toolkit

English | Español Indetectables Toolkit 设计为一把瑞士军刀，这个精选工具包对于恶意软件分析师、破解者和网络安全专家来说极具价值。它经过精心打造，可同时支持新手和经验丰富的用户。 该工具包是对我们网站中手册和编号理论镜像的补充。 优势 1. 全面 ：包含处理简单和复杂场景所需的全部基本工具。 2. 自动更新 ：集成了自定义的 Universal Updater，可自动保持工具更新。 3. 可扩展 ：通过更新 bin\updater\tools.ini 并在 bin\sendto\sendto 中链接，即可轻松添加新工具。 4. 自动安装...

RightHand-Persistence

RightHand Persistence 灵感来源于 CVE-2026-21509 用于持久化的 C++ COM 上下文菜单处理程序 一个使用 C++ 和 COM 实现的 Windows 上下文菜单处理程序示例，展示了隐蔽的持久化技术。通过注册自定义 COM 对象，当用户在 Windows 资源管理器中右键单击特定目标（文件、文件夹或背景）时，你的代码将执行。 免责声明： 本项目仅供教育和研究目的使用。此处演示的技术可能被用于恶意用途。作者不赞同将本代码用于任何非法活动。请负责任地使用此知识，并遵守道德规范。 POC 开始使用 前提条件 C++ 编译器（例如 Visual Studio...

burpsuite-copy-as-xmlhttprequest

Copy as XMLHttpRequest BurpSuite 扩展 该扩展为BurpSuite添加了一个上下文菜单，允许您将多个请求复制为JavaScript的XmlHttpRequest，从而简化了利用XSS时的PoC开发。 安装 从发行版下载最新的JAR或手动构建 通过标签页将JAR添加到BurpSuite：'扩展器' - '扩展' - '添加' 用法 从任何标签页中选择一个请求，或从'代理' - 'HTTP历史记录'标签页中选择多个请求 调用上下文菜单并选择'复制为XMLHttpRequest'...

SqlMap_BurpSuite

SqlMapBurpSuite 编译好的sqlmap.jar https://github.com/jas502n/SqlMapBurpSuite/blob/master/burpsqlmap/out/artifacts/burpsqlmapjar/burpsqlmap.jar grep -r "send to Sqlmap" src/burp/SnifferContextMenuFactory.java: JMenuItem jMenuItem = new JMenuItem"send to Sqlmap"; JMenuItem jMenuItem = new JMenuItem"se...

generator-burp-extension

Burp Extension Generator Installation First, install Yeoman and generator-burp-extension using npm we assume you have pre-installed node.js. npm install -g yo npm install -g generator-burp-extension Then generate your new project: yo burp-extension Burp Extension features When you generate your...

ContextMenuHijack

ContextMenuHijack Esta idea original que me inspiró es de @NinjaParanoid: ContextMenuHijack es una técnica de persistencia sencilla que utiliza el secuestro de COM basado en el comportamiento humano: cuando haces clic derecho sobre un archivo/carpeta en el Explorador de archivos para abrir el men...

Astra Linux – Vulnerability in Firefox

When a user opened the Web Extensions context menu, the Web Extension could access the post-redirect URL of the clicked element. If the Web Extension did not have the necessary WebRequest permissions for the hosts involved in the redirection, this would constitute a same-origin violation, allowin...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Web Browser UI of Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the contents of an iframe dialog context menu via a crafted HTML page. Chromium security severity: Low...

CVE-2026-73250

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory $INSTDIR from PowerEditor/installer/nppSetup.nsi into a PowerShell -Command string used by RegisterMSIX to invoke...

CVE-2026-57501

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link t...

CVE-2026-57501

Summary: CVE-2026-57501 affects Zen, a Firefox-based browser. Before version 1.21.5b, the contextual actions “Open link in glance” and “Split link in new tab” could load a page-controlled link URL with the System principal rather than the originating page’s principal, allowing a malicious page to...

CVE-2026-57501 Zen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link t...

CVE-2026-57501 Zen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link t...

CVE-2026-57501

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link t...

CVE-2026-57501 Zen: Context-menu "Open link in glance" / "Split link in new tab" loads a page-controlled link with the System principal, bypassing the web-content scheme restriction

Zen is a firefox-based browser. Prior to 1.21.5b, Zen's glance and split-view context-menu actions, Open link in glance and Split link in new tab, load a page-controlled link URL with the System principal instead of the originating page's principal, allowing a malicious web page to place a link t...

PT-2026-57005

Name of the Vulnerable Software and Affected Versions Zen versions prior to 1.21.5b Description In the glance and split-view context-menu actions, specifically Open link in glance and Split link in new tab, the browser loads a page-controlled link URL using the System principal instead of the...

MAL-2026-3269 Malicious code in @bcs-react-ui/context-menu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d7735468c4f2cdf66767c4b52a6a089b195ea5bb820b82a03690fb0c9586bc The package @bcs-react-ui/context-menu was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview @bcs-react-ui/context-menu is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-33051

Craft CMS is a content management system CMS. In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw combined with Craft::t string interpolation. A low-privileged control panel user...

CVE-2026-33051 Craft CMS Vulnerable to Stored XSS in Revision Context Menu

Craft CMS is a content management system CMS. In versions 5.9.0-beta.1 through 5.9.10, the revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw combined with Craft::t string interpolation. A low-privileged control panel user...