RansomLook

RansomLook RansomLook — это инструмент для мониторинга групп и рынков программ-вымогателей и извлечения их жертв. Возможности Основан на ransomwatch https://github.com/joshhighet/ransomwatch, Внесены важные изменения: Все данные хранятся в Valkey Скрапинг выполняется в многопоточном режиме Скрапи...

mylg

myLG, Command line Network Diagnostic Tool myLG is an open source software utility which combines the functions of the different network probes in one network diagnostic tool. Features Popular looking glasses ping/trace/bgp: Telia, Level3, NTT, Cogent, KPN More than 200 countries DNS Lookup...

pymultitor

PyMultiTor Python Multi Threaded Tor Proxy, Did you ever want to be at two different places at the same time? When I asked myself this question, I actually started developing this solution in my mind. While performing penetration tests there are often problems caused by security devices that bloc...

log4j-CVE-2021-44228

Apache Log4j Zero Day aka Log4Shell aka CVE-2021-44228 Введение Воспроизведение проблемы в k8s-окружении Настройка k8s-окружения с уязвимостью Возможные решения Политика безопасности KubeArmor Запрет любых exec из JVM/Java Правила на основе Default Deny Видимость/наблюдаемость KubeArmor внутри...

swap_digger

swapdigger swapdigger is a bash script used to automate Linux swap analysis for post-exploitation or forensics purpose. It automates swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, HTTP basic authentication, WiFi SSID and keys, etc. Download and run...

MIPS-CVE-2014-9222

면책 조항 튜토리얼은 정보 제공 및 교육 목적으로만 제공됩니다. 저는 윤리적 해킹, 정보 보안, 사이버 보안이 디지털 정보와 컴퓨터를 사용하는 모든 사람에게 친숙한 주제가 되어야 한다고 생각합니다. 해킹이 어떻게 이루어지는지 알지 못하고서는 해커로부터 자신을 방어하는 것은 불가능하다고 믿습니다. 요구 사항 root@kitploit: $ IDA Pro +7.0 you can use Radar2 since IDA is quite expensive $ Router running Rompager 4.07 : there're immen...

regexploit

Regexploit Find regexes which are vulnerable to Regular Expression Denial of Service ReDoS. More info onthe Doyensec blog Many default regular expression parsers have unbounded worst-case complexity. Regex matching may be quick when presented with a matching input string. However, certain...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: Fixed an issue where a missing zerocopy reference was present in the pskbcarve helpers. Both pskbcarveinsideheader and pskbcarveinsidenonlinear copy the old skbsharedinfo header into a new buffer using memcpy. Thi...

exploit-CVE-2016-10033

PHPMailer 5.2.18 Удаленное выполнение кода PHPMailer — самый популярный транспортный класс в мире, с примерно 9 миллионами пользователей по всему миру. Загрузки продолжаются со значительной скоростью ежедневно. Используется многими проектами с открытым исходным кодом: WordPress, Drupal, 1CRM,...

SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit

SCCM-CVE-2026-47301-Remote-Code-Execution-Exploit Proof-of-concept exploit chain I have discovered assigned as CVE-2026-47301 for Microsoft Configuration Manager SCCM, combining broken access control, CAB extraction-path traversal arbitrary file write, certificate verification bypass, and DLL...

kalitorify

Transparent Proxy through Tor for Kali Linux About kalitorify kalitorify is a shell script for Kali Linux which use iptables settings to create a Transparent Proxy through the Tor Network , the program also allows you to perform various checks like checking the Tor Exit Node i.e. your public IP...

PhoneSploit-Pro v2.3

PhoneSploit Pro The Swiss Army knife for Android. An all-in-one hacking tool written in Python to remotely take over Android devices using ADB, scrcpy, Nmap, and Metasploit-Framework. Table of contents Overview Screenshots Features Requirements Installing dependencies Getting started Device setup...

CVE-2017-7921

Инструмент для перечисления камер Hikvision и создания снимков Автономный инструмент для перечисления камер Hikvision из файла и создания снимка каждой камеры с использованием действительных учетных данных HTTP Basic или Digest аутентификация или CVE обхода аутентификации. Предназначен для запуск...

CVE-2026-85617

snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users outside their authorized scope. Attackers can include unauthorized user IDs in bulk delete requests to bypass instance-level restrictions...

CVE-2026-85616

Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for...

CVE-2026-85610

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor through mathjs matrix objects. Attackers can use the recovered constructor to loa...

CVE-2026-85611

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

CVE-2026-85592

phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed method grants access to all callers when main.enableAskQuestions is enabled, ignoring the records.allowQuestionsForGuests setting. Unauthenticated attackers ca...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85584

SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attempt state using attacker-controlled usernames without enforcing capacity limits or eviction policies. Unauthenticated attackers can submit repeated...