BlueTeam-Tools

BlueTeam-Tools 이 GitHub 저장소는 블루팀 활동 에 유용할 수 있는 70개 이상의 도구 와 리소스 모음을 포함하고 있습니다. 일부 도구는 블루팀을 위해 특별히 설계되었으며, 다른 도구는 더 일반적인 용도로 블루팀 맥락에서 사용하도록 조정될 수 있습니다. 🔗 레드팀이라면 RedTeam-Tools를 확인해보세요. 경고 이 저장소의 자료는 정보 제공 및 교육 목적으로만 제공됩니다. 불법 활동에 사용하기 위한 것이 아닙니다. 참고 화살표로 도구 목록 제목을 숨길 수 있습니다. 🔙을 클릭하면 목록으로 돌아갑니다. 도구 ...

windows-api-function-cheatsheets

Windows API 関数チートシート 連絡先 🌨️ Tetsuo: https://www.x.com/tetsuo 目次 Windows API 関数チートシート ファイル操作 プロセス管理 メモリ管理 スレッド管理 ダイナミックリンクライブラリ DLL 管理 同期 プロセス間通信 Windows フック 暗号化 デバッグ Winsock レジストリ操作 エラー処理 リソース管理 Unicode 文字列関数 文字列長 文字列コピー 文字列連結 文字列比較 文字列検索 文字の分類と変換 Win32 構造体チートシート 一般的な構造体 Win32 ソケット構造体チートシート...

bypass-url-parser

Bypass Url Parser Tool that tests MANY url bypasses to reach a 40X protected page. If you wonder why this code is nothing but a dirty curl wrapper, here's why: Most of the python requests do url/path/parameter encoding/decoding, and I hate this. If I submit raw chars, I want raw chars to be sent...

CVE-2024-3495-Poc

CVE-2024-3495-Poc CVE-2024-3495 Country State City Dropdown CF7 Accept-Encoding: gzip, deflate Accept: / Accept-Language: en-US;q=0.9,en;q=0.8 User-Agent: Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36 KHTML, like Gecko Chrome/108.0.5359.125 Safari/537.36 Connection: close...

evilqr

Evil QR Toolkit demonstrating another approach of a QRLJacking attack, allowing to perform remote account takeover, through sign-in QR code phishing. It consists of a browser extension used by the attacker to extract the sign-in QR code and a server application, which retrieves the sign-in QR cod...

PMD

実践的マルウェア開発 演習 1 - 環境セットアップ 1. ハイパーバイザー内に Windows 仮想マシンをセットアップします。 a. ベースインストールのスナップショットを必ず取得してください。 2. Visual Studio 2022 をダウンロードしてインストールします - https://visualstudio.microsoft.com/vs/ a. インストール時に Desktop development with C++ ワークロードを選択します 3. 以下をダウンロードしてインストールします: DebugView++ -...

CVE-2026-14855

The RT Mega Menu WordPress plugin (all versions up to and including 1.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) through the css[left] parameter, processed via the rtmega_update_menu_options AJAX action. The root cause is insufficient input sanitization and output escaping . Authent...

CVE-2026-92991

The Biggopti Library , a JavaScript component embedded in multiple WordPress plugins (including Ultimate Post Kit , Ultimate Store Kit , Smart Admin Assistant , Live Copy Paste , BDThemes Prime Slider Lite , BDThemes Element Pack Lite , and Pixel Gallery ), is vulnerable to Cross-Site Scripting (...

CVE-2026-92991 Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘displayid’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that wil...

EUVD-2026-82644

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

EUVD-2026-82645

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘displayid’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that wil...

CVE-2026-14855 RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

dcshadow

!WARNING 本番環境では実行しないでください。これはラボテスト用であり、ブルーチームが IoC、イベントタイプ、および挙動を特定するためのものです。 また、このツールは現状のまま提供されます。あなたが作成したいプルリクエストに対する標準的なレビュー以外のサポートは予定されていません。 Windows ホストから実行しないでください。Linux、または VM（RPC サービスの競合を避けるため）から実行してください。 理論 このプロジェクトは、Mimikatz の dcshadow テクニックの純粋な Python による代替を意図しています。これには、変更された...

halo-record

halo-record Tamper-evident audit trails for AI agents — hash-chained Runtime Records, rendered as a Runtime Report your customers can check themselves. Every action your agent takes tool calls, model calls, data access, approvals becomes one Runtime Record in an append-only, hash-chained log; the...

Sharpmad

Sharpmad Powermad의 C 버전 아직 완성되지 않았으며 완전히 테스트되지 않았습니다. 또한 다음 기능이 누락되었습니다: Invoke-DNSUpdate Get-KerberosAESKey 임시 Readme ADIDNS 모듈 Sharpmad.exe ADIDNS -Action new -Node test 액션| 설명 ---|--- AddACE| 노드에 ACE 추가 Disable| 노드를 툼스톤 처리 GetDACL| 노드 또는 영역 DACL 가져오기 GetOwner| 노드 소유자 가져오기 GetAttribute| 노드 속성 값...

CVE-2026-82982

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and...

punk.py

punk.py unix SSH post-exploitation 1337 tool how it works punk.py is a post-exploitation tool meant to help network pivoting from a compromised unix box. It collect usernames, ssh keys and known hosts from a unix system, then it tries to connect via ssh to all the combinations found. punk.py is...

censys-subdomain-finder

Censys subdomain finder Important note : As of late 2024, Censys does not provide API access to free accounts anymore. This is a tool to enumerate subdomains using the Certificate Transparency logs stored in Censys Search. It should return any subdomain who has ever been issued a SSL certificate ...

tfsec

📣 tfsec에서 Trivy로 마이그레이션 모든 사람을 위한 포괄적인 오픈 소스 보안 솔루션을 제공하려는 목표의 일환으로, 우리는 모든 스캐닝 관련 노력을 Trivy로 통합하고 있습니다. 지난 1년 동안 tfsec은 Trivy의 IaC 및 잘못된 구성 스캐닝 기능의 기반을 마련했으며, Terraform 스캐닝은 이미 오랫동안 Trivy에서 기본적으로 지원되었습니다. 앞으로 우리는 tfsec 커뮤니티가 Trivy로 전환하기를 권장합니다. Trivy로 이동하면 동일한 우수한 Terraform 스캐닝 엔진을 사용하면서 다음과 같은 ...

Advanced Responsive Video Embedder 10.8.7/10.8.8 - Hardcoded Backdoor Authentication Bypass

The compromised Advanced Responsive Video Embedder WordPress plugin releases 10.8.7 and 10.8.8 accept a hardcoded token through the wplogin parameter and establish an authenticated administrator session before normal authentication. A single unauthenticated GET request triggers the backdoor. This...