burp-vps-proxy

Burp VPS Proxy: Burp Suite를 위한 간편한 클라우드 프록시 시작하기 » 기능 · 제공업체 · 면책 조항 📖 소개 Burp VPS Proxy는 Burp Suite 내에서 인기 있는 클라우드 제공업체에 업스트림 SOCKS5 프록시를 자동으로 생성하고 삭제할 수 있게 해주는 Burp Suite 확장 프로그램입니다. 생성된 프록시를 사용하도록 Burp를 자동으로 구성하여 모든 아웃바운드 트래픽이 클라우드 IP 주소에서 나오게 합니다. 이는 침투 테스트 및 버그 바운티 헌팅을 수행하는 동안 기본 IP 주소가 널리...

algo

Algo VPN Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release announcement for more information. Features Supports only IKEv2 with strong crypto AES-GCM...

cloudlist

Features • Installation • Usage • Configuration • Running cloudlist • Supported providers • Library • Join Discord Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a...

edge

Cloud edge - 클라우드용 Whois IP를 조회하여 클라우드 제공업체 및 제공업체가 게시한 JSON, CSV 또는 텍스트 데이터 기반의 기타 세부 정보를 찾습니다 Cloud edge는 클라우드 서비스 제공업체에 초점을 맞춘 정찰 도구입니다. 클라우드 귀속 및 포렌식, 침투 테스트, 버그 바운티, 레드 팀 운영 또는 클라우드 제공업체의 일반적인 R&D에 사용할 수 있습니다. Edge는 클라우드 서비스 제공업체CSP가 게시한 IP 주소 범위AWS, Azure, GCP, Cloudflare, Digital Ocean 파일을...

cloud_ip_ranges

Cloud IP Ranges 설명 대부분의 클라우드 제공업체는 IP 주소 범위 목록을 최신 상태로 게시합니다. 이 도구는 최신 목록을 가져와 구문 분석하여 IP가 특정 제공업체의 범위에 속하는지 식별합니다. 지원 대상: AWS 출처 Azure 출처 Google Cloud Platform 출처 Alibaba Cloud 현재 목록을 게시하지 않음 Oracle Cloud Infrastructure 출처 IBM Cloud 현재 목록을 게시하지 않음 DigitalOcean 출처 이 도구는 Bryce Kunz의 Nimbusland에서 영...

powerfulseal

PowerfulSeal PowerfulSeal 은 Kubernetes 클러스터에 장애를 주입하여 문제를 가능한 한 조기에 감지할 수 있게 해줍니다. 완전한 카오스 실험을 설명하는 시나리오를 작성할 수 있습니다. 피할 수 없는 실패를 포용하세요. Seal을 포용하세요. 문서 사용 방법을 알아보려면 Powerfulseal 문서를 참조하세요. 주요 기능 Kubernetes, OpenStack, AWS, Azure, GCP 및 로컬 머신과 작동 완전한 카오스 실험을 설명하는 yaml 정책 Prometheus 및 Datadog 메트릭 ...

GHSA-J2G6-362Q-6QC6 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-gcp, velero-plugin-for-aws-fips, velero-plugin-for-gcp-fips, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-aws, velero-plugin-for-microsoft-azure...

CVE-2026-53227 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange, linux-azure, linux-gcp, linux-aws, linux-qemu, linux-vmware...

Multiple Node.js Modules compromised in npm supply chain attack (Shai-Hulud 'Miasma') (06/01/2026)

The remote host has a version of one or more Node.js modules installed known to be compromised in the Shai-Hulud 'Miasma' npm supply chain attack reported on 06/01/2026. This wave compromised 32 packages 96 versions published under the '@redhat-cloud-services' npm scope. It is tracked separately...

Improper Access Control

Rancher is vulnerable to Improper Access Control. The vulnerability is due to missing authorization checks when handling cloud-credential IDs, which allows an attacker to make unauthorized requests to cloud providers using attached credentials...

CVE-2026-34719

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme HTTP/HTTPS as well as the hostname was checked. This could end up in retrieving...

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services AWS secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos...

Keys on Doormats: Exposed API Credentials on the Web

Application programming interfaces APIs have become a central part of the modern IT environment, allowing developers to enrich the functionality of applications and interact with third parties such as cloud and payment providers. This interaction often occurs through authentication mechanisms tha...

Agent Grant: From Identity Signals to Measurable Risk Reduction

Executive Summary Identity is now the 1 attack surface. Agent Grant in Qualys ETM Identity uses agentic AI to measure and reduce identity risk across AD, Entra, Okta & other cloud IdPs/IDaaS. It operationalizes identity risk by turning messy Active Directory & identity-risk signals into validated...

Code Injection

Gardener Extensions is vulnerable to Code Injection. The vulnerability is due to improper handling of user-controlled input in Terraformer-based infrastructure provisioning across AWS, Azure, OpenStack, and GCP providers, which allows an attacker with administrative privileges in a Gardener proje...

CVE-2025-59823 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP...

secrets-store-sync-controller discloses service account tokens in logs

Hello Kubernetes Community, A security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vau...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: openbao-fips, eks-distro-fips, rekor-fips, jitsucom-bulker, consul-fips, filebrowser, eks-distro, cert-manager-fips, gitness, falcoctl, aactl, aws-eks-pod-identity-agent, openfga-fips, chezmoi, flux-image-automation-controller-fips, azuredisk-csi, gomplate-fips,...

Infrastructure Laundering: Blending in with the Cloud

Image: Shutterstock, ArtHead. In an effort to blend in and make their malicious traffic tougher to block, hosting firms catering to cybercriminals in China and Russia increasingly are funneling their operations through major U.S. cloud providers. Research published this week on one such outfit --...

CloudBrute - Awesome Cloud Enumerator

A tool to find a company target infrastructure, files, and apps on the top cloud providers Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode. The outcome is useful for bug bounty hunters, red teamers, and penetration testers alike. The complete writeup is available. here Motivation ...