kubesploit

Kubesploit Kubesploit is a cross-platform post-exploitation HTTP/2 Command & Control server and agent dedicated for containerized environments written in Golang and built on top of Merlin project by Russel Van Tuyl @Ne0nd0g. Our Motivation While researching Docker and Kubernetes, we noticed that...

gdog

Gdog A stealthy Python based Windows backdoor that uses Gmail as a command and control server This project was inspired by the gcathttps://github.com/byt3bl33d3r/gcat from byt3bl33d3r. Requirements Python 2.x PyCrypto module WMI module Enum34 module Netifaces module Features Encrypted...

hinge-command-control-c2

Using Hinge as a Command & Control Server Please see https://mattwie.se/hinge-command-control-c2...

PAKURI-THON

PAKURI-THON Pentest Achieve Knowledge Unite Rapid Interface - Python PAKURI-THON is a tool that supports pentesters with various pentesting tools and C4 server command & control and chat & communication server. PAKURI-THON can perform most of the operations with intuitive web operations and...

zuthaka

A collaborative free open-source Command & Control integration framework that allows developers to concentrate on the core function and goal of their C2. Explore the docs » · Report Bug · Request Feature · Table of Contents 1. About The Project Problem statement Solution Built With 2. Already...

PiX-C2

PiX-C2 ICMP C2 サーバーアプリケーション 作者: NoCow メール: [email protected] ICMP C2 プロジェクト（PiX-C2）は、ICMP のみを使用してコマンド制御を可能にするクライアント/サーバーアプリケーションです。サーバーは ICMP パケットをスニッフィングし、ICMP パケットのデータペイロードから情報を取得します。 適切なデータを受信すると、クライアントにコマンドが送信されます。コマンドは "run " で始まる必要があります。その他のサーバーオプションには、sleep、sysinfo などがあり、今後追加予定です。 前提条...

killchain

killchain “Kill Chain” is a unified console with an anonymizer that will perform these stages of attacks: Reconnaissance Weaponization Delivery Exploit Installation Command & Control And Actions Dependent tool sets are: 1...

C4

C4 C yberdelia，一个C 命令与控制框架的C 集合 目录 C4 目录 这是什么？ Cyberdelia？ 什么是C2（框架）？ 为什么要创建这个仓库？ 格式 本仓库的计划 Github特定内容 贡献项目 所用资源 这是什么？...

raven

Raven WebSocket用のCobaltStrike External C2 追加情報: https://www.cobaltstrike.com/help-externalc2 サーバービルド Ubuntu サーバーフォルダをVPSにコピーします。 rootまたはsudoで./setup.shを実行します。 クライアントビルド Windows クライアントフォルダをWindows開発ホストにコピーします。 Windows 10、8.1、または7のSDKをインストールします。...

Malleable-C2-Profiles

このリポジトリには README がありません。...

CVE-2026-68281

The CVE-2026-68281 entry covers the Linux kernel DRM/imagination driver where the DRM scheduler’s prepare_job() previously failed to account for the dependency between paired geometry and fragment jobs. The fix updates job_count_remaining_native_deps() so that paired job fences are counted as dep...

CVE-2026-68503

CVE-2026-68503 affects the LazyOwn RedTeam/APT Framework. Prior to version 0.2.154, it ships default C2 credentials (LazyOwn/LazyOwn) in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the ...

SIP Sustainable Irrigation Platform 5.x (cli_control) Remote Code Execution

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

MAL-2026-10442 Malicious code in @oliviamcdaniel12/safer-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f Package impersonates the popular safer-buffer module. On require, safer.js reads a PID from Porting-Buffer.md and, if that process is not alive, spaw...

Siggen Backdoor Hits Windows Developers Via Infected Visual Studio Projects

Dr.Web details Siggen Windows backdoor that uses Steam for C2, steals credentials and crypto data and infects Visual Studio projects to spread among developers...

Malicious code in @wagni_bot/jupiter-sdk (npm)

The npm package @wagnibot/jupiter-sdk is a supply-chain credential stealer disguised as a Jupiter Solana DEX aggregator SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

MAL-2026-6783 Malicious code in @marketfront/infopopup (npm)

The @marketfront/infopopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...

MAL-2026-6139 Malicious code in @httpactions/encode-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e52b15ad9413185c30f84ad7e11e031c74c359e04f5c30ce502b8bc73267d8e The package ships a single heavily obfuscated index.js that performs no URL-encoding work despite the package name. On require of the declared main,...

MAL-2026-6156 Malicious code in documents-widgets (npm)

The npm package documents-widgets published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

Malicious code in class-synth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aa63407d7400b4819d0739dedad0a32d9ae29b18509693c2e8763cf30275271 class-synth is advertised as a small class/style/date utility library, but its main entry dist/index.js contains a hidden top-level async IIFE init...