Lucene search
+L

957 matches found

Kitploit
Kitploit
added 2026/09/04 6:19 p.m.5 views

tirith

tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog | Releases Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? root@kitploit: curl -sSL...

6.1AI score
SaveExploits0References38
Kitploit
Kitploit
added 2026/09/04 5:40 p.m.5 views

TeamFiltration

TeamFiltration TeamFiltration은 O365 EntraID 계정을 열거, 스프레이, 유출, 백도어링하기 위한 크로스 플랫폼 프레임워크입니다. TeamFiltration의 작동 방식에 대한 소개는 TeamFiltration 위키 페이지를, 시작 방법은 Quick Start Guide를 참조하십시오! 이 도구는 2021년 1월부터 TrustedSec에서 내부적으로 사용되었으며, DefCON30에서 제 발표 Taking a Dump In The Cloud에서 공개적으로 출시되었습니다. 다운로드 Linux,...

5.6AI score
SaveExploits0References3
Kitploit
Kitploit
added 2026/09/04 9:26 a.m.5 views

metasploitable2-exploitation-metasploit

使用Metasploit攻击Metasploitable2:VSFTPD、Samba等 一份利用Metasploit框架进行渗透测试的实操指南——从PostgreSQL数据库设置和dbnmap扫描开始,通过vsftpd、Samba和UnrealIRCd获取三个root shell,再到使用Netcat提取凭据。 概述 本仓库记录了在一个隔离的VirtualBox实验室中对Metasploitable2进行的完整Metasploit攻击过程。涵盖主题: 设置带PostgreSQL后端和工作区的Metasploit 运行dbnmap将扫描结果直接保存到数据库 利用vsftpd...

8.6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/04 7:53 a.m.5 views

FakeAuth

FakeAuth FakeAuth는 사용자 자격 증명을 요청하고 HTTP 프로토콜을 통해 이를 유출하는 도구입니다. 다음 프로젝트에서 영감을 받았습니다. 1. hlldz's PICKL3 https://github.com/hlldz/pickl3 더러운 코드와 몇 가지 버그가 있을 수 있습니다 ; 설치 특별한 요구 사항 없음 사용법 v1.01 root@kitploit: Usage: FakeAuth.exe Example: FakeAuth.exe 1 1 1 10 windowtitle entercreds 10.0.0.0:80\n hide...

5.4AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/04 6:40 a.m.3 views

agent-vault

HTTPクレデンシャルプロキシ&ボールト Infisical によるオープンソースのクレデンシャルブローカーで、エージェントとそれらが呼び出すAPIの間に位置します。 エージェントはクレデンシャルを保持すべきではありません。Agent Vaultはブローカーアクセスにより、クレデンシャル流出リスクを排除します。 初めてですか?ローンチブログ記事でAgent Vaultの全貌をご覧ください。 ドキュメント | インストール | チュートリアル | ビデオデモ | Slack Agent Vaultの必要性...

5.6AI score
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/03 11:55 p.m.6 views

WifiPassword-Stealer

WifiPassword-Stealer ターゲットコンピュータから全ての登録済みWiFiパスワードを取得します。 インストール Pythonファイルを使用する場合 root@kitploit: pip install smtplib pip install subprocess pip install glob 使用方法 •テンポラリメールを使用して "https://mailtrap.io/" にアカウントを作成します。 •"main.py" に自身の SMTP ユーザー名と SMTP パスワードを設定します。 •以下のコマンドでEXEを作成します。 root@kitploit:...

5.4AI score
SaveExploits0References4
NVD
NVD
added 2026/09/03 1:06 p.m.5 views

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

7.2CVSS
SaveExploits0References2
CVE
CVE
added 2026/09/03 11:22 a.m.11 views

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 fails to validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node ). A shared-workflow editor or any user creating/updating a workflow via the REST API, Public API, or MCP can p...

7.2CVSS5.9AI score
SaveExploits0References2
EUVD
EUVD
added 2026/09/03 11:22 a.m.5 views

EUVD-2026-70401

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

7.2CVSS5.9AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/03 11:22 a.m.32 views

CVE-2026-85166 n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

7.2CVSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/02 5:18 p.m.31 views

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

6.5CVSS0.00313EPSS
SaveExploits0References9
CVE
CVE
added 2026/09/02 5:18 p.m.28 views

CVE-2026-84377

LiteLLM (an AI Gateway/proxy server for LLM APIs) is affected by an authenticated SSRF and provider-credential exfiltration vulnerability prior to versions 1.88.6 and 1.96.2 . The root cause lies in incomplete request validation across multiple proxy files (auth_utils.py, common_request_processin...

6.5CVSS5.8AI score0.00313EPSS
SaveExploits0References9
OSV
OSV
added 2026/09/02 5:18 p.m.4 views

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

6.5CVSS5.8AI score
SaveExploits0References11
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/09/01 5:16 p.m.8 views

Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

5.9AI score
SaveExploits0References2
OSV
OSV
added 2026/09/01 5:16 p.m.5 views

MAL-2026-15813 Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

5.9AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/01 4:44 a.m.2 views

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook-

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook- 2024年2月13日、MicrosoftはMicrosoft Outlookの深刻なセキュリティ脆弱性を公開しました。その識別子はCVE-2024-21413で、Moniker Link脆弱性として知られています。この脆弱性により、攻撃者はOutlookのProtected Viewメカニズムをバイパスできます。 素晴らしい 👍 以下が完全な翻訳 + Penetration Testing PT レポート形式の表現 です。プロフェッショナルで明確な日本語で記述しています。 ご依頼の通...

9.8CVSS8.3AI score0.9466EPSS
SaveExploits24
Kitploit
Kitploit
added 2026/08/30 5:05 p.m.6 views

CVE-2023-7231

CVE-2023-7231 – 重要: Audible fetchResource を介した SSRF → Memcached/Docker RCE チェーン 🔥 概要 この脆弱性により、.audible.com 上の Audible の fetchResource API においてサーバーサイドリクエストフォージェリ SSRF が可能となり、認証されていない攻撃者が内部インフラストラクチャに侵入できるようになります。 SSRF ペイロードの連鎖により、以下を達成しました: 🛡 AWS EC2 メタデータへのアクセス 🐳 127.0.0.1:2375 での Docker ソケットプロービ...

7.3CVSS8.7AI score0.00438EPSS
SaveExploits3
NVD
NVD
added 2026/08/24 4:17 p.m.8 views

CVE-2026-71366

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

7.7CVSS0.00333EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/24 3:42 p.m.9 views

EUVD-2026-64923

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

7.7CVSS5.5AI score0.00333EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/24 3:42 p.m.22 views

CVE-2026-71366

A server-side request forgery (SSRF) vulnerability affects multiple AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) in Red Hat Ansible Automation Platform 2.5 and 2.6 . Notification template URLs are used as direct HTTP request targets without validating against private,...

7.7CVSS5.4AI score0.00333EPSS
SaveExploits0References6
Rows per page
Query Builder