burp-vps-proxy

Burp VPS Proxy: Burp Suite 向け簡単クラウドプロキシ はじめに » 機能 · プロバイダー · 免責事項 📖 概要 Burp VPS Proxy は、Burp Suite 内から人気のクラウドプロバイダー上にアップストリーム SOCKS5 プロキシを自動的に作成・削除できる Burp Suite 拡張機能です。作成したプロキシを Burp が使用するように自動的に設定し、すべての送信トラフィックがクラウド IP アドレスから送信されるようにします。これにより、ペネトレーションテストやバグバウンティハンティングの最中に、主要な WAF によってメインの IP...

algo

Algo VPN Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release announcement for more information. Features Supports only IKEv2 with strong crypto AES-GCM...

cloudlist

Features • Installation • Usage • Configuration • Running cloudlist • Supported providers • Library • Join Discord Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a...

edge

Cloud edge - 클라우드용 Whois IP를 조회하여 클라우드 제공업체 및 제공업체가 게시한 JSON, CSV 또는 텍스트 데이터 기반의 기타 세부 정보를 찾습니다 Cloud edge는 클라우드 서비스 제공업체에 초점을 맞춘 정찰 도구입니다. 클라우드 귀속 및 포렌식, 침투 테스트, 버그 바운티, 레드 팀 운영 또는 클라우드 제공업체의 일반적인 R&D에 사용할 수 있습니다. Edge는 클라우드 서비스 제공업체CSP가 게시한 IP 주소 범위AWS, Azure, GCP, Cloudflare, Digital Ocean 파일을...

cloud_ip_ranges

クラウド IP レンジ 説明 ほとんどのクラウドプロバイダーは、自社の IP アドレスレンジの最新リストを公開しています。このツールは、最新リストを取得して解析することで、ある IP がプロバイダーのレンジに属しているかどうかを識別します。 対応プロバイダー: AWS ソース Azure ソース Google Cloud Platform ソース Alibaba Cloud 現在はリストを公開していません Oracle Cloud Infrastructure ソース IBM Cloud 現在はリストを公開していません DigitalOcean ソース このツールは、Bryce Kunz...

powerfulseal

PowerfulSeal PowerfulSeal は Kubernetes クラスタに障害を注入し、問題をできるだけ早期に検出できるようにします。完全なカオス実験を記述するシナリオを作成できます。 避けられない失敗を受け入れましょう。シールを受け入れましょう 。 ドキュメント 使用方法については、PowerfulSeal ドキュメント を参照してください。 主な特徴 Kubernetes、OpenStack、AWS、Azure、GCP、およびローカルマシンで動作 完全なカオス実験を記述する yaml ポリシー Prometheus と Datadog によるメトリクス収集...

GHSA-J2G6-362Q-6QC6 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-gcp, velero-plugin-for-aws-fips, velero-plugin-for-gcp-fips, velero-plugin-for-microsoft-azure-fips, velero-plugin-for-aws, velero-plugin-for-microsoft-azure...

CVE-2026-53227 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange, linux-azure, linux-gcp, linux-aws, linux-qemu, linux-vmware...

Multiple Node.js Modules compromised in npm supply chain attack (Shai-Hulud 'Miasma') (06/01/2026)

The remote host has a version of one or more Node.js modules installed known to be compromised in the Shai-Hulud 'Miasma' npm supply chain attack reported on 06/01/2026. This wave compromised 32 packages 96 versions published under the '@redhat-cloud-services' npm scope. It is tracked separately...

Improper Access Control

Rancher is vulnerable to Improper Access Control. The vulnerability is due to missing authorization checks when handling cloud-credential IDs, which allows an attacker to make unauthorized requests to cloud providers using attached credentials...

CVE-2026-34719

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme HTTP/HTTPS as well as the hostname was checked. This could end up in retrieving...

Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts, Steal Credentials

A large-scale credential harvesting operation has been observed exploiting the React2Shell vulnerability as an initial infection vector to steal database credentials, SSH private keys, Amazon Web Services AWS secrets, shell command history, Stripe API keys, and GitHub tokens at scale. Cisco Talos...

Keys on Doormats: Exposed API Credentials on the Web

Application programming interfaces APIs have become a central part of the modern IT environment, allowing developers to enrich the functionality of applications and interact with third parties such as cloud and payment providers. This interaction often occurs through authentication mechanisms tha...

Agent Grant: From Identity Signals to Measurable Risk Reduction

Executive Summary Identity is now the 1 attack surface. Agent Grant in Qualys ETM Identity uses agentic AI to measure and reduce identity risk across AD, Entra, Okta & other cloud IdPs/IDaaS. It operationalizes identity risk by turning messy Active Directory & identity-risk signals into validated...

Code Injection

Gardener Extensions is vulnerable to Code Injection. The vulnerability is due to improper handling of user-controlled input in Terraformer-based infrastructure provisioning across AWS, Azure, OpenStack, and GCP providers, which allows an attacker with administrative privileges in a Gardener proje...

CVE-2025-59823 Gardener providers vulnerable to code injection when Terraformer is used for infrastructure provisioning

Project Gardener implements the automated management and operation of Kubernetes clusters as a service. Code injection may be possible in Gardener Extensions for AWS providers prior to version 1.64.0, Azure providers prior to version 1.55.0, OpenStack providers prior to version 1.49.0, and GCP...

secrets-store-sync-controller discloses service account tokens in logs

Hello Kubernetes Community, A security issue was discovered in secrets-store-sync-controller where an actor with access to the controller logs could observe service account tokens. These tokens could then potentially be exchanged with external cloud providers to access secrets stored in cloud vau...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: openbao-fips, eks-distro-fips, rekor-fips, jitsucom-bulker, consul-fips, filebrowser, eks-distro, cert-manager-fips, gitness, falcoctl, aactl, aws-eks-pod-identity-agent, openfga-fips, chezmoi, flux-image-automation-controller-fips, azuredisk-csi, gomplate-fips,...

Infrastructure Laundering: Blending in with the Cloud

Image: Shutterstock, ArtHead. In an effort to blend in and make their malicious traffic tougher to block, hosting firms catering to cybercriminals in China and Russia increasingly are funneling their operations through major U.S. cloud providers. Research published this week on one such outfit --...

CloudBrute - Awesome Cloud Enumerator

A tool to find a company target infrastructure, files, and apps on the top cloud providers Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode. The outcome is useful for bug bounty hunters, red teamers, and penetration testers alike. The complete writeup is available. here Motivation ...