880 matches found
Judge-Jury-and-Executable
法官、陪审团与执行者 一款威胁狩猎取证工具 特性： 立即扫描挂载的文件系统以发现威胁 或在事件发生前收集系统基线，以获得额外的威胁狩猎能力 可在事件发生前、发生中或发生后使用 适用于单台到多台工作站 扫描 MFT，绕过文件权限、文件锁定或操作系统文件保护/隐藏/阴影 为每个文件收集多达 51 个不同属性 扫描结果存入 SQL 表，便于后续搜索、跨多次扫描和/或多台机器聚合结果，以及进行历史或回溯分析 利用 SQL 的强大功能搜索文件系统、查询文件属性、回答复杂或高层级问题，并狩猎威胁或入侵指标 要求： .NET Framework v4.8 Microsoft Visual C++ 20...
cloudquery
CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...
msdat
Quentin HARDY --- [email protected] [email protected] MSDAT MSDAT M icros oft SQL D atabase A ttacking T ool is an open source penetration testing tool that tests the security of Microsoft SQL Databases remotely. Usage examples of MSDAT: You have a Microsoft database listening remotely...
WebGoat.NET
Webgoat.NET 源代码：https://github.com/jerryhoff/WebGoat.NET 下载 zip：https://github.com/jerryhoff/WebGoat.NET/zipball/master 该 Web 应用程序是一个学习平台，旨在教授 常见的 Web 安全缺陷。它包含适用于大多数 Web 应用程序的 通用安全缺陷，还包含专门针对 .NET 框架的 课程。此应用中的练习旨在传授关于 Web 安全攻击以及开发人员如何克服这些攻击的知识。 警告：此 Web 应用程序含有大量安全漏洞， 运行时会令您的计算机变得极不安全！...
BSQLinjector
BSQLinjector BSQLinjector 使用盲注方法从 SQL 数据库中检索数据。 我建议使用 "--test" 开关，以便在实际发送请求前清晰地查看配置后的 payload 样式。 选项： root@kitploit: --file Mandatory - File containing valid HTTP request and SQL injection point SQLINJECT. --file=/tmp/req.txt --pattern Mandatory - Pattern to look for when query is true...
jackdaw
jackdaw 收集 收集 收集 这是什么？ Jackdaw 旨在收集你域中的所有信息，将其存储到 SQL 数据库中，并以精美的图形展示域对象之间的交互关系，以及潜在攻击者可能如何利用这些交互。 它还附带一个便利的功能，可帮你处理密码破解项目：存储/查找/报告哈希/密码/用户。 快速使用信息 如果不使用自动收集（例如不在 Windows 上），你需要通过 dbinit 创建一个初始空数据库 首先你需要执行 enum。在 Windows 上可以双击可执行文件或输入 jackdaw.exe auto 自动完成。 其次你需要运行 nest 来启动 Web 界面。默认情况下，它提供在...
jackdaw
jackdaw gather gather gather What is this? Jackdaw is here to collect all information in your domain, store it in a SQL database and show you nice graphs on how your domain objects interact with each-other an how a potential attacker may exploit these interactions. It also comes with a handy...
Reproduce-CVE-2024-21513
复现 CVE-2024-21513 概述 本项目演示了 langchain-experimental 包中的漏洞 CVE-2024-21513，该漏洞影响版本 =0.0.15 且 0.0.21。由于对检索到的所有值使用了 eval，VectorSQLDatabaseChain 组件在从数据库检索值时允许任意代码执行。 复现漏洞的工作流程 该应用程序允许你通过与电影相关的 SQL 数据库（包含 ID、标题、导演、年份、评分）进行对话。 使用 langchain 的 SQLDatabase 工具连接到 PostgreSQL 数据库。 利用 OpenAI 的 GPT 模型生成 SQL 查询。 ...
securitybot
Securitybot Distributed alerting for the masses! Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber's blog post. Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster...
CVE-2026-91934
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...
CVE-2026-91934
Flowise versions before 3.1.4 are affected by an insufficient path validation vulnerability in the SQL Database Chain node when connecting to SQLite databases. The flaw allows authenticated attackers to write arbitrary files to the filesystem by crafting file paths in SQLite connection parameters...
EUVD-2026-78792
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...
CVE-2026-91934 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...
CVE-2026-91934 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...
CVE-2026-91934 Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...
PT-2026-92054
Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execut...
CVE-2026-69502
Server-side request forgery ssrf in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-69502
CVE-2026-69502 is a server-side request forgery (SSRF) vulnerability in Azure SQL Database that allows an unauthorized, network-based attacker to elevate privileges . The CNA-assigned CVSS 3.1 score is 10.0 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating no privileges ...