gokart

GoKart - Go 安全静态分析 GoKart 是一款针对 Go 语言的静态分析工具，它利用 Go 源码的 SSA（单静态赋值）形式来发现漏洞。该工具能够追踪变量和函数参数的来源，判断输入源是否安全，从而相比其他 Go 安全扫描器减少误报数量。例如，通常与变量拼接的 SQL 查询可能被标记为 SQL 注入；但 GoKart 能够判断该变量是否实际上是常量或常量等价物，这种情况下并不存在漏洞。 GoKart 还为 Chariot （Praetorian 的安全平台）提供动力，帮助您发现、管理并修复源码及云环境中的漏洞。Chariot 让您能够轻松对源码进行自动化、持续的 GoKart...

trident

trident Trident 项目是一个自动化密码喷射工具，旨在满足以下需求： 能够在多个云平台/执行提供商上部署 能够根据目标的帐户锁定策略安排喷射活动 能够增加身份验证请求来源的 IP 池，以提升操作安全性 能够快速扩展功能以支持新遇到的身份验证平台 目录 trident 目录 架构 部署 安装 使用 配置 活动 结果 架构 该图使用 Diagrams 生成。 Go gopher 由 Renee French 设计， 并采用 CC BY 3.0 许可协议。 部署 部署 trident 需要 Google Cloud 项目、一个域名（用于编排器 API），以及针对该域名的...

noseyparker

Nosey Parker 现已由 Titus 取代。Nosey Parker 正式退役 请参见我们的公告文章 https://www.praetorian.com/blog/titus-open-source-secret-scanner/。Titus 仓库可在 https://github.com/praetorian-inc/titus 找到 概述 Nosey Parker 是一个 CLI 工具，用于在文本数据中查找密钥和敏感信息。它本质上是一个专门用于检测密钥的特殊 grep 类工具。 它专为攻击性安全设计（例如，在红队中实现横向移动），但也可以用于防御性安全测试。它在...

MAL-2026-16240 Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

augustus v0.14.24

Augustus - LLM vulnerability scanner for prompt injection, jailbreak, and adversarial attack testing Augustus - LLM Vulnerability Scanner Test large language models against 210+ adversarial attacks covering prompt injection, jailbreaks, encoding exploits, and data extraction. Augustus is a Go-bas...

Malicious code in mcp-notes-server-poc-praetorian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...

F5 BIG-IP TMUI AJP Smuggling Remote Code Execution Exploit

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/proto/apachejp' class MetasploitModule 'F5 BIG-IP TMUI AJP Smuggling RCE', 'Description' = %q This module exploits a flaw in F5's BIG-IP Traffic Management...

F5 Issues Warning: BIG-IP Vulnerability Allows Remote Code Execution

F5 has alerted customers of a critical security vulnerability impacting BIG-IP that could result in unauthenticated remote code execution. The issue, rooted in the configuration utility component, has been assigned the CVE identifier CVE-2023-46747, and carries a CVSS score of 9.8 out of a maximu...

Security Patch Releases for Critical Zero-Day Bug in Java Spring Framework

The maintainers of Spring Framework have released an emergency patch to address a newly disclosed remote code execution flaw that, if successfully exploited, could allow an unauthenticated attacker to take control of a targeted system. Tracked as CVE-2022-22965, the high-severity flaw impacts...

Unpatched Java Spring Framework 0-Day RCE Bug Threatens Enterprise Web Apps Security

A zero-day remote code execution RCE vulnerability has come to light in the Spring framework shortly after a Chinese security researcher briefly leaked a proof-of-concept PoC exploit on GitHub before deleting their account. According to cybersecurity firm Praetorian, the unpatched flaw impacts...

Hackers Begin Exploiting Second Log4j Vulnerability as a Third Flaw Emerges

Web infrastructure company Cloudflare on Wednesday revealed that threat actors are actively attempting to exploit a second bug disclosed in the widely used Log4j logging utility, making it imperative that customers move quickly to install the latest version as a barrage of attacks continues to...

ProxyLogon - PoC Exploit for Microsoft Exchange

PoC Exploit for Microsoft Exchange Launche Original PoC: https://github.com/testanull How to use: python proxylogon.py Example: python proxylogon.py primary [email protected] If successful you will be dropped into a webshell. exit or quit to escape from the webshell or ctrl+c By default, it...

Belkin F9K1122v1 1.00.30 Buffer Overflow / Cross Site Request Forgery

import socket, sys , base64, struct, string, urllib from getopt import getopt as GetOpt, GetoptError from uuid import getnode as getmac import SimpleHTTPServer, SocketServer TIMELINE ''' 3/16/2016 - First Submission to Belkin no response 5/3/2016 - Second Submission to Belkin no response 6/4/2016...

Belkin F9K1122v1 1.00.30 - Buffer Overflow (via Cross-Site Request Forgery)

import socket, sys , base64, struct, string, urllib from getopt import getopt as GetOpt, GetoptError from uuid import getnode as getmac import SimpleHTTPServer, SocketServer TIMELINE ''' 3/16/2016 - First Submission to Belkin no response 5/3/2016 - Second Submission to Belkin no response 6/4/2016...