rust crate (part of matrix-rust-sdk) prior to version 0.16.1 . The message edit validation logic is missing a check: when replacing an encrypted event, the replacement event is not required to be encrypted itself. This allows a malicious homeserver adminis...

CVE-2026-45057 matrix-sdk-ui: Incomplete edit validation

matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the matrix-sdk-ui crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious...

defense-matrix

Defense Matrix Archived Project This project was an attempt to automate various aspects of Linux security auditing and hardening. As time passed, I K4YT3X found many of the methodologies used in this project to be unideal and obsolete. Therefore, I recommend not continuing using this project but...

synapse

========================================================================= Synapse |support| |development| |documentation| |license| |pypi| |python| Synapse 现已积极维护于 element-hq/synapse Synapse 是一个开源的 Matrix 家服务器，由 Matrix.org 基金会从 2019 年到 2023 年开发。Matrix.org 基金会无法继续维护 Synapse，其 由 Element 继续开发...

Threat matrix: Mapping threats across cloud web applications

In this article 1. Overview 2. Technique Catalog 3. Privilege Escalation 4. Mitigation and protection guidance 5. References 6. Learn more Microsoft introduces the cloud web applications threat matrix, a MITRE ATT &CK-aligned framework that helps defenders understand, prioritize, and mitigate...