tirith

tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog | Releases Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? root@kitploit: curl -sSL...

TeamFiltration

TeamFiltration TeamFiltration은 O365 EntraID 계정을 열거, 스프레이, 유출, 백도어링하기 위한 크로스 플랫폼 프레임워크입니다. TeamFiltration의 작동 방식에 대한 소개는 TeamFiltration 위키 페이지를, 시작 방법은 Quick Start Guide를 참조하십시오! 이 도구는 2021년 1월부터 TrustedSec에서 내부적으로 사용되었으며, DefCON30에서 제 발표 Taking a Dump In The Cloud에서 공개적으로 출시되었습니다. 다운로드 Linux,...

metasploitable2-exploitation-metasploit

使用Metasploit攻击Metasploitable2：VSFTPD、Samba等 一份利用Metasploit框架进行渗透测试的实操指南——从PostgreSQL数据库设置和dbnmap扫描开始，通过vsftpd、Samba和UnrealIRCd获取三个root shell，再到使用Netcat提取凭据。 概述 本仓库记录了在一个隔离的VirtualBox实验室中对Metasploitable2进行的完整Metasploit攻击过程。涵盖主题： 设置带PostgreSQL后端和工作区的Metasploit 运行dbnmap将扫描结果直接保存到数据库 利用vsftpd...

FakeAuth

FakeAuth FakeAuth는 사용자 자격 증명을 요청하고 HTTP 프로토콜을 통해 이를 유출하는 도구입니다. 다음 프로젝트에서 영감을 받았습니다. 1. hlldz's PICKL3 https://github.com/hlldz/pickl3 더러운 코드와 몇 가지 버그가 있을 수 있습니다 ; 설치 특별한 요구 사항 없음 사용법 v1.01 root@kitploit: Usage: FakeAuth.exe Example: FakeAuth.exe 1 1 1 10 windowtitle entercreds 10.0.0.0:80\n hide...

agent-vault

HTTPクレデンシャルプロキシ＆ボールト Infisical によるオープンソースのクレデンシャルブローカーで、エージェントとそれらが呼び出すAPIの間に位置します。 エージェントはクレデンシャルを保持すべきではありません。Agent Vaultはブローカーアクセスにより、クレデンシャル流出リスクを排除します。 初めてですか？ローンチブログ記事でAgent Vaultの全貌をご覧ください。 ドキュメント | インストール | チュートリアル | ビデオデモ | Slack Agent Vaultの必要性...

WifiPassword-Stealer

WifiPassword-Stealer ターゲットコンピュータから全ての登録済みWiFiパスワードを取得します。 インストール Pythonファイルを使用する場合 root@kitploit: pip install smtplib pip install subprocess pip install glob 使用方法 •テンポラリメールを使用して "https://mailtrap.io/" にアカウントを作成します。 •"main.py" に自身の SMTP ユーザー名と SMTP パスワードを設定します。 •以下のコマンドでEXEを作成します。 root@kitploit:...

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 fails to validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node ). A shared-workflow editor or any user creating/updating a workflow via the REST API, Public API, or MCP can p...

EUVD-2026-70401

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

CVE-2026-85166 n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow e.g., the Workflow Tool node. A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can...

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

CVE-2026-84377

LiteLLM (an AI Gateway/proxy server for LLM APIs) is affected by an authenticated SSRF and provider-credential exfiltration vulnerability prior to versions 1.88.6 and 1.96.2 . The root cause lies in incomplete request validation across multiple proxy files (auth_utils.py, common_request_processin...

CVE-2026-84377 LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parameters

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls and cause the proxy to send its configured provider credentials t...

Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

MAL-2026-15813 Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook-

THM---CVE-2024-21413-Moniker-Link-Microsoft-Outlook- 2024年2月13日、MicrosoftはMicrosoft Outlookの深刻なセキュリティ脆弱性を公開しました。その識別子はCVE-2024-21413で、Moniker Link脆弱性として知られています。この脆弱性により、攻撃者はOutlookのProtected Viewメカニズムをバイパスできます。 素晴らしい 👍 以下が完全な翻訳 + Penetration Testing PT レポート形式の表現 です。プロフェッショナルで明確な日本語で記述しています。 ご依頼の通...

CVE-2023-7231

CVE-2023-7231 – 重要: Audible fetchResource を介した SSRF → Memcached/Docker RCE チェーン 🔥 概要 この脆弱性により、.audible.com 上の Audible の fetchResource API においてサーバーサイドリクエストフォージェリ SSRF が可能となり、認証されていない攻撃者が内部インフラストラクチャに侵入できるようになります。 SSRF ペイロードの連鎖により、以下を達成しました: 🛡 AWS EC2 メタデータへのアクセス 🐳 127.0.0.1:2375 での Docker ソケットプロービ...

CVE-2026-71366

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

EUVD-2026-64923

A server-side request forgery SSRF vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the target address against private, loopback, ...

CVE-2026-71366

A server-side request forgery (SSRF) vulnerability affects multiple AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) in Red Hat Ansible Automation Platform 2.5 and 2.6 . Notification template URLs are used as direct HTTP request targets without validating against private,...