yellow

root@kitploit: | | | | | | |/ \ | |/ \ \ /\ / / | || | / | | \ V V / , ||||/ // |/ - Just add blue. yellow - solo añade azul Modificaciones binarias sencillas que activarán un canarytoken cuando se ejecute un binario. Ideal para colocar trampas en sistemas de producción contra atacantes...

CanaryHunter

Canary Hunter Resumen Durante la ejecución de múltiples compromisos de red team en los últimos años, me he encontrado en varias ocasiones con Canary Tokens que podrían alertar al SOC de las acciones realizadas. Por ello, dediqué tiempo a investigar a fondo si existían formas de detectar estos...

KilledProcessCanary

Windows Killed Process Canary Un servicio de Windows para detectar si ha sido detenido e hibernar si hay múltiples instancias. Publicado como código abierto por NCC Group Plc - http://www.nccgroup.com/ Desarrollado por Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com...

Malicious code in bazelisk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4bcbd35130e716d1a2940c91b6691d41b9655fdc8587404af37bc6e5a7f1370 This npm package uses the name bazelisk, colliding with Google's bazelbuild/bazelisk project referenced in the tarball's source.txt, and self-labels ...

MAL-2026-10959 Malicious code in iphouse-core (npm)

The iphouse-core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10954 Malicious code in @markscan/utils (npm)

The @markscan/utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms ...

Krisp: Log4j CVE-2021–44228

The researcher's canary token got DNS interaction, which raised a false sense of log4shell vulnerability. $hostName would be exfiltrated if any of the processing servers were vulnerable, but as seen in the video submitted by the researcher just a plain DNS resolving was made...