6543 matches found
The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
Hunting-Queries-Detection-Rules
KQL Sentinel & Defender クエリ KQL for Defender XDR, Microsoft Sentinel & その他の Microsoft ソリューション...
massdns
MassDNS A high-performance DNS stub resolver MassDNS is a simple high-performance DNS stub resolver targeting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per...
cleanldap
CleanLdap AD WS 上でステルスLDAPクエリを実行するBOF 引数 本題に入ります。引数とその意味は以下の通りです： root@kitploit: Z: DC Hostname "dc01.example.com" Z: LDAP query "objectClass=" Z: Comma separated list of LDAP attributes "samaccountname,distinguishedName,cn" - if empty, collect all Z: Base DN "DC=example,DC=com" - if empty parse...
shodan-dorks
Shodan dorks Description: This GitHub repository provides a range of search queries, known as "dorks," for Shodan, a powerful tool used to search for Internet-connected devices. The dorks are designed to help security researchers discover potential vulnerabilities and configuration issues in...
querytool
QUERYTOOL - Google Sheet designed for OSINT About QueryTool is a specialized OSINT framework integrated within Google Sheets, aimed at simplifying the process of generating queries for various search engines to obtain specific results. Designed as an initial step in reconnaissance, QueryTool...
securitylab
GitHub Security Lab 这是 GitHub Security Lab 的主要 Git 仓库。 我们将其用于以下主要目的： 在我们的 docs 中与社区分享关于安全研究和漏洞披露的最佳实践。 我们使用 此仓库的 issues 来跟踪 CodeQL 赏金请求。 我们用它来发布一些概念验证漏洞利用（在漏洞修复后）。这些 PoC 可以在 SecurityExploits 子目录中找到。 CodeQL 查询示例，可以在 CodeQLQueries 子目录中找到。 CodeQL 资源 这部分是你们的！ 你想与社区分享一个很酷的 CodeQL...
ghauri
Like Ghauri, consider supporting the developer...
CVE-2024-4577
CVE-2024-4577 FOFA 検索： header="Xamppsinfo" || body="/xampps.jpg" || header="location http" && header="xampp" || body="content="Kai Oswald Seidler" || title="XAMPP for" || title="XAMPP Version" || body="font-size: 1.2em; color: red;"New XAMPP" Censys 検索：...
dnsx
A fast and multi-purpose DNS toolkit designed for running DNS queries Features • Installation • Usage • Running dnsx • Wildcard • Notes • Join Discord dnsx is a fast and multi-purpose DNS toolkit designed for running various probes through the retryabledns library. It supports multiple DNS querie...
dnsx
一个快速且多功能的DNS工具包，专为执行DNS查询而设计 功能特点 • 安装 • 使用方法 • 运行 dnsx • 通配符 • 注意事项 • 加入Discord dnsx 是一个快速且多功能的DNS工具包，专为通过 retryabledns 库执行各种探测而设计。它支持多种DNS查询、用户提供的解析器、以及类似 shuffledns 的DNS通配符过滤等功能。 功能特点 简单便捷的DNS记录查询工具。 支持查询 A, AAAA, CNAME, PTR, NS, MX, TXT, SRV, SOA 记录 支持DNS 解析 / 暴力破解 支持自定义 解析器 输入 支持多种解析器格式...
instarecon
InstaRecon 自動化された基本的なデジタル偵察。ターゲットの初期フットプリントを取得し、追加のサブドメインを発見するのに最適です。InstaReconは以下を実行します: DNSルックアップ A, PTR, MX, NS 発見されたすべてのホストに対して再帰的にDNSルックアップ Whois ドメインおよびIP ルックアップ サブドメインとURLを探すGoogle dork Shodan ルックアップ 全体のCIDRに対する逆DNSルックアップ ターゲットがネットワークの場合のみ ...すべてコンソールまたはCSVファイルにきれいに出力されます。...
cypherhound
CypherHound 一款Python3终端应用程序，包含用于BloodHound数据集的Neo4j Cypher查询，并附带一个脚本，可自动将这些查询导入BloodHound CE。 输出样例 终端 HTML报表 HTML报表（续） 为什么？ BloodHound 是每位渗透测试人员的必备工具。然而，它的设计也带来了一些负面影响。以下是我遇到的最棘手的痛点，以及本工具旨在解决的问题： 1. 我的工具以列表形式思考 – 在我的工具能解析导出的JSON图之前，我需要将图结果以逐行格式的.txt文件呈现， 才能从其他工具中实际攻击目标 。 2. 复制/粘贴图结果 – 这延续了第一点，但...
graphql-cop
GraphQL Cop - Security Audit Utility for GraphQL About GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. GraphQL Cop is perfect for running CI/CD checks in GraphQL. It is lightweight, and covers interesting security issues in GraphQL. GraphQL Cop allows you ...
Threat-Hunting
脅威ハンティング | 検知エンジニアリング 以下のための脅威ハンティング および検知クエリ のコレクション: CrowdStrike Falcon CQL – CrowdStrike Query Language を使用 Microsoft Defender XDR KQL – Kusto Query Language を使用 不審なプロセス、異常なネットワーク動作、LOLBins Living-off-the-Land バイナリ、永続化メカニズム、資格情報アクセス、横移動、C2活動、および潜在的なAPT 行動を発見することを目的としています。可能な限りMITRE ATT...
graphw00f
Credits to Nick Aleks for the logo! graphw00f - GraphQL Server Fingerprinting Table of Contents How does it work? Detections GraphQL Threat Matrix Prerequisites Installation Configuration Example Usage Fingerprinting GraphQL Detecting & Fingerprinting GraphQL Support & Issues Resources How does i...
AD_Miner
AD Miner is an Active Directory on-premise and Entra ID auditing tool that: Leverages Cypher queries to analyze data from the BloodHound graph database Neo4j. Provides a comprehensive overview of existing weaknesses through a static, web-based report. Web-based reports features: Detailed listings...
Blinder
Blinder Blidner is a small python library to automate time-based blind SQL injection by using a pre defined queries as a functions to automate a rapid PoC development. Installation You can install Blinder using the following command: pip install blinder Or by downloading the source and importing ...
velociraptor
Velociraptor - Endpoint visibility and collection tool. Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language VQL queries. To learn more about Velociraptor, read the documentation on: https://docs.velociraptor.app/ Quick start If you want to see...