jsluice

jsluice jsluice 是一个 Go 包和命令行工具，用于从 JavaScript 源代码中提取 URL、路径、机密以及其他有趣的数据。 如果你想立即执行这些操作：请查看命令行工具。 如果你想将 jsluice 的功能集成到你自己的项目中：请查看示例，并阅读包文档。 安装 要安装命令行工具，请运行： root@kitploit: ▶ go install github.com/BishopFox/jsluice/cmd/jsluice@latest 要将该包添加到你的项目中，请运行： root@kitploit: ▶ go get...

Security Bulletin: Consul vulnerable to an authorization bypass in the catalog node-write path

Summary Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any sing...

bip

Bip Bip 是一个旨在简化使用 python 与 IDA 交互的项目。其主要目标是方便在 IDA 的交互式控制台中使用 python 以及编写插件。更笼统地说，目标是自动化通过 python API 完成的重复性任务。Bip 的开发还旨在提供一种更加面向对象、更 "python-like" 的 API 以及一份 真正的 文档。 这段代码并不完整，仍有很多功能缺失。开发工作会优先考虑用户的需求以及开发者自身的使用需求，因此请毫不犹豫地提交 PR、Feature Request 和 Issues（包括针对文档的）。 文档以 RST 格式提供（可使用 sphinx 编译），位于 docs/...

CacheData_decrypt

CacheDatadecrypt Un simple kit de herramientas para hacer fuerza bruta y descifrar el CacheData de Windows EntraId. root@kitploit: usage: decryptcachedata.py -h pin,password ... CacheData bruteforcer. On a live windows host, to copy the folders with all subfolders and files: xcopy /H /E /G /C as...

dotNIET

.NIET .NIET 是一个 IDA Pro 插件。其目的是导入缺失的符号（通常有数千个），这些符号由 .NET Native 编译的二进制文件在运行时解析。这些符号位于 SharedLibrary.dll 中，但并未被该文件导出。 .NIET 已在以下平台上通过 IDA Pro 7.5（使用 python 3.8）进行了测试： Windows Linux 该插件目前支持以下 .NET Native 框架版本： 1.3 1.6 1.7 2.2 如果你遇到其他版本，请创建一个 issue。 安装 将这些文件复制到你的 IDA Pro 插件目录： root@kitploit:...

EUVD-2026-75707

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054

CVE-2026-89054 is a missing authorization vulnerability in OpenNMS Horizon . The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH , leaving the shipped @PATCH endpoints for event configuration and SNMP data collection accessible withou...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

CVE-2026-89054 OpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes

A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST API defines authorization rules for every HTTP method except PATCH, so the shipped @PATCH configuration endpoints for event configuration a...

NetSpecter

NetSpecter NetSpecter is a lightweight yet powerful asynchronous OSINT and reconnaissance engine built in Python. It combines multi-source intelligence gathering DNS, WHOIS, Web, TLS, HTTP, Geo, Reverse DNS with Shodan-powered security intelligence and full raw data access, providing a complete...

cups-script-final-project

機能 CVE-2025-58060 は Common UNIX Printing System CUPS における認証バイパスの脆弱性です。このツールは二段階の検出を行います。バージョン番号だけに頼るのではなく、バナーに基づくバージョンチェックとアクティブな認証バイパスプローブを組み合わせます。これにより、Server ヘッダーがパッチバージョンを切り詰めている場合でも、実際の脆弱性ステータスを確認できます。 ステージ1 — バージョンチェック CUPS の Web インターフェース（ポート 631）から Server: HTTP...

PowerShell-Suite

PowerShell-Suite Hay grandes herramientas y recursos en línea para realizar casi cualquier tarea en PowerShell; sin embargo, a veces es necesario crear un script de utilidad para un propósito específico o para salvar una brecha ontológica. Esta es una colección de utilidades de PowerShell que arm...

CVE-2026-88059

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

CVE-2026-88056

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

DEBIAN-CVE-2026-88056

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClien...

DEBIAN-CVE-2026-88059

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering SSR and hydration u...

CVE-2026-88021

Consul and Consul Enterprise are vulnerable to an authorization bypass in the Connect service mesh that may allow a service to reach a destination it is not authorized to access. When building Envoy RBAC rules to enforce Connect intentions, Consul did not correctly escape certain characters in...

CVE-2026-87090

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node...

CVE-2026-87106

Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exhaust server memory before ACL authorization is evaluated. A client that can complete the internal RPC mTLS handshake may exploit this issue without holding a...

CVE-2026-87107

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog deregistration path that may allow a local ACL token to delete peer-imported catalog objects. A caller with service:write or node:write permission may exploit this issue to remove services, checks, or nodes...