XIP

XIP Description XIP generates a list of IP addresses by applying a set of transformations used to bypass security measures e.g. blacklist filtering, WAF, etc. asciicast Further explaination on our blog post article Usage root@kitploit: python3 xip.py --help Docker alternative Official image You c...

web

Network-wide ad blocking via your own Linux hardware Pi-hole website | Documentation | Discourse Forum | Donate Pi-hole Web Interface Pi-hole®'s Web interface based off of AdminLTE provides a central location to manage your Pi-hole and review the statistics generated by FTLDNS™. Easy-to-interpret...

monstra_cms-3.0.4--getshell

monstracms-3.0.4--getshell monstracms-3.0.4-上传getshell CVE- 2018-17418 代码分析（Code analysis）： 在monstra\plugins\box\filesmanager\ filesmanager.admin.php第150行中存在forbiddentypes变量做黑名单限制，继续跟进该变量 In the line 150 of monstra\plugins\box\filesmanager\ filesmanager.admin.php, there is a forbiddentypes variab...

cve-2017-2636-el

cve-2017-2636-el This role installs the workaround documented on https://access.redhat.com/security/cve/CVE-2017-2636 to blacklist the nhdlc module from being loaded. Requirements This role only applies to Red Hat Enterprise Linux versions 6 and 7, and variants CentOS, CloudLinux, etc. License MI...

CVE-2020-8840

CVE-2020-8840: FasterXML/jackson-databind Remote Code Execution Vulnerability 0x00 Introduction jackson-databind is a JSON processing library under the FasterXML project. 0x01 Vulnerability Overview On February 19, NVD released a security advisory disclosing a remote code execution vulnerability...

destroylist

Destroylist: Phishing & Scam Domain Blacklist...

ai-ublock-blacklist

AI uBlock Origin Blacklist A personal list for uBlock Origin blocking AI content farms. Pull requests welcome. Install You can click here to subscribe to this list automatically. This link works only if you have uBlock Origin installed. Alternatively, import the following URL as a 3rd party list ...

rita

RITA Real Intelligence Threat Analytics If you get value out of RITA and would like to go a step further with hunting automation, futuristic visualizations, and data enrichment, then take a look at AC-Hunter. Brought to you by Active Countermeasures. Sponsored by BHIS. RITA is an open source...

shed

Shed - .NET runtime inspector Shed is an application that allow to inspect the .NET runtime of a program in order to extract useful information. It can be used to inspect malicious applications in order to have a first general overview of which information are stored once that the malware is...

CVE-2020-10673

Vulnerability Description Recently, the Asiainfo Security Network Attack and Defense Laboratory tracked that jackson-databind has updated a JNDI injection blacklist class. If the jar package of this class exists in the project and the JDK version meets the injection version, remote code execution...

vallumd

vallumd This program allows you to centralize and distribute IP blacklists. If you maintain a server on the Internet, it's very likely you encountered one or more brute force attacks. Not a problem, just install fail2ban. Done. But if you're running multiple servers, each of them running their...

siper

Siper Shield Siper is a high-performance, XDP-based IP blacklist firewall built with Go and C eBPF. It allows you to drop malicious traffic at the earliest possible stage in the Linux networking stack—the network driver level. By leveraging XDP Express Data Path, Siper processes packets before th...

crowdsec

CrowdSec은 오픈 소스이자 참여형 보안 솔루션으로, 크라우드소싱 기반의 서버 탐지 및 악성 IP 차단 기능을 제공합니다. 보안 엔진으로 탐지 및 차단하고, 네트워크에 기여하며, 실시간 커뮤니티 차단 목록을 활용하세요. 특징 및 장점 다목적 보안 엔진 CrowdSec 보안 엔진은 올인원 IDS/IPS 및 WAF입니다. 로그 소스와 HTTP 요청을 분석하여 악성 행위를 탐지하고, Remediation Components를 통해 능동적인 대응이 가능합니다. 탐지 규칙은 MIT 라이선스로 허브에서 확인할 수 있습니다...

CVE-2020-26258

Description XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not...

Parth

Parth Heuristic Vulnerable Parameter Scanner Introduction Some HTTP parameter names are more commonly associated with one functionality than the others. For example, the parameter ?url= usually contains URLs as the value and hence often falls victim to file inclusion, open redirect and SSRF...

xepor

Xepor Xepor pronounced /ˈzɛfə/ , zephyr is a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style. This project is meant to be used with mitmproxy...

CVE-2019-19576

class.upload.php = 2.0.3 Arbitrary file upload Автор — Jinny Ramsmark Затрагиваемый вендор — Verot.net Затрагиваемый продукт — class.upload.php = 2.0.3 Протестировано на свежеустановленной Ubuntu 19.10 с PHP7.3 и Apache/2.4.38 В частности, Debian/Ubuntu оказались уязвимыми, так как они добавляют...

HouseProxy

HouseProxy Protect your parents from phishing, HTTP proxy focused on block phishing URL's Install root@kitploit: git clone https://github.com/mthbernardes/HouseProxy.git cd HouseProxy/ pip3 install -r requeriments.txt Config root@kitploit: Edit etc/HouseProxy.conf to change de default user and...

CVE-2026-1337-AI-Coding-Assistant-Prompt-Injection-to-Sandbox-Escape

CVE-2026-1337 – AI 코딩 어시스턴트 프롬프트 인젝션을 통한 RCE 📖 개요 AI 기반 코드 리뷰 봇의 프롬프트 인젝션 취약점으로 인해 공격자가 봇의 “fix” 제안을 조작하여 임의의 셸 명령을 주입할 수 있습니다. 샌티타이저는 단순한 블랙리스트를 사용하지만 인코딩 트릭을 통해 우회됩니다. ⚙️ 취약점 세부 정보 유형: 프롬프트 인젝션 → 명령 주입 영향: CI/CD 러너에서 원격 코드 실행RCE 근본 원인: AI 모델이 사용자가 제공한 Fix: 섹션을 무비판적으로 그대로 반영합니다. 블랙리스트가 위험한 명령을...

xss_vulnerability_challenges

Сценарии XSS-уязвимости задачи Этот репозиторий представляет собой Docker-приложение на PHP, содержащее несколько задач по XSS-уязвимостям. Идеи, лежащие в основе задач: Обход проверки JavaScript Обход HTML-сущностей Обход WAF Обход проверки черного списка Обход базовой проверки XSS Обход WAF с...