detection-rules

Detection Rules Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine. This repository was first announced on Elastic's blog post, Elastic Security...

cloudquery

CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...

dorothy

David French @threatpunter님이 Elastic Security에서 만들었습니다. Dorothy는 보안 팀이 Okta 환경의 모니터링 및 탐지 기능을 테스트하는 데 도움을 주는 도구입니다. Dorothy는 공격자가 Okta 환경에서 작동할 때 취할 수 있는 행동과 보안 팀이 감사할 수 있어야 하는 행동을 시뮬레이션하는 여러 모듈을 갖추고 있습니다. 각 모듈은 지속성, 방어 회피, 정보 수집 등 관련 MITRE ATT&CK® 전술에 매핑됩니다. Dorothy에 대해 더 알아보고 시작하는 방법은 이 블로그 게시물...

CredKing

CredKing Overview Benefits Basic Usage Plugin Usage Gmail Okta Installation Development Plugin specific arguments Overview AWS Lambda를 사용하여 여러 리전에 걸쳐 IP 주소를 회전시키며 패스워드 스프레이Password Spray를 쉽게 실행할 수 있습니다. 제공: Benefits 모든 AWS Lambda 리전 완전 지원 멀티스레드 처리 사용자/패스워드 쌍 자동 생성 새 플러그인 손쉽게 추가 가능 실행 역할과 Lambda 함...

DefinitelyNotPhishing

⚠️ 면책 조항 이 저장소는 교육 및 테스트 목적으로만 제공됩니다. 여기에 포함된 모든 도구, 구성 및 리소스피싱 템플릿, 레드팀 유틸리티, 공격적 보안 스크립트 등는 명시적 허가 가 부여된 랩, 데모, 침투 테스트 환경과 같은 승인된 환경에서만 사용하도록 엄격히 제공됩니다. 허가 없이 이 코드, 데이터 또는 파생 콘텐츠를 사용하여 무단 공격, 피싱 캠페인을 수행하거나 시스템을 손상시키지 마십시오. 여기에 있는 자료를 사용하여 발생하는 오용, 남용 또는 불법 활동에 대해 어떠한 책임도 지지 않습니다. 허가 없이 시스템이나 개인을...

CVE-2026-78622

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents...

CVE-2026-78631

The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access t...

CVE-2026-78635

The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag,...

CVE-2026-78630

The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to construct OS commands. An authenticated local user with access to the management interface can supply crafted values, resulting in the execution of arbitrary OS...

CVE-2026-78629

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication...

CVE-2026-78626

The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization check, resulting in an authorization bypass when an administrator has explicitly configured a Protected Rule policy on one or more application resources...

CVE-2026-78627

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...

CVE-2026-78625

The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated file is automatically included during authentication requests, resulting in execution with the privileges of the web server process...

CVE-2026-78623

The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datastore configuration. The unsanitized values are substituted directly into the query string prior to preparation, resulting in unintended SQL execution against t...

CVE-2026-78624

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

CVE-2026-78620

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

CVE-2026-78574

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

CVE-2026-78552

The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is interpolated directly into the nginx server block without inspection, resulting in execution of injected directives...

CVE-2026-78560

The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP header without cryptographic validation. In architectures where this optional source is enabled without an upstream reverse proxy or firewall configured to saniti...

CVE-2026-78579

The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP datastore configuration. The raw values are substituted directly into the filter string and passed to the LDAP search operation, resulting in modification of th...