Malicious code in checkmate-remediation-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f55d0ebeea19e228ec6edbb1782df87539c476478d3935559fda90a458b1b4 The package's package.json declares a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, the home...

Malicious code in css-kfvwax-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2041e61cd16558aaaeac8a2f26024866a6b949d93817f78de744c5c1781023df On require, thunderboltRegistry.js runs an IIFE that shells out via childprocess to collect host identity id, whoami, uname -a, network interface...

creepy

creepy 현재 버전 1.1 저자 Yiannis Kakavas 홈페이지 http://www.geocreepy.com 설치 안내 http://www.geocreepy.com 참조 설명 지리적 위치 기반 OSINT 도구입니다. Creepy는 지리적 위치 정보를 수집하는 OSINT 도구입니다. 온라인 소스에서 위치 관련 정보를 수집하고, 지도에 표시하고, 정확한 위치 및/또는 날짜를 기준으로 검색 필터링을 제공하며, CSV 형식이나 KML로 내보내어 Google Maps에서 추가 분석이 가능합니다. 특별 감사 Creepy 아이콘 ...

CVE-2026-102775

The Joomla Extension - phoca.cz (specifically Phoca Cart versions 5.0.0 - 6.1.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the order-file download endpoint. The application fails to validate provided d (download token) and o (order token) parameters against stored value...

datasploit

Overview of the tool: Performs OSINT on a domain / email / username / phone and find out information from different sources. Correlate and collaborate the results, show them in a consolidated manner. Tries to find out credentials, api-keys, tokens, subdomains, domain history, legacy portals, etc...

flashsploit

Exploitation Framework for ATtiny85 HID Attacks Twitter - Telegram - Blog Available in Flashsploit is an Exploitation Framework for Attacks using ATtiny85 HID Devices such as Digispark USB Development Board, flashsploit generates Arduino IDE Compatible .ino Scripts based on User Input and then...

EvilSelenium

EvilSelenium EvilSelenium is a new project that weaponizes Selenium to abuse Chromium-based browsers. The current features right now are: Steal stored credentials via autofill Steal cookies Take screenshots of websites Dump Gmail/O365 emails Dump WhatsApp messages Download & exfiltrate files Add...

Ultimate-Social-Scrapers

Ultimate Social Scrapers by Cyfy Labs 📢 Important Update 📢 Cyfy Labs is no longer active. Thank you for all your support on this journey! 🫶 Cyfy Labs provides modern social media scraping tools. Our products enable businesses and researchers to collect hundreds of public data points for use cases...

SQLbit

SQL Blind Injection Tool A tool for blind SQL injections that uses multithreaded bitwise comparisons to find values of cells in SQL-tables. Works with SQLite at least and supports cookies. It's able to: Search cell values by columns in a table Search characters count in a cells by columns in a...

CVE-2023-44765_ConcreteCMS-Stored-XSS---Associations

ConcreteCMS XSS v2.2.18 작성자: Sergio 설명: ConcreteCMS v.9.2.1의 크로스 사이트 스크립팅Cross Site Scripting 취약점으로 인해 로컬 공격자가 System & Settings의 Data Objects에 있는 Plural Handle에 조작된 스크립트를 통해 임의 코드를 실행할 수 있습니다. 공격 벡터: 스크립팅 취약점으로, "Data Objects from System & Settings"의 Plural Handle 항목에 대한 위생 처리sanitization 취약점이 있...

CVE-2018-1273

CVE-2018-1273 CVE-2018-1273 환경 CVE-2018-1273: Spring Data Commons에서의 RCE https://pivotal.io/security/cve-2018-1273 애플리케이션 https://github.com/spring-projects/spring-data-examples/tree/master/web/example 빌드 $ docker build -t cve-2018-1273 . 실행 $ docker run -d -p 8080:8080 cve-2018-1273 웹...

Twitter-Info

트위터 정보 트위터 계정 정보를 가져오는 간단한 파이썬 스크립트입니다. 다음과 같은 정보를 가져옵니다: 이름 팔로잉 팔로워 좋아요 계정 생성일 프로필 사진 사용자 이름 또는 프로필 링크만 있으면 됩니다. 사용법 python3 twitterinfo.py or 예시 입력 python twitterinfo.py ngll 출력 Name: Nigella Tweets: 30 Following: 8 Followers: 4 Likes: 9 Account made in: 10:45 - 31 Oca 2017 Full profile picture...

RpcInvestigator

RPC Investigator Please read our blog post announcement. RPC Investigator RPCI is a .NET/C Windows Forms UI application that provides an advanced discovery and analysis interface to Windows RPC endpoints. The tool provides a visual interface around the existing core RPC capabilities of the...

loboguara

Lobo Guará - 사이버 위협 인텔리전스 플랫폼 Lobo Guará 는 사이버 보안 전문가를 대상으로 다양한 사이버 위협 인텔리전스CTI 기능을 제공하는 플랫폼입니다. 위협 식별, 데이터 유출 모니터링, 의심스러운 도메인 및 URL 분석 등을 더 쉽게 해주는 도구를 제공합니다. 기능 1. SSL 인증서 검색 조직에 위협이 될 수 있는 도메인과 서브도메인을 식별할 수 있습니다. 신뢰할 수 있는 인증 기관에서 발급한 SSL 인증서가 실시간으로 색인되며, 사용자는 4자 이상의 키워드로 검색할 수 있습니다. 참고 : 현재...

loboguara

Lobo Guará - Cyber Threat Intelligence Platform Lobo Guará is a platform aimed at cybersecurity professionals, with various features focused on Cyber Threat Intelligence CTI. It offers tools that make it easier to identify threats, monitor data leaks, analyze suspicious domains and URLs, and much...

FACT

Forensic Artefact Collection Tool Overview FACT is a tool to collect, process and visualise forensic data from clusters of machines running in the cloud or on-premise. Deployment For a basic single-node deployment, we recommend using Docker and Docker Compose. First, read docker-compose.yaml for...

CVE-2025-54794-Hijacking-Claude-AI-with-a-Prompt-Injection-The-Jailbreak-That-Talked-Back

🧠 CVE-2025-54794: Hijacking Claude AI with a Prompt Injection – The Jailbreak That Talked Back By Aditya Bhatt | Offensive Security Specialist | Red Team Operator | VAPT Addict ⚔️ Introduction: When Your AI Can Be Hacked With Words In an era where language models have become the co-pilots of our...

Spring_cve-2022-22980

Springcve-2022-22980 spring data mongodb remote code execution | cve-2022-22980 poc Description A Spring Data MongoDB application is vulnerable to SpEL injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value...

-CVE-2022-1609

CVE-2022-1609 Bash poc for CVE-2022-1609 WordPress Weblizar Backdoor How to install ? wget https://raw.githubusercontent.com/0xSojalSec/CVE-2022-1609/main/exploit.sh chmod +x exploit.sh ./exploit.sh How to use it ? GH0ST3exP10it$ ./exploit.sh http://127.0.0.1:8080 + Targeting http://127.0.0.1:808...

Cloakify

CloakifyFactory CloakifyFactory & the Cloakify Toolset - Data Exfiltration & Infiltration In Plain Sight; Evade DLP/MLS Devices; Social Engineering of Analysts; Defeat Data Whitelisting Controls; Evade AV Detection. Text-based steganography using lists. Convert any file type e.g. executables,...