isf

Industrial Exploitation Framework ISFIndustrial Exploitation Framework is a exploitation framework based on Python, it's similar to metasploit framework. ISF is based on open source project routersploit. Read this in other languages:English, 简体中文, Disclaimer Usage of ISF for attacking targets...

tyton

Tyton This Project Is Now Archived Linux Kernel-Mode Rootkit Hunter for 4.4.0-31+. For more information, visit Tyton's website. Detected Attacks Hidden Modules Syscall Table Hooking Network Protocol Hooking Netfilter Hooking Zeroed Process Inodes Process Fops Hooking Interrupt Descriptor Table...

blind-sql-bitshifting

基于位移的盲SQL注入 这是一个通过位移法计算 字符而非猜测字符的盲SQL注入模块。根据配置，每个字符需要7/8次请求。 用法 root@kitploit: import blind-sql-bitshifting as x Edit this dictionary to configure attack vectors x.options 配置示例： root@kitploit: 易受攻击的链接 x.options"target" = "http://www.example.com/index.php?id=1" 指定Cookie（可选） x.options"cookies" = ""...

FAMA

已弃用：LabCIF - 移动应用取证分析 入门指南 Android 数据提取与分析框架，集成 Autopsy 模块。轻松从设备中转储用户数据，并为 Autopsy 或外部应用生成强大报告。 功能 通过 ADB 从 Android 设备提取用户应用数据（需要 root 和 ADB）。 从 Android 镜像或挂载路径转储用户数据。 轻松构建特定 Android 应用的模块。 生成清晰可读的 JSON 报告。 完全集成 Autopsy 兼容性（数据源处理器模块、摄取模块、报告模块、地理定位、通信和时间线支持）。 基于当前案例导出 HTML 报告。 报告截图 先决条件 Python（2.7...

CVE-2025-67887

CVE-2025-67887 1C-Bitrix = 25.100.500 Translate Module Vulnerabilidad de Ejecución Remota de Código...

pe_tree

PE Tree PE Tree is a Python module for viewing Portable Executable PE files in a tree-view using pefile and PyQt5. It can also be used with IDA Pro, Ghidra, Volatility, Rekall and minidump to view and dump in-memory PE files, as well as perform import table reconstruction. Table of contents 1...

pe_tree

PE Tree PE Tree 是一个 Python 模块，用于使用 pefile 和 PyQt5 以树状视图查看可移植可执行文件 PE 文件。 它还可以与 IDA Pro、Ghidra、Volatility、Rekall 和 minidump 一起使用，以查看和转储内存中的 PE 文件，并执行导入表重建。 目录 1. 功能 2. 应用程序 要求 功能 安装 Windows Mac/Linux 面向开发者 用法 暗色模式 3. IDAPython 要求 功能 安装 使用 setuptools 手动安装 面向开发者 用法 示例 转储内存中的 PE 文件 4. Rekall 要求 功能 安装...

FunctionStomping

FunctionStomping 描述 这是一种全新的 shellcode 注入技术，用于绕过 AV 和 EDR。该技术受 Module Stomping 启发，并具有一些相似之处。 截至本文撰写时（2022-01-23），hollows-hunter 也无法检测到它。 这项技术的最大优势在于，它不会覆盖整个模块或 PE，只覆盖一个函数，并且目标进程仍然可以使用目标模块中的任何其他函数。 缺点在于，它并非对所有函数都有效（但对大多数函数有效），详细说明见我的博客：The Good, The Bad And The Stomped Function。 注意：如果 AV 标记此行为，但签名是...

Mandiant-Azure-AD-Investigator

Mandiant Azure AD Investigator 聚焦于 UNC2452 TTP 概述 本仓库包含一个 PowerShell 模块，用于检测可能指示 UNC2452 及其他威胁行为者活动的痕迹。某些痕迹是“高置信度”的入侵指标，而其他痕迹则属于所谓的“双重用途”痕迹。双重用途痕迹可能与威胁行为者活动有关，也可能与合法功能有关。需要对这些痕迹进行分析和验证。有关 UNC2452 所用技术的详细说明，请参阅我们的博客。 此工具为只读 工具。它不会对 Microsoft 365 环境进行任何更改。 总之，该模块将： 尽最大努力识别需要进一步验证和分析的入侵指标 它 不会 ： 100...

domain-protect

OWASP Domain Protect - 已迁移 OWASP Domain Protect 已迁移至 terraform-aws-domain-protect OWASP Domain Protect 现在可作为 Terraform 模块 使用 参见 OWASP Domain Protect 文档，包括 迁移 选项...

CVE-2026-31431_SCA_WAZUH

Política SCA de Wazuh: Copy Fail CVE-2026-31431 Este archivo de política: copy-fail-cve-2026-31431-policy.yml está diseñado para detectar la posible exposición y el estado de mitigación de Copy Fail / CVE-2026-31431. Qué comprueba esta política 1. algifaead está deshabilitado mediante la política...

CVE-2025-57819-ioc-check

CVE-2025-57819-ioc-check Descripción CVE-2024-6387-ioc-check es una herramienta ligera y eficiente diseñada para identificar IoCs en servidores FreePBX con cualquiera de los módulos endpoint Los usuarios deben actualizar a las últimas versiones compatibles de FreePBX actualmente 15, 16 y 17 y...

Linux Distros Unpatched Vulnerability : CVE-2026-90140

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad fuse: fix UAF in rcu pathwalks, fuseconnput frees the fuseconn through callrcu...

Linux Distros Unpatched Vulnerability : CVE-2026-93108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the...

Linux Distros Unpatched Vulnerability : CVE-2026-93109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an...

CVE-2026-55556: Heap-based Buffer Overflow

Rsyslog is a rocket-fast system for log processing. From 8.2110.0 until 8.2604.0, the optional imhttp module's parseauthheader function in contrib/imhttp/imhttp.c allocates a zero-byte heap buffer with calloc0, len when an HTTP Basic Authorization value exceeds its fixed work buffer, then passes...

Linux Distros Unpatched Vulnerability : CVE-2026-93110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/core: Wait for RCU callbacks before unloading ibcore putgidndev is queued with callrcu and implemented in ibcore. Stopping the workqueues does not drain...

Linux Distros Unpatched Vulnerability : CVE-2026-90291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - module/dups: Fix use-after-free in kmoddupreq lifetime handling The kmod dups code uses RCU to ensure that a kmoddupreq instance is freed only after it is no...

EulerOS 2.0 SP10 : cifs-utils (EulerOS-SA-2026-3685)

According to the versions of the cifs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user...

Linux Distros Unpatched Vulnerability : CVE-2026-92481

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pinctrl: mediatek: free EINT resources on unbind mtkeintdoinit creates an IRQ domain, populates it with a mapping for every EINT line and installs a chained...