ScrapPY

🐕 ScrapPY: 轻松实现PDF数据提取 ScrapPY 是一款 Python 实用工具，用于提取手册、文档及其他敏感 PDF 中的内容，生成针对性的单词列表，可供进攻性安全工具用于暴力破解、强制浏览和字典攻击。ScrapPY 可执行词频、熵和元数据分析，并支持完整输出模式以定制针对特定攻击的单词列表。该工具深入挖掘可能指向密码或隐藏目录的关键词和短语，输出为 Hydra、Dirb 和 Nmap 等工具可读取的文本文件。借助 ScrapPY，加速初始访问、漏洞发现和横向移动！ Demo:...

frostbyte

FrostByte 前言： 过去几天我一直在尝试 AppDomain 管理器注入 技术，在之前的红队演练中，它针对某些 EDR 取得了不错的成功。虽然这对于初始访问向量来说非常不错，但我想发布一个 POC，帮助你将 shellcode 隐藏在其他地方。不再需要嵌入 shellcode 的 DLL 文件！ 问题！ 虽然这是一项独立使用时非常出色的技术，但当与诸如通过 ISO/ZIP/VHD/VHDX 文件发送 C ClickOnce 之类的投递技术结合时，真正的问题是：有十分之一的概率，用于 appdomain 的 DLL 会被 AV/EDR 的 AI/ML 启发式检测到。这是因为在初始化...

FOCA

FOCA（通过收集的档案对组织进行指纹识别） FOCA 是一款主要用于查找扫描文档中的元数据和隐藏信息的工具 。这些文档可能位于网页上，可以使用 FOCA 下载并分析。 它能够分析多种文档，最常见的是 Microsoft Office 、Open Office 或 PDF 文件，尽管它也能分析例如 Adobe InDesign 或 SVG 文件。 这些文档通过三个可用的搜索引擎进行搜索：Google 、Bing 和 DuckDuckGo 。三个引擎的结果总和构成了大量文档。也可以添加本地文件来提取图形文件中的 EXIF 信息，并且在下载文件之前，就已经对通过 URL...

prowler

Prowler is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security...

CVE-2023-7231

CVE-2023-7231 – Cadena crítica de SSRF → Memcached/Docker RCE a través de fetchResource de Audible 🔥 Resumen Esta vulnerabilidad permite Server-Side Request Forgery SSRF en la API fetchResource de Audible en .audible.com, permitiendo a atacantes no autenticados pivotar hacia la infraestructura...

zannotate

ZAnnotate ZAnnotate es una utilidad en Go que facilita anotar grandes conjuntos de datos de IP con metadatos de red. Actualmente esto incluye: CLI Flag| Descripción| Requiere API Key| Requiere descarga de datos ---|---|---|--- --censys| Inteligencia de internet de Censys API en vivo| Sí| --cymru|...

botb

Break out the Box BOtB BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies. What does it do? BOtB is a CLI tool which allows you to: Exploit common container vulnerabilities Perform commo...

Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection

The Everest Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.3 via deserialization of untrusted input from form entry metadata. This is due to the html-admin-page-entries-view.php file calling PHP's native unserialize on stored entry meta...

FormCraft3 <= 3.9.15 - Server-Side Request Forgery

Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions. id: CVE-2026-65442 info: name: FormCraft3 = 3.9.15 - Server-Side Request Forgery author: DhiyaneshDk severity: high description: | Unauthenticated Server Side Request Forgery SSRF in FormCraft = 3.9.15 versions...

Concrete CMS <9.5.1 - Unauthenticated File-Usage Internal Metadata Disclosure

Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate. The endpoint /ccm/system/dialogs/file/usage/fID accepts an integer file ID in the URL and returns internal site structure data page IDs, versions, URL paths to anyone who sends a GET request. id:...

DomainMOD 4.13.0 - Cross-Site Scripting

DomainMOD 4.13.0 is vulnerable to cross-site scripting via reporting/domains/cost-by-owner.php in the "or Expiring Between" parameter. id: CVE-2020-20988 info: name: DomainMOD 4.13.0 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.13.0 is vulnerable to...

Kan <= 0.5.4 - Server-Side Request Forgery

Kan, an open-source project management tool Trello alternative, versions 0.5.4 and below are vulnerable to an unauthenticated Server-Side Request Forgery in the /api/download/attatchment endpoint. The endpoint passes the attacker-controlled url query parameter straight to a server-side fetch...

MagicMirror <= 2.35.0 - Server-Side Request Forgery

An unauthenticated Server-Side Request Forgery SSRF vulnerability in the /cors endpoint allows any remote attacker to force the MagicMirror² server to perform arbitrary HTTP requests to internal networks, cloud metadata services, and localhost services. The endpoint also expands environment...

Gotenberg <= 8.30.1 - Server Side Request Forgery

Gotenberg is an API-based document conversion tool. In versions 8.30.1 and earlier, the default private-IP deny-lists for the --webhook-deny-list and --api-download-from-deny-list flags use a case-sensitive regular expression ^https?:// to match URL schemes. Because Go's net/url.Parse normalizes...

Gotenberg - Command Injection

Gotenberg 8.31.0 contains a command injection caused by lack of validation on JSON metadata keys in /forms/pdfengines/metadata/write endpoint, letting unauthenticated attackers execute OS commands, exploit requires crafted HTTP request. id: CVE-2026-42589 info: name: Gotenberg - Command Injection...

Monsta FTP <= 2.14.4 - Unauthenticated SSRF via IPv6 Blocklist Bypass

Monsta FTP before 2.14.5 contains a server-side request forgery vulnerability in the fetchRemoteFile action caused by an incomplete IP blocklist check in the isBlockedIP function, which fails to detect embedded IPv4 addresses within IPv4-mapped IPv6 addresses. id: CVE-2026-60105 info: name: Monst...

ResourceSpace - Metadata Export

In Montala ResourceSpace through 9.8 before r19636, csvexportresultsmetadata.php allows attackers to export collection metadata via a non-NULL k value. id: CVE-2022-31260 info: name: ResourceSpace - Metadata Export author: ritikchaddha severity: medium description: | In Montala ResourceSpace...

Rank Math SEO < 1.0.229 - Unauthenticated User and Term Metadata Insert/Update/Deletion

Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress contains a missing capability check on 'updatemetadata' in all versions up to 1.0.228, letting unauthenticated attackers insert, update, or delete metadata, including user and term metadata, potentially causing loss of...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

CVE-2024-53677-Analysis

CVE-2024-53677 分析 本仓库包含为分析 Apache Struts 中 CVE-2024-53677 而准备的相关文档和实验工件。 概述 CVE-2024-53677 是 Apache Struts 文件上传处理中的一个漏洞。当来自旧版 FileUploadInterceptor 的与文件名相关的元数据被当作普通动作参数处理，并用于服务器端路径计算时，就会触发此问题。本仓库的组织方式旨在将分析报告、截图和本地实验室快照集中存放，以便文档记录和可重现性。 文档 分析报告: docs/CVE-2024-53677Analysis-Report.md 截图: docs/asset...