lazyrecon

root@kitploit: | | | |/ | /| | | | / / |/ | \ | | | / / | | | | | | / | | | ||\ |/ \ || ||/|| |v2 |/ Lazyrecon v2 is a subdomain discovery tool that finds and resolves valid subdomains then performs SSRF/LFI/SQLi fuzzing, brute-force and port scanning. It has a simple modular architecture and...

cloud

Cloud Monitoring the Cloud Landscape Our mission with this project is to provide an always up-to-date and freely accessible map of the cloud landscape for every major cloud service provider. We've decided to kick things off with collecting SSL certificate data of AWS EC2 and GCP machines,...

physical-bitcoin-attacks

Known Physical Bitcoin Attacks A list of known attacks against Bitcoin / crypto asset owning entities that occurred in meatspace. NOTE: this list is not comprehensive; many attacks are not publicly reported. If you are aware of an attack that is not listed, please open an issue or pull request. F...

CVE-2021-25741

关于 fork on Betep0k/CVE-2021-25741/fork 图片无用，并在metarget上测试...

bucket-stream

🚨 Bucket Stream is no longer maintained. If you need support or consultation for your red teaming endeavours, drop me an e-mail [email protected] 🚨 Bucket Stream Find interesting Amazon S3 Buckets by watching certificate transparency logs. This tool simply listens to various certificate...

CVE-2023-43144

CVE-2023-43144 描述 Assets Management System 1.0 存在 SQL 注入漏洞，通过 delete.php 中的 id 参数触发。 PoC root@kitploit: sqlmap -u 'http://localhost/delete.php?id=4' --cookie="PHPSESSID=SESSID" --dbms=MySQL --dbs --batch 代码审查（delete.php） root@kitploit: ?php include 'core/init.php'; $id = $GET'id';...

CVE-2024-48914

Esta publicación es un artículo de investigación publicado por EQSTLab. Gracias aRajesh Sharma, quien descubrió esta vulnerabilidad. CVE-2024-48914 ★ CVE-2024-48914 PoC de Lectura Arbitraria de Archivos y DoS ★ Descripción CVE-2024-48914 : Vulnerabilidad de lectura arbitraria de archivos y DoS en...

Kunyu

Kunyu坤舆 - 更高效的企业资产收集 中文文档 | English 0x00 介绍 工具介绍 Kunyu 坤舆，名字取自 ，测绘实际上是一个地理信息相关的专业学科，针对海里的、陆地的、天上的地理信息进行盘点。同样应用于网络空间，发现未知、脆弱的资产也是如此，更像是一张网络空间地图，用来全面描述和展示网络空间资产、网络空间各要素及要素之间关系，以及网络空间和现实空间的映射关系。所以我认为“坤舆”还是比较贴合这个概念的。 Kunyu坤舆，旨在让企业资产收集更高效，使更多安全相关从业者了解、使用网络空间测绘技术。 应用场景 对于 kunyu 的使用，应用场景可以有很多，例如：...

poro

poro Description Scan for publicly accessible assets on your AWS environment Services covered by this tool: AWS ELB API Gateway S3 Buckets RDS Databases EC2 instances Redshift Databases Poro also check if a tag you specify is applied to identified public resources using --tag-key and --tag-value...

poro

poro 描述 扫描 AWS 环境中公开可访问的资产 本工具覆盖的服务： AWS ELB API Gateway S3 存储桶 RDS 数据库 EC2 实例 Redshift 数据库 Poro 还会检查你指定的标签是否应用于已识别的公开资源，使用 --tag-key 和 --tag-value 参数。 先决条件 具有对上述服务只读权限的 AWS 账号 Python 3.X requests=2.22.0 boto3=1.20 botocore=1.20 enlighten=1 用法 克隆此仓库 使用有效凭证配置环境 - aws configure sso pip install -r...

cloudlist

Features • Installation • Usage • Configuration • Running cloudlist • Supported providers • Library • Join Discord Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

Chuanhu Chat - Directory Traversal

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/dns.php Profile Name or notes field. id: CVE-2018-19914 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

FreeBSD : immich -- locked assets remain accessible through shared albums and links (fcc6917b-adbc-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fcc6917b-adbc-11f1-a655-3497f65b111b advisory. NVD reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are...

FortiLogger 4.4.2.2 - Arbitrary File Upload

FortiLogger 4.4.2.2 is affected by arbitrary file upload issues. Attackers can send a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then Assets/temp/hotspot/img/logohotspot.asp. id: CVE-2021-3378 info: name: FortiLogger 4.4.2.2 - Arbitrary File Upload author:...

gh_release_test

GitHub.com Release Test Project Esta es una demostración de la funcionalidad destacada en la siguiente publicación de blog: https://wwws.nightwatchcybersecurity.com/2021/04/25/supply-chain-attacks-via-github-com-releases/ Por favor, dirija cualquier pregunta a [email protected]...

CVE-2026-86772

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...

CVE-2026-86772

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting (XSS) vulnerability in DepartmentPresenter::formattedNameLink() . Department names are rendered unescaped in the fallback branch shown to users lacking the departments.view permission. An attacker with departments.edit permissio...

CVE-2026-86772 Snipe-IT 8.6.3 Stored XSS via Department Names

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedNameLink where department names are rendered unescaped in the fallback branch for users without departments.view permission. Users with departments.edit permission can inject...