Hwacha

Hwacha https://www.n00py.io/2017/12/raining-shells-on-linux-environments-with-hwacha/ Hwacha是一个用于在Nix系统中快速执行载荷的工具。轻松收集工件或在已获取凭据的整个子网系统上执行Shellcode。 root@kitploit: $python hwacha.py &&&& && && && &&&&&&&&&&&& && && && Created by Esteban Rodriguez /\ &&&&&& && &&&&&&&&&& && Web: https://www.n00py.i...

CVE-2014-4688

CVE-2014-4688 root@kitploit: python3 pfsense.py --rhost 10.10.10.60 --lhost 10.10.14.2 --lport 9999 --username rohit --password pfsense...

xcavator

xcavator 一款利用渗透测试中获取的凭据进行网络数据定位的工具。 Xcavator 是一款扫描 IP 地址范围以查找托管文件的服务（目前支持 FTP、FTPS 和 SMB），并使用给定凭据尝试下载所有可获取的文件，同时在文件中扫描感兴趣的字符串的工具。 另一种模式是仅下载文件名与正则表达式（RegEx）匹配的文件。 由 Nikos Laleas 开发，联系邮箱 nikos d0t laleas at nccgroup d0t com 基于 AGPL 协议发布。更多信息请参阅 LICENSE。 先决条件 Python 3.3 和...

POC-CVE-2022-28117

CVE 2022 28117 PoC Python 稍作修改 用法 : python3 .\poccve2022-28117.py -x file:///etc/passwd -u username -p password http://192.168.148.140/navigate...

cve-2024-42327

cve-2024-42327 usage: cve-2024-42327.py -h -u URL -n USERNAME -p PASSWORD --example cve-2024-42327.py: error: the following arguments are required: -u/--url, -n/--username, -p/--password...

netgear-telenetenable

telnetenable.py，作者 Paul Gebheim 由 insanid 修改以适配较新的 Netgear 路由器（R7000、R7500） 翻译自 C 源码，源码见 http://wiki.openwrt.org/toh/netgear/telnet.console 运行方式： python telnetenable.py IP - 你的 Netgear 设备的 IP，通常为 192.168.1.1 MAC - MAC 地址应为你的 Netgear 设备 LAN 口的 MAC 地址，不带 ":"。例如："00:40:5E:21:14:4E" 应写成 "00405E21144E...

n8n-nodes-sqlite3 vulnerable to path traversal via user-controlled database file path (db_path parameter)

Affected versions 1.0.0 Patched version 1.0.0 Description In versions prior to 1.0.0, the SQLite node accepted the database file path as a direct node parameter visible and editable in the workflow. A workflow author who mapped untrusted user input to the dbpath field could allow an attacker to...

Exploit for CVE-2026-19295

Description Proof o...

CVE-2026-56577

HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks...

CVE-2026-56577 HCL MyCloud affected by Weak Password Policy

HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks...

Containing a domain compromise: How predictive shielding shut down lateral movement

In this article 1. Predictive shielding overview 2. Attack chain overview 3. How predictive shielding changed the outcome 4. MITRE ATT&CK® techniques observed 5. Learn more In identity-based attack campaigns, any initial access activity can turn an already serious intrusion into a critical incide...

Google Introduces Agentic AI to Combat Cybersecurity Threats

Google enhances cybersecurity with Agentic AI, launching Unified Security to fight zero-day exploits, enterprise threats, and credential-based attacks.…...

Timing is Everything: The Role of Just-in-Time Privileged Access in Security Evolution

To minimize the risk of privilege misuse, a trend in the privileged access management PAM solution market involves implementing just-in-time JIT privileged access. This approach to privileged identity management aims to mitigate the risks associated with prolonged high-level access by granting...

Healthy security habits to fight credential breaches: Cyberattack Series

Fifty percent of Microsoft cybersecurity recovery engagements relate to ransomware,1 and 61 percent of all breaches involve credentials.2 In this second report in our ongoing Cyberattack Series, we look at the steps taken to discover, understand, and respond to a push-bombing request that targete...

SUSE CVE-2018-3775

Improper Authentication in Nextcloud Server prior to version 12.0.3 would allow an attacker that obtained user credentials to bypass the 2 Factor Authentication...

Zyxel AX7501-B0 安全漏洞

The Zyxel AX7501-B0 is a router from China Heqin Zyxel. A security vulnerability exists in the Zyxel AX7501-B0 version prior to V5.17ABPC.3C0. An attacker could exploit the vulnerability to access WLAN services using credentials...

CVE-2022-20963

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of an affected device. This vulnerability is due to...

CVE-2022-37144

The PlexTrac platform prior to API version 1.17.0 does not restrict excessive MFA TOTP submission attempts. An unauthenticated remote attacker in possession of a valid username and password can bruteforce their way past MFA protections to login as the targeted user...

CheckMK Raw Edition 安全漏洞

tribe29 CheckMK Raw Edition is a comprehensive and flexible IT monitoring system from tribe29, Germany. A security vulnerability exists in CheckMK Raw Edition that originates from a successful exploit that requires the use of valid credentials or a user with the administrator role to hijack a...

Unauthorized Access Vulnerability in PoE Infrared Webcam of P&L Technologies Ltd.

hereinafter referred to as "TP-LINK" is a leading global supplier of network communication equipment. TP-LINK's PoE infrared webcam has an unauthorized access vulnerability, which can be exploited by attackers to directly steal real-time video streams by constructing usernames and passwords at...