2621 matches found
velociraptor
Velociraptor - 终端可见性与数据采集工具。 Velociraptor 是一款使用 Velociraptor 查询语言（VQL）查询来收集主机状态信息的工具。 要了解更多关于 Velociraptor 的信息，请阅读文档： https://docs.velociraptor.app/ 快速开始 如果你想了解 Velociraptor 的用途，只需： 1. 从发布页面为你喜欢的平台（Windows/Linux/MacOS）下载二进制文件。 2. 启动 GUI $ velociraptor gui 这将会启动...
mcp-shark
mcp-shark AI 代理工具安全扫描器 — 专为在 IDE 中处理 MCP 的安全与平台工程师构建。 对 MCP IDE 配置 以及嵌入的工具元数据运行本地静态 scan：41 条规则 （包括 AAuth 可见性 ）、毒流启发式分析，以及 SARIF / HTML / JSON 报告。无托管配置扫描后端。 可选添加一个本地 HTTP 代理 ，并附带浏览器内仪表盘 ，使实时流量、发现结果、AAuth 信号和沙盒检查集中在一处，而无需将配置发送给供应商。 你可以 使用流量 进行实时 JSON-RPC 捕获、过滤、导出，以及 AAuth 状态标签 运行本地分析 ，对捕获的流量执行 OWA...
LID
██╗ ██╗██████╗ ██║ ██║██╔══██╗ ██║ ██║██║ ██║ ██║ ██║██║ ██║ ███████╗██║██████╔╝ ╚══════╝╚═╝╚═════╝ Linux 完整性漂移 — "Linux 正在消亡" — 系统发现绕过 LSM 安全保证的内核代码路径 大门从未被攻破，只是被绕过了。 什么是 LID？ Linux 安全模块框架有一个核心保证，已经保持了 20 多年 ： 安全模块只能增加 限制。它们永远不能移除 限制。 这个保证是正确的。LID 并没有打破它。 LID 发现了完全绕过 LSM 钩子的内核代码路径 ——执行安全敏感操作而不咨询...
Imperius
Imperius 让LKM rootkit再次可见。 这涉及从rootkit（例如diamorphine rootkit）中获取"moduleshow"函数的地址，并使用它来调用该函数，将其重新添加到lsmod中，从而能够移除一个LKM rootkit。 我们可以在非常简单的内核中使用/sys/kernel/tracing/availablefilterfunctionsaddrs获取函数地址，但这仅从内核6.5x版本起可用。...
AIOstack
AI 代理看起来总是经过授权。AIOStack 告诉你何时并非如此。 AI 代理代表用户执行操作。它们使用真实凭证、发起真实 API 调用、调用工具、访问 API，并接触生产系统。 大多数安全工具将此类活动视为合法，因为从技术上讲，它确实是合法的。 真正的问题不仅仅是未经授权的访问。 更大的问题是，在运行时，授权访问可能变得不恰当 。 AIOStack 是 Aurva 提供的面向 AI 工作负载的免费社区运行时可见性层。它帮助安全团队和平台团队发现影子 AI、映射代理身份、追踪 LLM 和工具活动，并了解 AI 系统在 Kubernetes 环境中的行为。 无需修改应用代码。无需 SDK...
trivy
📖 Documentation Trivy pronunciation is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets what Trivy can scan: Container Image Filesystem Git Repository remote Virtual Machine Image Kubernetes...
NetAlertX
NetAlertX - 网络可见性与资产智能框架 !mainmain 📷 点击查看更多截图 !Main screenmain| !devicedetails 1devicedetails| !Screen networknetwork ---|---|--- !presencepresence| !maintenancemaintenance| !settingssettings !synchubsynchub| !report1report1| !devicenmapdevicenmap 前往 https://netalertx.com/ 查看更多 gif 和截图 📷。 NetAler...
rakkess
rakkess 审查访问权限 - 一个 kubectl 插件，用于显示服务器资源的访问矩阵 简介 你是否曾想过自己在提供的 Kubernetes 集群上拥有哪些访问权限？ 对于单个资源，你可以使用 kubectl auth can-i list deployments，但也许你正在寻找一个完整的概览？ 这就是 rakkess 的用途。 它会列出当前用户对所有服务器资源的访问权限，类似于 kubectl auth can-i --list。 它还可用于查找哪些主体可以访问某个服务器资源。 请查看子命令 rakkess resource，详见 下文。 演示 示例 显示所有资源的访问权限...
Malcolm
Malcolm Malcolm is a powerful network traffic analysis tool suite designed with the following goals in mind: Easy to use – Malcolm accepts network traffic data in the form of full packet capture PCAP files, Zeek logs, and Suricata alerts. These artifacts can be uploaded via a simple browser-based...
KevinLAB BEMS (Building Energy Management System) - Backdoor Account
KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...
custom-bytecode-analyzer
custom-bytecode-analyzer Java bytecode analyzer customizable via JSON rules. It is a command-line tool that receives a path containing one or more Jar or War files, analyzes them using the provided rules and generates HTML reports with the results. Usage usage: java -jar cba-cli.jar OPTIONS -a...
CVE-2026-97626 Gitea profile feed disclosure bypassing user visibility
Requesting a user or organization profile page GET /username with an Accept: application/rss+xml or Accept: application/atom+xml header returned the owner's activity feed without the visibility check that the profile page and the .rss and .atom routes apply. Anonymous users, restricted users and...
cornershot
What is CornerShot In warfare, CornerShot is a weapon that allows a soldier to look past a corner and possibly take a shot, without risking exposure. Similarly, the CornerShot package allows one to look at a remote host’s network access without the need to have any special privileges on that host...
sysflow
SysFlow: Cloud-native system telemetry pipeline This repository hosts the documentation and issue tracker for all SysFlow projects. Quick reference Documentation : the SysFlow Documentation Where to get help : the SysFlow Community Slack Where to file issues : the github issue tracker Source of...
CVE-2026-79960
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
ModTracer
ModTracer v1.0 ModTracer 查找隐藏的 Linux 内核 Rootkit 并使其再次可见。 另一种使 LKM 可见的方法是使用 imperius 技巧：https://github.com/MatheuZSecurity/Imperius 加入 Rootkit 研究人员小组 https://discord.gg/66N5ZQppU7...
CVE-2026-79960
The Gitea repository management platform contains a vulnerability where pushes authenticated with a deploy key are incorrectly recorded as being performed by the repository owner. This Incorrect Authorization (CWE-863) causes permission checks in the push hook pipeline to evaluate the owner's pri...
CVE-2026-79960 Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...
CVE-2026-79960 Gitea deploy key pushes acting as the repository owner
When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and...