gotestwaf

GoTestWAF GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, SOAP, XMLRPC, and others. It was designed to evaluate web application security solutions, such as API security proxies, Web Application Firewalls, IPS, API...

nono

Built by the team that brought you Sigstore The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central !NOTE In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum. !IMPORTANT Organization...

katana

A next-generation crawling and spidering framework Features • Installation • Usage • Scope • Config • Filters • Join Discord Features Fast And fully configurable web crawling Standard and Headless mode JavaScript parsing / crawling Customizable automatic form filling Scope control - Preconfigured...

pharos

Pharos Static Binary Analysis Framework The Pharos static binary analysis framework is a project of the Software Engineering Institute at Carnegie Mellon University. The framework is designed to facilitate the automated analysis of binary programs. It uses the ROSE compiler infrastructure develop...

CVE-2023-36845

CVE-2023-36845 説明 CVE-2023-36845 は、Juniper SRX ファイアウォールおよび EX スイッチに影響を与える注目すべき PHP 環境変数操作の脆弱性です。Juniper はこの脆弱性を中程度の深刻度と分類していますが、本記事では、この単一の脆弱性をリモートから認証なしでコード実行に悪用する方法を詳しく説明します。 検索 - Shodan title:"Juniper Web Device Manager" title:"Juniper" http.favicon.hash:2141724739 使い方 🛠 検出 python3...

idasql

IDASQL どんなAIエージェントにもコンパイル済みバイナリを理解させる能力を与える。 IDASQLは、IDA ProデータベースのためのSQLインターフェースで、Elias...

ida-pro-mcp

IDA Pro MCP !IMPORTANT I recommend using theOfficial Hex-Rays IDA MCP Server instead! See the announcement blog post for more information. Simple MCP Server to allow vibe reversing in IDA Pro. https://github.com/user-attachments/assets/6ebeaa92-a9db-43fa-b756-eececce2aca0 The binaries and prompt...

kbd-audio

kbd-audio This is a collection of command-line and GUI tools for capturing and analyzing audio data. Keytap The most interesting tool is called keytap - it can guess pressed keyboard keys only by analyzing the audio captured from the computer's microphone. Check this blog post for more details:...

honggfuzz

Honggfuzz A security-oriented, feedback-driven, evolutionary fuzzer. Honggfuzz is a general-purpose fuzzer that uses code coverage software and hardware-based to find bugs. It is multi-process, multi-threaded, and supports persistent fuzzing for extreme speed. Key Features Fast : Multi-process an...

SharpImpersonation

SharpImpersonation これは私による学習しながらのプロジェクトです。よく知られた手法を使用して、他の公開ツールと比較していくつかの改善を加えた、 単なる 別の権限借用ツールを構築しました。コードベースは以下から取得しました： https://github.com/0xbadjuju/Tokenvator 導入に関するブログ記事はこちらにあります： https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/ ユーザープロセスの一覧表示 PS PS C:\temp SharpImpersonation.e...

sloppy-joe

환각hallucination된, 오타스쿼팅된, 비정규 의존성을 프로덕션에 도달하기 전에 잡아내세요. cargo install sloppy-joe 2026년 3월의LiteLLM 공급망 공격은 월간 9700만 다운로드의 패키지를 손상시켰습니다. 공격자는 배포 자격 증명을 탈취하고, SSH 키, 클라우드 자격 증명, K8s 비밀을 수집하는 악성 버전을 푸시했습니다. sloppy-joe의 기본 72시간 버전 연령 게이트는 두 개의 감염된 버전을 모두 차단했을 것입니다. 이들은 게이트가 열리기 훨씬 전인 몇 시간 이내에 발견되었습니다...

proxychains-ng

ProxyChains-NG ver 4.17 README ProxyChains is a UNIX program, that hooks network-related libc functions in DYNAMICALLY LINKED programs via a preloaded DLL dlsym, LDPRELOAD and redirects the connections through SOCKS4a/5 or HTTP proxies. It supports TCP only no UDP/ICMP etc. The way it works is...

machofile

machofile machofile は、マルウェア解析とリバースエンジニアリングに重点を置いた、Mach-Oバイナリファイルを解析するためのモジュールです。 Ero Carrera の pefile に触発されたこのモジュールは、Mach-Oバイナリに対して同様の機能を提供することを目的としています。 ファイルフォーマットの知識、基本構造、定数の取得に使用された参考資料とドキュメントは、以下のリソースから引用しています。 machofile は自己完結型です。このモジュールに依存関係はなく、エンディアン非依存であり、macOS、Windows、Linux で動作します。 他にも...

frostbyte

FrostByte Progolue: In the past few days I've been experimenting with the AppDomain manager injection technique had a decent success with it in my previous Red Team engagements against certain EDRs. Although, this is really good for initial access vector, I wanted to release a POC which will help...

tenet

Tenet - A Trace Explorer for Reverse Engineers Overview Tenet is an IDA Pro plugin for exploring execution traces. The goal of this plugin is to provide more natural, human controls for navigating execution traces against a given binary. The basis of this work stems from the desire to research ne...

tenet

Tenet - 리버스 엔지니어를 위한 트레이스 탐색기 개요 Tenet은 IDA Pro 플러그인으로 실행 트레이스를 탐색하기 위한 도구입니다. 이 플러그인의 목표는 주어진 바이너리에 대해 실행 트레이스를 탐색할 수 있는 보다 자연스럽고 인간적인 제어 기능을 제공하는 것입니다. 이 작업의 기반은 소프트웨어에서 복잡한 실행 패턴을 검사하고 추출하는 새롭거나 혁신적인 방법을 연구하려는 열망에서 비롯되었습니다. 이 프로젝트에 대한 더 많은 맥락은 초기 출시에 관한 블로그 포스트를 참조하세요. QIRA / geohot 외 여러분의 영감에...

binary-exploitation-notes

Binary Exploitation Notes Historical lab analyses of stack pi...

the-backdoor-factory

The new version of BACKDOOR FACTORY is available! Get access here: https://github.com/sponsors/secretsquirrel WARNING: Pull Requests WILL BE IGNORED AND CLOSED. The Backdoor Factory BDF For security professionals and researchers only. The goal of BDF is to patch executable binaries with user...

the-backdoor-factory

The new version of BACKDOOR FACTORY is available! Get access here: https://github.com/sponsors/secretsquirrel WARNING: Pull Requests WILL BE IGNORED AND CLOSED. The Backdoor Factory BDF セキュリティ専門家と研究者のみを対象としています。 BDFの目的は、実行可能バイナリにユーザーが望むシェルコードをパッチとして埋め込み、パッチ適用前の状態の通常の実行を継続させることです。 Black Hat USA...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.18.0 Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a...