vhosts-sieve

VHosts Sieve 名前解決できないドメインからバーチャルホストを検索します。 インストール root@kitploit: git clone https://github.com/dariusztytko/vhosts-sieve.git pip3 install -r vhosts-sieve/requirements.txt 使用方法 サブドメインのリストを取得します（例：Amassを使用） root@kitploit: $ amass enum -v -passive -o domains.txt -d example.com -d example-related.com...

vhosts-sieve

VHosts Sieve Searching for virtual hosts among non-resolvable domains. Installation root@kitploit: git clone https://github.com/dariusztytko/vhosts-sieve.git pip3 install -r vhosts-sieve/requirements.txt Usage Get a list of subdomains e.g. using Amass root@kitploit: $ amass enum -v -passive -o...

pe-sieve

はじめに PE-sieve は、システム上で実行されているマルウェアを検出し、さらに分析のために悪意のある可能性のある材料を収集するのに役立つツールです。スキャン対象プロセス内のさまざまなインプラント（置換・インジェクションされたPE、シェルコード、フック、その他のメモリパッチ）を認識し、ダンプします。 インラインフック、Process Hollowing、Process Doppelgänging、Reflective DLL Injection などを検出します。 PE-sieve は、軽量エンジン として設計されており、一度に単一のプロセス をスキャンします。EXE または DLL...

hollows_hunter

hollowshunter Hollows Hunter is a command-line application based on PE-sieve passive memory scanner. Recognizes and dumps a variety of potentially malicious implants replaced/implanted PEs, shellcodes, hooks, in-memory patches. While in case of PE-sieve you can select the process only by its PID,...

mal_unpack

malunpack 基于 PE-sieve 的动态脱壳工具（ 📖 了解更多 ）。 它运行加壳的恶意软件，等待其解出有效载荷，转储该有效载荷，然后终止原始进程。 !CAUTION 此脱壳工具会实际运行原始恶意软件。请仅在虚拟机中使用。 ⚙ 用法 基本用法： root@kitploit: malunpack.exe /exe /timeout 默认情况下，它会转储植入的 PE。 如果要转储 shellcode，请使用选项：/shellc。 如果要转储被修改/挂钩/修补的 PE，请使用选项 /hooks。 如果希望脱壳器在超时时终止，而不是在找到第一个植入物时终止，请使用 /trigger T...

pesieve-go

pesieve-go PE-sieve 的 Golang 绑定。 需要 pe-sieve32.dll、pe-sieve64.dll（受支持版本）位于项目目录中，或位于环境变量 PESIEVEDIR 指向的路径中。 API 为 PE-sieve API 提供以下包装器： root@kitploit: PESieveVersion uint32 func PESieveHelp func PESieveScanpp PEsieveParams PEsieveReport func PESieveScanExpp PEsieveParams, rtype treporttype,...

ida_ifl

IFL - Lista interactiva de funciones Licencia: CC-BY https://creativecommons.org/licenses/by/3.0/ Un pequeño plugin cuyo objetivo es proporcionar una forma fácil de navegar entre funciones y sus referencias. Además, permite importar informes generados por, por ejemplo, PE-sieve en IDA. Soporta:...

[SECURITY] [DLA 4766-1] cyrus-imapd security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4766-1 [email protected] https://www.debian.org/lts/security/ Xavier Guimard September 01, 2026 https://wiki.debian.org/LTS -...

CVE-2026-40013

A flaw was found in Dovecot. An authenticated attacker can submit a specially crafted Sieve script containing an extreme numeric literal to the ManageSieve service. This action triggers an out-of-bounds write during script compilation, leading to memory corruption and a crash of the ManageSieve...

CVE-2026-42007

A flaw was found in Dovecot. An authenticated attacker can use a Sieve script with the editheader extension to trigger a use-after-free vulnerability in the mail editing code. This can lead to memory corruption, potentially crashing the mail delivery process and allowing for arbitrary code...

CVE-2026-52681

A flaw was found in dovecot. An authenticated attacker can bypass the configured Sieve CPU limit by repeatedly changing active scripts. This action prevents proper CPU resource accounting and leaves behind compiled script files, leading to sustained CPU and increased disk consumption. The...

Linux Distros Unpatched Vulnerability : CVE-2026-42007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write...

Linux Distros Unpatched Vulnerability : CVE-2026-40013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve...

Linux Distros Unpatched Vulnerability : CVE-2026-33605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode...

Linux Distros Unpatched Vulnerability : CVE-2026-52681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active...

AZL-98271 CVE-2026-52681 affecting package dovecot 2.3.20-1

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed,...

CVE-2026-52681

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed,...

ALPINE-CVE-2026-52681

Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the accounting by repeatedly changing the active script. Compiled script files are also not removed when a script is deleted or renamed. The configured Sieve CPU limit can be bypassed,...

ALPINE-CVE-2026-42007

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during...

CVE-2026-42007

An attacker that has valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free in the mail editing code, and to write memory contents beyond the intended buffer into the delivered mail. This causes memory leak and opportunity to do memory corruption during...