Network Infrastructure Penetration Testing: SPARTA

SPARTA is a python GUI application which simplifies network infrastructure penetration testing by aiding the penetration tester in the scanning and enumeration phase. It allows the tester to save time by having point-and-click access to his toolkit and by displaying all tool output in a convenien...

DBC2 (DropboxC2) - A Modular Post-Exploitation Tool, Composed Of An Agent Running On The Victim'S Machine

DBC2 DropboxC2 is a modular post-exploitation tool, composed of an agent running on the victim's machine, a controler, running on any machine, powershell modules, and Dropbox servers as a means of communication. This project was initially inspired by the fantastic Empire framework, but also as an...

sAINT - A Spyware Generator for Windows systems written in Java

sAINT is a Spyware Generator for Windows systems written in Java. Features Keylogger Take Screenshot Webcam Capture Persistence Tested On KaliLinux - ROLLING EDITION How To Use Install dependencies you need Maven and JDK 8 package installed $ apt install maven default-jdk default-jre openjdk-8-jd...

Firefox 57 "Quantum" Released – 2x Faster Web Browser

It is time to give Firefox another chance. The Mozilla Foundation today announced the release of its much awaited Firefox 57, aka Quantum web browser for Windows, Mac, and Linux, which claims to defeat Google's Chrome. It is fast. Really fast. Firefox 57 is based on an entirely revamped design an...

CVE-2017-5082

Failure to take advantage of available mitigations in credit card autofill in Google Chrome prior to 59.0.3071.92 for Android allowed a local attacker to take screen shots of credit card information via a crafted HTML page...

CVE-2017-7139

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Phone" component. It allows attackers to obtain sensitive information by leveraging a timing bug to read a secure-content screenshot that occurred during a locking action...

CVE-2017-7139

An issue was discovered in certain Apple products. iOS before 11 is affected. The issue involves the "Phone" component. It allows attackers to obtain sensitive information by leveraging a timing bug to read a secure-content screenshot that occurred during a locking action...

The Next Generation Of Genealogy Sitebuilding SQL Injection

========================================================================================== The Next Generation of Genealogy Sitebuilding SQL Injection Vulnerability ==========================================================================================...

More mainstream version control system was traced to the presence of the client arbitrary code execution vulnerability-vulnerability warning-the black bar safety net

Around the world programmers Please Note, You must now immediately updates your version control system, Git, SVN, Mercurial open-source version control system recently to fix critical security vulnerabilities, the delay in the upgrade, you will be affected by the vulnerability. More mainstream...

ImageMagick Denial of Service Vulnerability (CNVD-2017-18102)

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. A denial of service vulnerability exists in the 'ReadSCREENSHOTImage' function in the coders/screenshot.c file in...

DNS Reconnaissance: AQUATONE

DNS Reconnaissance AQUATONE is a set of tools for performing reconnaissance on domain names. It can discover subdomains on a given domain by using open sources as well as the more common subdomain dictionary brute force approach. After subdomain discovery, AQUATONE can then scan the hosts for...

DATA - Credential Phish Analysis and Automation

Credential Phish Analysis and Automation BUCKLEGRIPPER py Given a suspected phishing url or file of line separated urls, visit, screenshot, and scrape for interesting files. Requirements can be installed by running or reviewing installbucklegripperdeps.sh usage: bucklegripper.py -h -u URL -s SOUR...

Harvest: [platform.harvestapp.com] Reflected XSS in Error Message via URL parameters

Hi @jorgeleria, I came across a potential reflected XSS vector while exploring platform.harvestapp.com functionality. At present, I have been unable to locate a functional payload, so would like to report this as HTML injection. Proof of Concept Steps to reproduce 1. Visit the below Demonstration...

Stealthy Konni RAT Targeting North Korea Since 2014

Two recent espionage campaigns against political and strategic targets in North Korea has been linked to malware that has stayed hidden for the better part of three years. Cisco’s research arm Talos published a report yesterday on the malware it calls Konni. Two attacks in April used phishing...

WordPress: Reflected XSS at https://da.wordpress.org/themes/?s= via "s=" parameter

Hello - You have a reflected XSS vulnerability located at this domain: https://da.wordpress.org/themes/?s= This was tested on the latest version of Chrome Version 57.0.2987.133 64-bit By entering this payload in the URL, you are able to execute a script to fire:...

Huawei P6 Elevation of Privilege Vulnerability

The Huawei P6 is a smartphone from the Chinese company Huawei Huawei.The EDGE-U00, EDGE-T00 and EDGE-C00 are among the versions... The Huawei P6 suffers from an elevation of privilege vulnerability. An attacker can exploit the vulnerability to perform a screenshot operation, resulting in the...

CVE-2016-5059

CVE-2016-5059 involves OSRAM SYLVANIA Osram Lightify Home. The CNVD entry (CNVD-2017-12298) describes it as a vulnerability in versions up to 2016-07-26 where the application fails to implement SSL pinning, enabling a man-in-the-middle attacker to intercept SSL/TLS traffic from the affected syste...

Kaspersky: In App purchase Hack

I have downloaded kaspersky internet security from the playstore and it asks for free version or trial version and i have given trial version then i got 7 days free pack,After that i used with the help of lucky patcher and freedom app i can able to byepass without money i can able to purchase 365...

Car Workshop System - SQL Injection

Car Workshop System - SQL Injection Car Workshop System, the presence of the parameter filter is not strict, leading to a sql injection vulnerability, if the other server is turned on the error display, can be directly used Google Dork: N/A Injection point:...

Joomla! Component Simple Membership 3.3.3 - 'userId' Parameter SQL Injection

Joomla! Component Simple Membership 3.3.3 - the 'userId' Parameter SQL Injection Joomla! Component Simple Membership 3.3.3, the presence of the parameter filter is not strict, leading to a sql injection vulnerability, if the other server is turned on the error display, can directly use, if you tu...