kraken

Kraken هو ماسح ضوئي بسيط عبر المنصات يعمل مع Yara ويمكن بناؤه لأنظمة Windows وMac وFreeBSD وLinux. وهو مخصص بشكل أساسي للاستجابة للحوادث والبحث والكشف المخصص ليس لحماية نقاط النهاية. فيما يلي الميزات الأساسية: فحص الملفات التنفيذية قيد التشغيل وذاكرة العمليات الجارية باستخدام قواعد Yara المقدمة...

byp4xx

/ / / // / / / / / / / // /| |// |// / // / // / // / / Some cURL options you may use as example: -L follow redirections 30X responses -x : to set a proxy -m to set a timeout -H for new headers. Escape double quotes. -d for data in the POST requests body -... Built-in options: --all Verbose mode...

bt2

bt2: Blaze Telegram Backdoor Toolkit bt2 is a Python-based backdoor in form of a IM bot that uses the infrastructure and the feature-rich bot API provided by Telegram, slightly repurposing its communication platform to act as a C&C. Dependencies Telepot requests Installation $ sudo pip install...

ShuckNT

🔐 ShuckNT : Décortiquez le hash avant d'essayer de le casser | Le script de Shuck.sh ShuckNT est le script du service en ligne Shuck.sh pour une utilisation sur site essayez-le en ligne !. Il est conçu pour rétrograder, convertir, disséquer et décortiquer les jetons d'authentification basés sur l...

DataSurgeon

DataSurgeon v1.2.8 DataSurgeon ds is a versatile tool designed for incident response, DLP, penetration testing, and CTF challenges. It allows for the extraction of various types of sensitive information including emails, phone numbers, hashes, credit cards, URLs, IP addresses, MAC addresses, SRV...

tscopy

TScopy آخر تحديث 2022-03-31 تقديم TScopy من المتطلبات أثناء التعامل مع حادث أمني Incident Response - IR القدرة على تحليل الملفات الموجودة في نظام الملفات. أحيانًا تكون هذه الملفات مقفلة من قبل نظام التشغيل OS لأنها قيد الاستخدام، وهذا مزعج بشكل خاص مع سجلات الأحداث وخلايا التسجيل. تتيح TScopy...

tscopy

TScopy Updated 2022-03-31 Introducing TScopy It is a requirement during an Incident Response IR engagement to have the ability to analyze files on the filesystem. Sometimes these files are locked by the operating system OS because they are in use, which is particularly frustrating with event logs...

EUVD-2026-95926

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107833

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains an unbounded recursion vulnerability in the ProcessResponse function located in internal/bodyprocessors/json.go. The root cause is that the ignoreJSONRecursionLimit value of -1 is passed to readJSON, while the recursive guard o...

CVE-2026-75597

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

CVE-2022-44877

CVE-2022-44877 نظرة عامة يُستخدم هذا السكريبت بلغة Bash لاختبار قابلية استهداف خوادم الويب لثغرة CVE-2022-44877. يقوم السكريبت بإرسال طلب curl إلى عنوان URL مستهدف مع حمولة مشفرة بـ base64. إذا كان الهدف عرضة للثغرة CVE-2022-44877، فسيكون الوقت المنقضي لطلب curl أكبر من 3.5 ثانية. التثبيت sudo...

Trawler

Dredging Windows for Persistence What is it? Trawler is a PowerShell script designed to help Incident Responders discover potential indicators of compromise on Windows hosts, primarily focused on persistence mechanisms including Scheduled Tasks, Services, Registry Modifications, Startup Items,...

YAMA-dev

YAMA Yet Another Memory Analyzer for malware detection Concept YAMA is a system for generating scanner that can inspect specific malware during incident response. The scanner generated by YAMA is designed to explore the memory of Windows OS and detect malware. With the increasing prevalence of...

CVE-2026-66753-HTTP-Header-Injection-via-Unvalidated-CR-and-LF-in-Header-Values-tiny_http-

Avis de sécurité : injection d'en-tête HTTP via les CR et LF non validés dans les valeurs d'en-tête tinyhttp Identifiant CVE attribué : CVE-2026-66753 Résumé tinyhttp ne rejette pas les retours chariot ni les sauts de ligne dans les valeurs d'en-tête HTTP, dans les deux sens. Côté requête,...

IRTriage

Incident Response Triage: Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael'...

nuubi

Nuubi Tools Scanner, Recon. Details Options: -h/--help | Show help message and exit Arguments: -b/--banner | Banner grabing of target ip address -s/--subnet | Subnetlookup of target -c/--cms | Cms detect with headers -d/--dns | Dnslookup of target domain -e/--extract | Extract links from target...

aftermath

About Aftermath is a Swift-based, open-source incident response framework. Aftermath can be leveraged by defenders in order to collect and subsequently analyze the data from the compromised host. Aftermath can be deployed from an MDM ideally, but it can also run independently from the infected...

aftermath

حول الأداة Aftermath هي إطار عمل مفتوح المصدر للاستجابة للحوادث مبني على لغة Swift. يمكن للمدافعين الاستفادة من Aftermath لجمع وتحليل البيانات من المضيف المخترق. يمكن نشر Aftermath عبر MDM من الناحية المثالية، ولكن يمكن أيضاً تشغيلها بشكل مستقل من سطر أوامر المستخدم المخترق. تقوم Aftermath أولاً...

aiiroverlay

Pourquoi une surcouche, et non un remplacement. La thèse. Fait partie du framework AI IR Overlay™. VoirCONTENTMAP.md pour la carte complète du dépôt. L'AI IR Overlay : Aperçu du framework Version actuelle : v0.35.0 · 2026-07-09 · CHANGELOG Une base de référence pratique de réponse aux incidents...