node9-proxy

🛡️ node9 Access control for AI agents Your AI agents can reach Slack, GitHub, email, and your database. node9 decides what they may do with each one. Credential jail · secrets and PII · destructive git, SQL and shell held for review · MCP tool pinning · network egress allowlist · loop breaker · on...

badkeys

badkeys Tool and library to check cryptographic public keys for known vulnerabilities what? badkeys checks public keys in various formats for known vulnerabilities. A web version can be found at badkeys.info. install badkeys can be installed via pip: pip3 install badkeys You may want to use a...

AOSP-DownloadProviderDbDumperSQLiLimit

AOSP-DownloadProviderDbDumperSQLiLimit PoC Exploiting SQL Injection in Android's Download Provider in Sort Parameter CVE-2019-2196 Security Advisory Android AOSP Download Provider SQL Injection in Query Sort Parameter CVE-2019-2196 Demo...

fortios-auth-bypass-exploit-CVE-2024-55591

CVE-2024-55591 A Fortinet FortiOS Authentication Bypass Vulnerable Exploit Description Use this exp,you can bypass authentication and run cmd USEAGE sysirq@sysirq-machine:/Work/Fortinet/FortiGate7016/CVE-2024-55591$ python3 exp.py usage: exp.py -h --target TARGET --port PORT --username USERNAME...

chackd

chackd chackd is a daemon which randomize each second the kernel parameter tcpchallengeacklimit to prevent side channel attacks Introduction A shortly presented side-channel attack has given strong attention of the community 1 . For lots of servers or smartphone devices this attack considered...

sliver-gui

Sliver GUI A desktop operator console for the Sliver C2 framework in the spirit of Cobalt Strike and Havoc. Designed and Developed by Raj Kumar Mullapudi Sliver GUI is a thin Wails v2 Go + plain HTML/CSS/JS frontend over Sliver's existing rpcpb.SliverRPC gRPC service. It reimplements no C2 logic...

CVE-2022-40348_Intern-Record-System-Cross-site-Scripting-V1.0-Vulnerability-Unauthenticated

CVE-2022-40348: Intern Record System - 'name' and 'email' Cross-site Scripting Unauthenticated XSS Exploit Title: Intern Record System - 'name' and 'email' Cross-site Scripting Unauthenticated XSS Date: 2022-06-09 Exploit Author: Hamdi Sevben Vendor Homepage:...

CVE-2026-85706

CVE-2026-85706 — GitLab Unauthenticated Arbitrary File Read For authorized penetration testing and Red Team operations only. Unauthorized use constitutes a criminal offense. See Legal Notice. Overview CVE-2026-85706 is a CVSS 10.0 path traversal vulnerability in GitLab Community and Enterprise...

CVE-2023-49976

CVE-2023-49976 Customer Support System 1.0 - XSS Cross-Site Scripting Vulnerability in the "subject" at "ticketlist" Description : Customer Support System 1.0 is vulnerable to stored XSS. A XSS vulnerability exists in version 1 of the Customer Support System. A malicious actor can insert JavaScri...

recaptcha

Description This repository contains a technical analysis of Google's antibot reCAPTCHA focusing on: Payload Structure and Values Fingerprinting Techniques Obfuscation Techniques Anti-debugging/Tampering Techniques Virtual Machines Contact Discord: @grecaptcha Telegram: @lyxlobyx Obfuscation...

archiver-MOTW-support-comparison

Comparison of MOTW Mark of the Web propagation support of archiver software for Windows English | Japanese Background On 3 March 2022, Microsoft announced that the default behavior of Office applications on Windows will be changed to block macros in files from the internet such as email attachmen...

CVE-2022-23614

CVE-2022-23614 PoC for CVE-2022-23614, GHSA-5mv2-rx3q-4w2v Twig sort filter code execution/sandbox bypass As seen in this commit - https://github.com/twigphp/Twig/commit/.., twig was passing user supplied function name as a callback parameter to uasort here, thus leading to arbitrary code executi...

nuclei-action

This Nuclei Action makes it easy to orchestrate Nuclei with GitHub Action. Integrate all of your Nuclei Templates into powerful continuous security workflows and make it part of your secure software development life cycle. Nuclei Action Compatibility v3.0.0+ runs on Node.js v24 and adopts a...

M365-Assess

M365 Assess Comprehensive M365 Security Assessment Tool Read-only Microsoft 365 security assessment for IT consultants and administrators What is this? M365 Assess runs a single read-only command against a Microsoft 365 tenant and produces CSV data, a self-contained branded HTML report, and an XL...

CVE-2024-23897

CVE-2024-23897 CVE-2024-23897 - Arbitrary file read vulnerability through the CLI can lead to RCE Products and Versions affected: Product| Affected Versions ---|--- Jenkis Server| = 2.441 = LTS 2.426.3 CVSS: CRITICAL Actively Exploited: YES Patch: YES Mitigation: YES Help usage: CVE-2024-23897.py...

CVE-2024-27348

CVE-2024-27348 🪶 CVE-2024-27348 Proof of concept Exploit RCE in Apache HugeGraph Server Unauthenticated users can execute OS commands via Groovy injection in Apache HugeGraph Server. Usage 🛠 Exploit multiple targets ☣️ python3 CVE-2024-27348.py -f targets.txt -c "command to execute" Exploit single...

CVE-2023-32571-POC

Dynamic Linq injection to RCE - CVE-2023-32571 About Dynamic Linq injection to RCE CVE-2023-32571 Recently, members of the NCC Group discovered a vulnerability in Dynamic Linq that allows attackers to call C functions through a Linq Injection, thus making it possible to obtain RCE. Even with the...

ad-ldap-enum

ad-ldap-enum ad-ldap-enum is a Python script developed to collect users/computers and their group membership from Active Directory. In large Active Directory environments, tools such as NBTEnum were not quick enough. By executing LDAP queries against a domain controller, ad-ldap-enum is able to...

CVE-2024-51567

CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python proof-of-concept PoC exploit script for CVE-2024-51567 , a critical command injection vulnerability affecting CyberPanel v2.3.6. This vulnerability, found in the upgrademysqlstatus endpoint, enables remote command execution RCE by bypassing...

FalconHound

FalconHound NOTE: As of the BloodHound CE 7.0 release, the default database has been switched to Postgres. This version of FalconHound still relies on Neo4j to be the default database. If you want to keep using FalconHound while running the latest BloodHound version, add the following line to you...