Damn-Vulnerable-Android-Components

The Damne Vulnerable Android Components - DVAC The sieve reborn! Damn Vulnerable Android Components DVAC is an educational Android application intentionally designed to expose and demonstrate vulnerabilities related to various Android components such as Activities, Intents, Content Providers, and...

scorecard

OpenSSF Scorecard...

spybrowse

BrowseSpy Be sure to change the ftp variables throughout the code, these variables contain the username, password, & IP address of the FTP server which receives the files. This code will do the following: 1. Copy itself into the %TMP% directory & name itself ursakta.exe 2. Add a registry entry to...

tweets_analyzer

Simple Twitter Profile Analyzer The goal of this simple python script is to analyze a Twitter profile through its tweets by detecting: Average tweet activity, by hour and by day of the week Timezone and language set for the Twitter interface Sources used mobile application, web browser,...

Hooketh

Hooketh A set of scripts that ease working with Frida, tailored to help finding the correct function to hook to and then modify it. Usage For both of the scripts, I assume you have a device connected via USB or have an emulator running on the same machine. Install frida on your machine and ensure...

simplewall

simplewall Definitely for advanced users. Description: Simple tool to configure Windows Filtering Platform WFP which can configure network activity on your computer. The lightweight application is less than a megabyte, and it is compatible with Windows 7 SP1 and higher operating systems. You can...

kmon

Linux Kernel Manager and Activity Monitor 🐧💻...

getsubdomain

getsubdomain Get subdomain list and check whether they are active or not by each response code. Using API by c99.nl Installation root@kitploit: ▶ go install github.com/abaykan/getsubdomain@latest Put your APIKEY in /.config/c99.txt: root@kitploit: ▶ echo "" /.config/c99.txt Usage Single Domain...

SteppingStones

Stepping Stones Purpose A hub for Red Team activity to aid in record keeping, situational awareness and reporting. Stepping Stones provides a web based UI for the team to log activity and generate report snippets. The UI is intended to be rapid enough to be used throughout the engagement, not jus...

Sigma-Rule-for-CVE-2021-22005-scanning-activity

此存储库没有 README。...

Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...

LogDash Activity Log <= 1.1.3 - SQL Injection

The LogDash Activity Log plugin for WordPress is vulnerable to SQL Injection via the username parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2023-4281

CVE编号: CVE-2023-4281 漏洞类型: IP地址欺骗 描述: Activity Log 插件从潜在不可信的头部中获取客户端 IP 地址，攻击者可操纵其值。这可能被用于隐藏恶意流量的来源。 复现步骤: root@kitploit: Run the following code in the web browser and note on the backend that the IP address has been faked. await fetch"/wp-login.php", "headers": "content-type":...

octosuite

Terminal-based toolkit for GitHub data analysis. root@kitploit: $ octosuite user torvalds root@kitploit: from pprint import pprint import octosuite user = octosuite.Username="torvalds" exists, profile = user.exists if exists: pprintprofile Installation root@kitploit: pip install octosuite Usage T...

detections

detections Este es un repositorio de información que podría ser útil para detectar actividad maliciosa en tu entorno. No es exhaustivo y úsalo bajo tu propio riesgo ¡valida tus hallazgos!...

log4j-pcap-activity

log4j-pcap-activity（日志4j数据包捕获活动） 一个有趣的活动，使用来自 log4j 漏洞 CVE-2021-44228 的数据包捕获文件 说明 打开 Wireshark 并导入本仓库中的 PCAP 文件：log4j-exploit.pcap。 查看数据包，回答以下问题。 问题 简单 1. 哪些数据包编号包含 TCP 三次握手？ 提示：共有 9 个。 2. 对于第一次握手，哪个服务器 IP 和端口正在与哪个其他服务器 IP 和端口建立连接？ 3. 对于第二次握手？ 4. 与目标端口关联的服务是什么？ 5. 对于第三次握手？ 6. 查看前 4 个数据包，我们可以确定...

Aegis

AEGIS 面向 AI 编码代理的独立、操作系统级可观测性 从代理外部观察 AI 代理在你的机器上实际执行的操作——进程、文件、网络——无需任何钩子。 AEGIS 是一个面向 AI 代理的独立、操作系统级观察器。 无论代理是如何启动的，或者它是否配合监控，它都会观察代理进程、文件访问和网络活动——并将每一条观察结果关联到特定的代理 实例 ，且该归属的证据会被明确记录在案。它基于 CommonJS JavaScript 监控引擎构建，渲染进程和共享类型使用 TypeScript。开源、本地化、无遥测 ——一切数据都保留在你的机器上。 演示录制于...

apk-interceptor

apk-interceptor Asistente de evaluación de Deeplinks, Intents y puentes WebView para Android apk-interceptor es un APK de prueba portátil para Android, destinado a evaluaciones de seguridad de aplicaciones autorizadas. Ayuda a los ingenieros de seguridad a verificar cómo una aplicación Android...

GitHunt

BHEU 演示 此仓库包含三个用于 2025 年欧洲黑帽大会 《GitHub 上的取证轨迹：猎寻供应链活动》 （https://blackhat.com/eu-25/briefings/schedule/index.htmlthe-forensic-trail-on-github-hunting-for-supply-chain-activity-48832）的演示。 1. potentialattacksdemo ：一个 Flask Web 应用程序，演示如何基于公共 GitHub 数据流识别和调查攻击。 2. ghdig ：一个用于调查 GitHub 活动的命令行工具。 3...

CVE-2024-38063

CVE-2024-38063 Vulnerabilidad de Windows que permite llevar a cabo actividad no autorizada a través de la red: ejecución remota de código en Windows TCP/IP. Dos máquinas virtuales —una víctima y un atacante— están listas para simular el ataque. En la máquina víctima se utilizó una herramienta de...