azbelt

azbelt Azure 관련 자격 증명을 열거하기 위한 독립형 DLL 및 sliver 확장주로 AAD 가입 머신에서 모듈 aadjoin - NetGetAadJoinInformation을 통해 머신의 AAD 상태 정보를 가져옵니다. credman - 자격 증명 관리자에서 자격 증명을 가져옵니다. env - 비밀을 포함할 수 있는 Azure/AAD 관련 환경 변수를 찾습니다. managed - 관리 ID가 있는 머신 정보를 얻기 위해 IMDS 엔드포인트를 호출합니다. msal - 다양한 MSAL 캐시에서 토큰을 찾습니다...

Atlas

Atlas Atlas is a cross-platform Windows/Linux network execution and security assessment toolkit built on top of TrustedSec's Titanis protocol library. It is inspired by the workflow of NetExec/CrackMapExec: target lists, credential sets, modular enumeration, and compact HH:mm:ss + host - message...

kerbrute

kerbrute Скрипт для выполнения брутфорса Kerberos с использованием библиотеки Impacket. При выполнении на вход подаётся пользователь или список пользователей, а также пароль или список паролей. Затем выполняется атака методом перебора для обнаружения: Действительные пары «имя пользователя:пароль»...

plown

О программе Plown — это сканер безопасности для CMS Plone. Хотя Plone имеет лучшие показатели безопасности среди всех крупных CMS и считается высокозащищённой системой, неправильные конфигурации и слабые пароли могут привести к взлому. Plown разработан для упрощения поиска имен пользователей и...

CVE-2025-26788

CVE-2025-26788 환경구축 1단계 - Docker Desktop 실행 확인 docker version 2단계 - 이미지 빌드 cd C:\Users\jhcho\Desktop\passkey\CVE-2025-26788 docker build -t skfs . 3단계 - 컨테이너 실행 docker run -d --name skfs --hostname skfs.localdomain --privileged --cgroupns=host -v /sys/fs/cgroup:/sys/fs/cgroup:rw --tmpfs /run...

OracleOTM

OracleOTM Python-инструмент для эксплуатации CVE-2021-35616 Скрипт работает по модулям, которые я реализовал в следующем порядке: ► Перебор имен пользователей ► Поиск учетных данных по умолчанию ► Выполнение SQL-запроса через сервлет DBXML ► Полная эксплуатация и выполнение JSP Синтаксис скрипта...

Bludit-3-9-2-bb

Bludit-3-9-2-bb Bludit 3.9.2 - 브루트포스 우회 - CVE-2019-17240 CVE-2019-17240 기반의 매우 간단한 스크립트입니다. 원본 POC 및 설명: https://github.com/bludit/bludit/pull/1090. root@kitploit: usage: python ./bludit-3-9-2-bb.py -l 'http://sitename.com/admin/login' -u ./usernamesfilelist.txt -p ./passwordsfilelist.txt -l :...

EUVD-2026-74846

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity t...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-84674

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin (version 26.1.0 and earlier) allow an attacker with Overall/Read permission to enumerate the IDs of credentials stored in Jenkins. The CVSS v3.1 base score is 5.4 (Medium) , reflecting a network-vector attack with low complexity and ...

EUVD-2026-70147

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-48767

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-48767 Google Sheets OAuth access token disclosure to guest members via getAccessToken

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-48767 Google Sheets OAuth access token disclosure to guest members via getAccessToken

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-70444

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70447

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70433

Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

CVE-2026-70447

Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...