c2-cloud

About The Project The C2 Cloud is a robust web-based C2 framework, designed to simplify the life of penetration testers. It allows easy access to compromised backdoors, just like accessing an EC2 instance in the AWS cloud. It can manage several simultaneous backdoor sessions with a user-friendly...

Villain

Villain 目的 Villain は、複数のリバース TCP および HoaxShell ベースのシェルを処理し、追加機能（コマンド、ユーティリティ）で機能を強化し、接続された兄弟サーバー（異なるマシンで動作する Villain インスタンス）間でそれらを共有できる、高水準の Stage 0/1 C2 フレームワークです。 フレームワークの主な機能は次のとおりです。 デフォルト、カスタマイズ可能、および/またはユーザー定義のペイロードテンプレートに基づくペイロード生成（Windows & Linux） セッション間を素早く切り替えられる動的に動作する疑似シェルプロンプト...

Kitsune

Kitsune Kitsune はポリモーフィックなCommand & Controlです。このツールを使用すると、NetExec、Villain、Evil-WinRMなど、お気に入りのハッキングツールのグラフィカルバージョンを入手できます。さらに、自動再接続、レポート、履歴、および実装された各ツールの追加機能など、多くの改善が含まれています。 その使い方は、Cobalt...

WordPress Ultimate Nofollow plugin <= 1.4.8 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Quentin VILLAIN 3wsec in WordPress Ultimate Nofollow plugin versions = 1.4.8. Solution Deactivate and delete. This plugin has been closed as of November 3, 2021 and is not available for download. This closure is temporary, pending a full...

WordPress Batch Cat plugin <= 0.3 - Arbitrary Categories Add/Set/Delete to Posts vulnerability

Arbitrary Categories Add/Set/Delete to Posts vulnerability discovered by Quentin VILLAIN 3wsec in WordPress Batch Cat plugin versions = 0.3. Solution Deactivate and delete. This plugin has been closed as of September 24, 2021 and is not available for download. This closure is temporary, pending a...

Urban Dictionary: DOM XSS through ads

Multiple ads hosted on www.urbandictionary.com make the www.urbandictionary.com origin vulnerable to DOM XSS. Attached is an image of alertdocument.domain executing. The injection works in Firefox and Chrome. Visiting the following URL will probably cause an alert box displaying the document.doma...

Firefox Enables DNS over HTTPS

This is good news: Whenever you visit a website -- even if it's HTTPS enabled -- the DNS query that converts the web address into an IP address that computers can read is usually unencrypted. DNS-over-HTTPS, or DoH, encrypts the request so that it can't be intercepted or hijacked in order to send...

Space Villain Voice Changer - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Space Villain Voice Changer published at the 'play' market has multiple vulnerabilities...