APTSimulator

APT Simulator Important: Don't just ZIP download or clone the repo if you don't plan to develop some test. Use the package in the release which contains a packaged version with encrypted archives that don't contain cleartext samples and tools. APT Simulator is a Windows Batch script that uses a s...

CyberThreatIntel

CyberThreatIntel Analysis of malware and Cyber Threat Intel of APT and cybercriminals groups Summary 2020-01-20 - Transparent Tribe APT 2020-01-03 - MAAS Terraloader 2019-12-28 - SideWinder same targets, same TTPs, time to counter-attack ! 2019-11-18 - APT33 continue to target US companies...

CVE-2026-14459-14460-pardus-software

Pardus Software Center — Local Privilege Escalation CVE-2026-14459 & CVE-2026-14460 Proof-of-concept and exploit-ready code for two local privilege escalation issues in the pardus-software package Pardus Software Center version 1.0.4 , both fixed in 1.0.5. CVE| Class| Summary| CVSS 3.1 CERT-TR...

CVE-2023-4357-APT-Style-exploitation

CVE-2023-4357-APT-Style-exploitation Apt style exploitation of Chrome 0day CVE-2023-4357 https://ogulcan-unveren.medium.com/seviye-y%C3%BCkseltmek-chrome-zerodayi-xss-ile-tetiklemek-23b8498f9701...

CPSC253_CybersecurityFinalProjectReports

Introduction These papers were part of my final project for my Cybsecurity class: CPSC 253 - Cybersecurity Foundations and Principles The premise of my final project was that I was a newly hired consultant in a research center and helped optimize their security around their server room. Phase 1 W...

check_CVE-2019-3462

Check @Debian and @Ubuntu GNU / Linux for CVE-2019-3462 in APT...

APT-Backpack

APT-Backpack Most common used CVE's by APT, legitimate RAT and other tools used by adversary CVE's CVE-2019-11510 Pulse Connect Secure 8.2 8.3 9.0 Unauth file read CVE-2019-19781 Citrix ADC & Gateway Directory Traversal CVE-2020-5902 F5 Big IP RCE CVE-2021-1497 Cisco HyperFlex HX Unauth Command...

KaliPackergeManager

KaliPackergeManager kalipm.sh is a powerful package management tool for Kali Linux that provides a user-friendly menu-based interface to simplify the installation of various packages and tools. It streamlines the process of managing software and enables users to effortlessly install packages from...

CVE-2026-72530-TrueConf-Sandbox-Escape-

CVE-2026-72530: TrueConf Server Sandbox Escape - Mitigation & Detection PoC 📌 General Description This repository contains an educational demonstration of mitigation and detection for CVE-2026-72530 , a critical Code Injection and Sandbox Escape vulnerability in TrueConf Server. Vulnerability...

CVE-2026-55222

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user the one that executes Isar instead of root. If...

CVE-2026-55222

The Isar root filesystem generation system (versions 0.11 and newer ) contains a flaw where the /etc/apt/trusted.gpg.d directory is manually created during bootstrap setup with ownership assigned to the calling user instead of root . If an unprivileged user shares the same ID as the calling user,...

EUVD-2026-109069

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user the one that executes Isar instead of root. If...

CVE-2026-55222 Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user the one that executes Isar instead of root. If...

CVE-2026-55222 Isar: Unprivileged user ownership of trusted repository GPG public keys storage after bootstrap

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user the one that executes Isar instead of root. If...

katoolin3

katoolin3 Katoolin3 brings all programs available in Kali Linux to Debian and Ubuntu. Description This program is a port of katoolin from LionSec to python3. Katoolin3 offers several improvements over katoolin: Up to date packages The old katoolin uses an outdated package list. Katoolin3 always...

PT-2026-122144

Isar is an integration system for automated root filesystem generation. In versions 0.11 and newer, /etc/apt/trusted.gpg.d is created manually during bootstrap setup to be able to deploy local keys. By that, the directory is owned by the calling user the one that executes Isar instead of root. If...

yara-rules

yara-rules Collection of YARA signatures from recent malware research Ruleset Dacls Trojan Rule: DaclsLinux.yara Rule: DaclsWindows.yara Reference: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown Rule: APT32KerrDown.yara Reference:...

collection-document

Descripción del Proyecto Colección de artículos de seguridad de calidadpor reconstruir Some are inconvenient to release. Some forget update,can see me star. collection-document awesome 以前的链接中大多不是优质的 渗透测试部分不再更新 因精力有限，缓慢更新 Author: tom0li Blog: https://tom0li.github.io - Project Description -...

katoolin3

katoolin3 Katoolin3 trae todos los programas disponibles en Kali Linux a Debian y Ubuntu. Descripción Este programa es un puerto de katoolin de LionSec a python3. Katoolin3 ofrece varias mejoras sobre katoolin: Paquetes actualizados El antiguo katoolin usa una lista de paquetes desactualizada...

APTInvestBench: Evaluating Autonomous APT Investigation under Varying Telemetry

Large language model LLM agents could help security operations centers SOCs investigate advanced persistent threats APTs by turning weak leads into evidence for intrusion scoping and response. Yet success under one telemetry setting does not establish robustness to changes in log collection,...