Qu1cksc0pe

Qu1cksc0pe 一站式恶意软件分析工具，可分析多种文件类型，从Windows二进制文件到电子邮件文件。 您可以获取 ： 使用了哪些DLL文件。 函数和API。 节区和段。 URL、IP地址和电子邮件。 Android权限（危险/特殊/信息）。 MITRE ATT&CK映射（Windows + Linux静态分析）。 文件扩展名及其名称。 内嵌的可执行文件/漏洞利用程序。 等等... Qu1cksc0pe旨在获取关于可疑文件的更多信息，并帮助用户了解该文件具备哪些能力。 Qu1cksc0pe当前可分析 文件| 分析类型 ---|--- Windows可执行文件 .exe, .dll,...

LazySign

LazySign 使用 Windows 二进制文件和 bat 文件为二进制文件创建假证书 多年来，已经发布了几种能够窃取或伪造二进制文件签名的酷工具。 然而，所有这些工具都需要额外的依赖项，如 Go、Python 等。 本仓库让你无需任何额外依赖即可进行假签名，所有使用的二进制文件均来自微软自己的开发工具包。 我编写了一个 bat 文件来简化操作。 Invoke-LazySign.ps1 PowerShell 脚本是另一个选项，它既不需要额外的依赖，也不需要额外的二进制文件，只需干净利落的 PowerShell cmdlet。 所以，如果你和我一样懒，只需克隆此仓库，运行 bat 或...

ranger

ranger A tool to support security professionals access and interact with remote Microsoft Windows based systems. This project was conceptualized with the thought process, we did not invent the bow or the arrow, just a more efficient way of using it. Ranger is a command-line driven attack and...

PT-ToolKit

PT-ToolKit Exploits, Scripts PowerShell, Exécutables utiles lors de tests de pénétration ou d'engagement Red Team La plupart des outils et scripts sont destinés à l'environnement Active Directory et à la plateforme Windows Table des matières Exploits PowerShell-Scripts Windows-Binary Exploits :...

Needles at Scale: LLM-Assisted Target Selection for Windows Vulnerability Research

The attack surface of a modern operating system is a haystack: thousands of signed binaries and millions of functions, almost none relevant to any given vulnerability. A human analyst or an LLM agent must pick the function worth reading before analyzing it. At whole-OS scope, this target selectio...

wpsecscan

WPSecScan !testshttps://github.com/bryanflowers/wpsecscan...

CVE-2026-8398

A supply chain attack compromised the official installation packages of DAEMON Tools Lite Windows versions 12.5.0.2421 through 12.5.0.2434, distributed from the legitimate website daemon-tools.cc between approximately April 8, 2026, and May 5, 2026. Attackers gained unauthorized access to the...

Malicious code in 3pool-sushibar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5112bb2ea3570e56be6525c48ef026624f46dead693e78333696273c911c6c42 This package is a dependency-chain dropper. package.json declares 15 undocumented dependencies in three numbered families web3chain02032, rusttool070...

A Decompilation-Driven Framework for Malware Detection with Large Language Models

The parallel evolution of Large Language Models LLMs with advanced code-understanding capabilities and the increasing sophistication of malware presents a new frontier for cybersecurity research. This paper evaluates the efficacy of state-of-the-art LLMs in classifying executable code as either...

CVE-2020-36904 Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint

Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NOLISTEXEPATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration,...

PT-2025-54418

Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO LIST EXE PATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration,...

Selea CarPlateServer 访问控制错误漏洞

Selea CarPlateServer is a car plate recognition software from Selea, Italy. An access control error vulnerability exists in Selea CarPlateServer version 4.0.1.6, which originates from the ability to bypass authentication by manipulating the NOLISTEXEPATH configuration parameter, which could lead ...

EUVD-2019-15105

Malware in sbrugna...

CVE-2019-5530

Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid Authenticode signature...

VTScanner - A Comprehensive Python-based Security Tool For File Scanning, Malware Detection, And Analysis In An Ever-Evolving Cyber Landscape

VTScanner is a versatile Python tool that empowers users to perform comprehensive file scans within a selected directory for malware detection and analysis. It seamlessly integrates with the VirusTotal API to deliver extensive insights into the safety of your files. VTScanner is compatible with...

container-tools:ol8 security, bug fix, and enhancement update

aardvark-dns 2:1.1.0-4 - remove windows binaries and regenerate vendor tarball - Related: 2061390 2:1.1.0-3 - add gating.yaml - Related: 2061390 2:1.1.0-2 - bump Epoch to preserve upgrade path - Related: 2061390 1.1.0-1 - initial import - Related: 2061390 buildah 1:1.27.0-2 - fix CVE-2022-2990 -...

LazySign - Create Fake Certs For Binaries Using Windows Binaries And The Power Of Bat Files

Create fake certs for binaries using windows binaries and the power of bat files Over the years, several cool tools have been released that are capeable of stealing or forging fake signatures for binary files. All of these tools however, have additional dependencies which require Go,python,... Th...

Emulation of Kernel Mode Rootkits With Speakeasy

In August 2020, we released a blog post about how the Speakeasy emulation framework can be used to emulate user mode malware such as shellcode. If you haven’t had a chance, give the post a read today. In addition to user mode emulation, Speakeasy also supports emulation of kernel mode Windows...

NTLMRawUnHide - A Python3 Script Designed To Parse Network Packet Capture Files And Extract NTLMv2 Hashes In A Crackable Format

NTLMRawUnhide.py is a Python3 script designed to parse network packet capture files and extract NTLMv2 hashes in a crackable format. The tool was developed to extract NTLMv2 hashes from files generated by native Windows binaries like NETSH.EXE and PKTMON.EXE without conversion. The following bina...

CVE-2020-13177

The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does not use hard coded paths for certain Windows binaries, which allows an attacker to gain elevated privileges via execution of a malicious binary placed in the...