secretive

Secretive Secretive는 Secure Enclave로 SSH 키를 보호하고 관리하는 앱입니다. 왜? 더 안전한 저장 SSH 키의 가장 일반적인 설정은 디스크에 저장하고 적절한 권한으로 보호하는 것입니다. 대부분의 경우 문제가 없지만 악의적인 사용자나 맬웨어가 개인 키를 복사하는 것은 그리 어렵지 않습니다. Secure Enclave로 키를 보호하면 설계상 내보낼 수 없습니다. 접근 제어 Mac에 Secure Enclave가 있으면 Touch ID 또는 Apple Watch 인증과 같은 강력한 접근 제어도 지원합니다...

CVE-2023-34039

CVE-2023-34039 CVE-2023-34039 VMWare Aria Operations for Networks vRealize Network Insight 정적 SSH 키 RCE를 위한 POC 기술 분석 취약점에 대한 근본 원인 분석은 제 블로그에서 확인할 수 있습니다: https://summoning.team/blog/vmware-vrealize-network-insight-rce-cve-2023-34039/ 요약 VMWare Aria Operations for Networks vRealize Network Insig...

punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

trommel

TROMMEL TROMMEL은 임베디드 장치 파일을 훑어 잠재적 취약점 지표를 식별합니다. TROMMEL은 다음 지표들을 식별합니다: Secure Shell SSH 키 파일 Secure Socket Layer SSL 키 파일 Internet Protocol IP 주소 Uniform Resource Locator URL 이메일 주소 셸 스크립트 웹 서버 바이너리 설정 파일 데이터베이스 파일 특정 바이너리 파일 예: Dropbear, BusyBox 등 공유 객체 라이브러리 파일 웹 애플리케이션 스크립팅 변수 및 Android...

Mlflow <2.9.2 - Path Traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6909 info: name: Mlflow 2.9.2 - Path Traversal author: Hyunsoo-ds severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Successful...

CVE-2020-12116

CVE-2020-12116 CVE-2020-12116 취약점을 악용하기 위한 개념 증명 코드: ManageEngine OpManager에서의 인증되지 않은 임의 파일 읽기. 요약 OpManager의 최신 릴리스에는 디렉터리 트래버설 취약점이 포함되어 있어 OpManager 애플리케이션의 모든 파일에 대한 무제한 액세스를 허용합니다. 여기에는 개인 SSH 키, 비밀번호로 보호된 Java 키스토어, 키스토어, 개인 인증서 및 백엔드 데이터베이스의 비밀번호를 포함하는 구성 파일이 포함됩니다. LDAP가 구성된 경우...

CVE-2026-82929 Use of Shared Cryptographic Key in mH-DEVELOPER

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...

CVE-2026-82929

The mH-DEVELOPER smart home module is vulnerable because it uses identical hard-coded SSH host keys across all devices instead of generating unique per-device keys. An attacker capable of extracting these keys from the firmware can deploy a rogue SSH server that clients will trust automatically. ...

secretive v4.0.0

Secretive Secretive is an app for protecting and managing SSH keys with the Secure Enclave. Why? Safer Storage The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy...

brutus v1.15.0

Brutus "Et tu, Brute?" — The last words before credentials fall. Modern credential testing tool in pure Go Installation • Quick Start • Pipeline • Protocols • Enumeration • Proxy • Library Overview Brutus is a multi-protocol authentication testing tool designed to address a critical gap in...

CVE-2026-73678

CVE-2026-73678 enables unauthenticated remote code execution in MindsDB Minds Platform

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it...

Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

MAL-2026-13775 Malicious code in permit2 (npm)

permit2 is a malicious npm package that squats the bare name of Uniswap's Permit2 token-approval system whose legitimate npm distribution is the scoped @uniswap/permit2-sdk, advertising itself as a "smart contract development toolkit." The package contains no real functionality — the published...

Malicious code in tokocrytodev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6 On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from...

MAL-2026-13628 Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...

MAL-2026-13519 Malicious code in streak-kit-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3 The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any...

MAL-2026-13372 Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

MAL-2026-13362 Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in streak-math-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f98537ccfd6214a3970375d9c210e83853153b35b19193b4b1850fe6450ed4f The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spawns it detached with piped...