typodetect

TypoDetect 此工具为蓝队、安全运营中心（SOC）、研究人员和公司提供检测其域名活跃变异的能力，从而阻止这些域名被用于欺诈活动（如钓鱼和短信钓鱼）。 为此，TypoDetect 允许使用 IANA 网站上发布的最新版 TLD（顶级域名）、验证区块链 DNS 中的去中心化域名以及 DoH 服务（基于 HTTPS 的 DNS）中的恶意软件报告。 为了方便用户，TypoDetect 默认以 JSON 格式返回报告，也可根据用户选择以 TXT 格式返回，并在屏幕上显示生成的变异摘要、活跃域名以及检测到的恶意软件或去中心化域名报告。 安装 克隆此仓库： root@kitploit: git...

BlockChainSec

项目介绍 本项目主要用于整理归纳区块链安全相关的资料以及技术文档信息，主要包含以下几个方面： 基础知识 协议分析 合约审计 公链基础 公链安全 安全事件 跨链技术 知识扩展 思维导图 基本操作 波场合约部署测试 Remix+MetaMask实现以太坊合约的部署 实战操作 Ethernaut闯关录上 Ethernaut闯关录中 Ethernaut闯关录下 强网杯区块链题目--Babybank深入分析 强网杯区块链题目--Babybet深入分析 阅读拓展 比特币学习笔记 区块链2.0实战学习笔记 浅谈区块链及其安全 浅析区块链共识机制 区块链安全—详谈合约攻击一 区块链安全—详谈合约攻击二...

BlockChainConstruction

文章前言 本篇文章我们主要对公链审计中几个值得关注的方面进行简单介绍，对于安全审计人员以及公链开发人员而言这都是一个值得借鉴与思考的项目。 体系结构 在介绍公链体系建设之前我们先来看一下区块链的体系结构： 区块链 1.0时代： 体系架构：如下图所示 代表产物：比特币、瑞波币、狗狗币、莱特币、万事达币等 区块链 2.0时代： 体系结构：如下图所示 代表产物：以太坊、LISK、Hyperledger等 主要变更： 应用层：增加了智能合约 激励层：缩短出块时间为16秒 共识层：加入DPOS、POS、PBFT 数据层：扩充了区块，支持发送数据和变量，采用优化的加密算法和Merkle树 区块链...

Argos

Argos — 区块链资产追踪平台 Argos 是一个多语言区块链调查平台，用于在以太坊和比特币上追踪、分析和可视化资金流动。基于 Rust、OCaml 和 TypeScript/React 构建。 架构 root@kitploit: +-----------------------+ | Frontend React 19 | | Vite + Tailwind CSS | +-----------+-----------+ | HTTP/REST +-----------v-----------+ | REST API Rust | | Axum — port 8990 | | | ...

GOATCasino

Welcome to the GOAT Casino! Try your luckor skills at the various games in the casino to win fabulous tokens and prizes! This is under development so there may be a disappointing amount of games at the moment but there are more to come and plenty of things to exploit in the meantime. To Begin: 1...

Axiom-protocol

Axiom：去中心化与抗审查通信协议 🚀 线上部署详情 网络： Arbitrum One（主网 L2） 链 ID： 42161 RPC 端点： https://arb1.arbitrum.io/rpc（或任何自定义的 Alchemy/Infura 端点） Axiom 代理合约地址： 0xc11CFf8111e8b1F055eba095Efb679a38Abe6b63 （注意：Axiom 采用 UUPS 可升级代理架构。所有客户端交互必须始终 指向此代理地址，而绝不能指向底层实现合约。） 📖 如何读取数据（索引器/客户端） 客户端绝不应...

raptor

Raptor Raptor 是一个用于审计区块链生态系统（合约、协议等）的框架。 概述 Raptor 提供了结构化的方法和工具，用于识别智能合约和区块链协议中的安全漏洞。该框架帮助审计人员一致地记录发现，并为多个审计平台生成报告。 安装 curl root@kitploit: 安装最新稳定版（推荐） curl -sSL https://raw.githubusercontent.com/calvin-kimani/raptor/main/install.sh | bash 安装特定版本 curl -sSL...

CVE-2026-9998-Insecure-Deserialization-in-Blockchain-Oracle

10. CVE-2026-9998 – Insecure Deserialization in Blockchain Oracle Overview A blockchain oracle node deserializes data from a smart contract event using Python’s pickle, allowing an attacker to execute arbitrary commands. Severity: Critical Full Node Compromise Oracle Simulation & Exploit...

presentations

Mis presentaciones Se pueden encontrar más cosas en mi sitio personal: https://sites.google.com/site/zhiniangpeng root@kitploit: Explotando vulnerabilidades de RCE de preautenticación y escape de sandbox en EXSi, Typhooncon 2023 Los objetos OLE siguen siendo peligrosos hoy en día — Explotando...

web3-decoder

Web3 Decoder Web3 Decoder es una extensión de Burp Suite diseñada para analizar operaciones de blockchain e interacciones con contratos inteligentes. Procesa llamadas JSON-RPC a Ethereum y redes compatibles incluyendo Polygon, Arbitrum, BSC, y otras Claves API de exploradores de bloques La mayorí...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations

The Common Vulnerabilities and Exposures CVE database catalogs vulnerability claims in hard- and software, among them those pertaining to blockchain programs a.k.a. smart contracts. We present CVE-Smart-Contracts, a curated dataset of CVE records up to July 2026 referring to Ethereum smart...

Malicious code in pyservercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859 The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long...

MAL-2026-15603 Malicious code in pyservercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859 The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long...

CVE-2026-55764

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, Klever-Go allows a mint-role holder to bypass a finite per-nonce MaxSupply on the semi-fungible token add-quantity path. In core/kapp/systemAccount/systemAcount.go, SFTAddCirculation performed meta.Circulation ...

CVE-2026-55763 Klever-Go: Percentage-transfer royalty skips the source debit at exactly-100% splits

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go calls SubFromBalance after the split loop and after the royaltiesToPay royaltiesToPay, so a valid PercentTransferPercentage = 10000 split...

CVE-2026-54755

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32...

CVE-2026-54755 Klever-Go: Integer overflow in split-royalty validation enables unbounded minting of KLV (native token)

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, split-royalty fields decoded in core/kapp/builtInFunctions/utils.go can contain values greater than core.HundredPercent, and core/kapp/kda/create.go and core/kapp/kda/trigger.go sum those values in uint32...

PT-2026-83228

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.19 Description An integer overflow exists in the handling of split-royalty fields. The software validates split royalties by summing them into a uint32 accumulator and checking if the total is within...

Malicious code in pybitjs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 611713d33cb9efee440b0a416812cbb2ceda3d43c0cdc73c1f8b353400209df5 The package's setuptools cmdclasses BuildPy, Develop invoke node pybitjs/js/main.js during pip install, and write a pybitjs.pth file containing impor...