fawkes

Fawkes Mythic C2 Agent Fawkes 是一个完全以氛围驱动的方式（vibe-coded）编写的 Mythic C2 代理。它始于一个“我想知道”的念头，如今已成为一个目标。我的目标是：不为此代理写一行代码，而是完全通过提示语（prompt）来生成它。 我最初尝试自己编写代理，但在克隆示例容器、阅读 Mythic 文档、观看开发系列 YouTube 视频，以及从 Merlin 或 Freyja 等其他代理复制代码后，我意识到自己根本没有时间开发自己的代理。不过，编写提示语这件事，我还是有时间做的。 Fawkes 是一个基于 Go 语言的代理，具备跨平台能力。它支持...

Priv2Admin

目标是“翻译”Windows操作系统权限，使其指向以下路径之一： 1. 管理员权限 2. 完整性/机密性威胁 3. 可用性威胁 4. 纯粹混乱 权限列表及说明见：https://learn.microsoft.com/en-us/windows/win32/secauthz/privilege-constants 如果可以通过多种方式达成目标，优先级如下： 1. 使用内置命令 2. 使用PowerShell（仅当存在可用的脚本） 3. 使用非操作系统工具 4. 使用其他任何方法 你可以通过 whoami /priv...

hershell

Hershell NOTE: the project has been forked on this repo, check there for any other developments. Hershell is a simple TCP reverse shell written in Go. It uses TLS to secure the communications, and provide a certificate public key fingerprint pinning feature, preventing from traffic interception...

CVE-2019-16278

CVE-2019-16278 CVE-2019-16278Nostromo httpd命令执行 ➜ Downloads python nostromo.py 114.114.114.114 8080 pwd /bin ➜ Downloads python nostromo.py 114.114.114.114 8080 id uid=65534 gid=65534 ➜ Downloads python nostromo.py 114.114.114.114 8080 "ls -al" drwxr-xr-x 2 0 0 0 Apr 12 2013 . drwxr-xr-x 16 0 0 0...

ronin

ronin 网站 源码 问题 文档 Discord | Mastodon 描述 Roninwebsite 是一个免费且开源的 Ruby 工具包，用于安全研究和开发。Ronin 包含许多不同的 CLI 命令 和 Ruby 库ronin-rb，用于处理各种安全任务，例如编码/解码数据、过滤 IP/主机/URL、查询 ASN、查询 DNS、HTTP、扫描 Web 漏洞ronin-vulns-synopsis、爬取网站ronin-web-spider、安装第三方仓库ronin-repos-synopsis 中的 漏洞利用ronin-exploits 和/或...

CVE-2026-16723

CVE-2026-16723 Donar Apoya el mantenimiento de este proyecto con PayPal o escaneando el código QR a continuación. ⚡ Uso Sencillo Usa este proyecto solo en entornos seguros y autorizados, como: Máquinas virtuales locales Contenedores Docker Entornos de laboratorio aislados Entornos de pruebas de...

The vulnerability of the TOPAZ Metron PTS time synchronization device, related to the failure to implement measures to neutralize special elements, allows intruders to inject arbitrary OS commands.

The vulnerability of the TOPAZ Metron PTS time synchronization device is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to inject arbitrary OS commands...

pyradm

🔮 pyradm Remote administration crossplatfrom tool via telegram Coded with ❤️ python3 + aiogram3 https://t.me/whlab Screenshots Disclaimer All information contained in this repository is provided for educational and research purposes only The author is not responsible for any illegal use of this...

mose

MOSE Master Of SErvers Copyright 2020 National Technology & Engineering Solutions of Sandia, LLC NTESS. Under the terms of Contract DE-NA0003525 with NTESS, the U.S. Government retains certain rights in this software MOSE is a post-exploitation tool that helps security professionals leverage...

Malicious code in a11y-tabindex-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045 a11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands cat /etc/hosts,...

Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

Malicious code in wcag-color-a11y-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b6e72298f32298d6558f5d52eb7a9d5185b37fe8df14748bf61d6686dde1cb3 Package is advertised as a WCAG color accessibility helper library but ships thunderboltRegistry.js, an IIFE that on module load executes shell...

ida-pro-mcp

IDA Pro MCP !IMPORTANT I recommend using theOfficial Hex-Rays IDA MCP Server instead! See the announcement blog post for more information. Simple MCP Server to allow vibe reversing in IDA Pro. https://github.com/user-attachments/assets/6ebeaa92-a9db-43fa-b756-eececce2aca0 The binaries and prompt...

Malicious code in css-anchor-pos-fallback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0a6c8e1448ffd9abb3732872ea3d49280a422d49524aaa57d0b89a73812f05 The package advertises itself as a CSS anchor-position polyfill but on require executes an IIFE in thunderboltRegistry.js that runs id, whoami, uname...

reconpal

ReconPal：利用NLP进行信息安全侦查 侦察是最重要的阶段之一，看似简单，但要做好却需要付出大量努力和技巧。一个人需要了解正确的工具、正确的查询/语法、运行这些查询、关联信息并清理输出。所有这些对于经验丰富的信息安全/侦察专业人员来说可能很容易，但对于其他人来说，仍然近乎魔法。在聊天中提出简单问题，比如“在新加坡找一台支持UDP的开放Memcached服务器？”或“新加坡有多少IP摄像头使用默认凭据？”然后得到答案，这该有多酷？...

metabigor

Metabigor - OSINT power without API key hassle What is Metabigor? Metabigor maps a target's infrastructure without asking you to register for a single API key. Network ranges, certificates, related domains, exposed ports, CDN vendors, and code leaks - all from free sources, all pipeable into each...

CVE-2025-5548

⚡ CVE-2025-5548: Investigación y explotación de vulnerabilidades Este repositorio proporciona un análisis técnico y una guía de la prueba de concepto para CVE-2025-5548. Esta investigación cubre el ciclo de vida completo de la vulnerabilidad, desde la inspección inicial del binario hasta la...

cypherhound

CypherHound A Python3 terminal application that contains Neo4j cyphers for BloodHound data sets with a script to automate importing them into BloodHound CE. Output Samples Terminal HTML Report HTML Report continued Why? BloodHound is a staple tool for every penetration tester. However, there are...

CVE-2007-1567

🐞 CVE-2007-1567: War FTP Daemon 1.65 - 基于栈的缓冲区溢出 经典的基于栈的缓冲区溢出漏洞，存在于 War FTP Daemon 1.65 中，通过畸形的 FTP 命令演示了老式的远程代码执行技术。 📑 目录 为何存在此仓库 此漏洞为何有趣 背景与受影响软件 关于漏洞 触发崩溃 利用方法 🎓 为何存在此仓库 此仓库是我在讲授内存损坏利用时所使用材料的一部分（除了我的日常工作外，我还在不同的网络安全课程中授课，帮助培养下一代的逆向工程师）。 CVE-2007-1567 是我在介绍完基本的 EIP...

dr_checker

DR.CHECKER : A Soundy Vulnerability Detection Tool for Linux Kernel Drivers This repo contains all the sources, including setup scripts. Now with an Amazing UI to view the warnings along with corresponding source files. Tested on Ubuntu = 14.04.5 LTS Announcements 16 Feb 2018 : DR.CHECKER has bee...