36107 matches found
cve-2022-22963
Spring Cloud Function SpEL - cve-2022-22963 Build root@kitploit: $ git clone https://github.com/twseptian/cve-2022-22963.git $ cd cve-2022-22963 $ docker build . -t spring-spel-0day $ docker run -p 8080:8080 --name spring-spel-0day spring-spel-0day Payload root@kitploit:...
EUVD-2026-74647
Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings...
HybridTestFramework
HybridTestFramework Supported By In the era of cloud-native world we cannot stick to a particular framework, however due to projects requirement we often need to evolve the existing testing solution in such a way so that it can cater multiple testing requirement, hence is targeting to create a...
maps_scanner
MAPS Cloud Scanner A research tool for interacting with Windows Defender's MAPS Microsoft Active Protection Service cloud-based file reputation and dynamic signature delivery system. MAPS is the cloud backend that powers Defender's real-time protection verdicts, sample submission pipeline, and...
SpringExploitGUI
SpringExploitGUIv1.0 0x01 Preface Today, I reproduced several previous Spring vulnerabilities and weaponized them. The tool currently supports detection and exploitation of Spring Cloud Gateway RCE CVE-2022-22947, Spring Cloud Function SpEL RCE CVE-2022-22963, and Spring Framework RCE...
gcp_scanner
Disclaimer This project is not an official Google project. It is not supported by Google and Google specifically disclaims all warranties as to its quality, merchantability, or fitness for a particular purpose. GCP Scanner This is a GCP resource scanner that can help determine what level of acces...
osmedeus
Osmedeus Osmedeus - A Modern Orchestration Engine for Security What is Osmedeus? Osmedeus is a security focused declarative orchestration engine that simplifies complex workflow automation into auditable YAML definitions, complete with encrypted data handling, secure credential management, and...
coalmine
Cloud Canary Token Management β Deploy, monitor, and rotate deceptive credentials across AWS and GCP to detect unauthorized access. !WARNING Alpha Version β Coalmine is in early development. Basic functionality is the current priority, and the application should not be considered fully security...
surf
Surf - Escalate your SSRF vulnerabilities on Modern Cloud Environments surf allows you to filter a list of hosts, returning a list of viable SSRF candidates. It does this by sending a HTTP request from your machine to each host, collecting all the hosts that did not respond, and then filtering th...
kubebot
Kubebot A security testing Slackbot built with a Kubernetes backend on the Google Cloud Platform NOTE: I am not actively maintaining this project anymore. I am working on v2 of Kubebot along with a couple other folks which will likely be presented at one of the upcoming security conferences...
cloud-custodian
Cloud Custodian c7n Cloud Custodian, also known as c7n, is a rules engine for managing public cloud accounts and resources. It allows users to define policies to enable a well managed cloud infrastructure, that's both secure and cost optimized. It consolidates many of the adhoc scripts...
spring_cloud_gateway_memshell
CVE-2022-22947 memshell This script is incomplete, for learning purposes only, do not use illegally. Based on c0ny1 senior's blog, this is a learning script that can write netty and spring memory shells. Test environment is vulhub root@kitploit: eg:xx.py http://127.0.0.1:8080 netty whoami...
cloudlist
Features β’ Installation β’ Usage β’ Configuration β’ Running cloudlist β’ Supported providers β’ Library β’ Join Discord Cloudlist is a multi-cloud tool for getting Assets from Cloud Providers. This is intended to be used by the blue team to augment Attack Surface Management efforts by maintaining a...
algo
Algo VPN Algo VPN is a set of Ansible scripts that simplify the setup of a personal WireGuard and IPsec VPN. It uses the most secure defaults available and works with common cloud providers. See our release announcement for more information. Features Supports only IKEv2 with strong crypto AES-GCM...
cloudquery
CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...
EvilMist
EvilMist EvilMist is a collection of scripts and utilities designed to support cloud security configuration audit, cloud penetration testing & cloud red teaming. The toolkit helps identify misconfigurations, assess privilege-escalation paths, and simulate attack techniques. EvilMist aims to...
attack_range
Splunk Attack Range v5 The Splunk Attack Range builds instrumented cloud environments AWS, Azure, GCP, simulates attacks, and forwards data into Splunk for detection development and testing. What it does: Build labs β Deploy a small, production-like lab Splunk, Windows/Linux servers, optional Kal...
parsec-cloud
.. raw:: html root@kitploit: Simple, secure, end-to-end encrypted file sharing in the cloud Parsec Parsec is a cloud-based application for simple and cryptographically secure file sharing. π Client-side E2EE to ensure your data is only accessed by you and the people you share it with. βοΈ...
cve-2022-22947-godzilla-memshell
CVE-2022-22947 godzilla-memshell CVE-2022-22947 Inject Godzilla memory shell...
vulhub
Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required. δΈζηζ¬Chinese version Quick Start Install Docker examp...