opencast-CVE-2021-43821-env

opencast-CVE-2021-43821-env opencast cve-2021-43821敏感信息泄露漏洞环境 复现文章：https://mp.weixin.qq.com/s/fjna3mHraPmEy1b1wnEYrQ...

s2-048

s2-048 Exploit para s2-048, CVE-2017-9791. root@kitploit: / \ \ / / | | \ / / | | / \ / / | | | \ \ / /| | | | | | | / /| | / / | | | | \ V / | ||/ /| || | | / /, |/ / , | | | / || ||/||// //// //|| poc: root@kitploit:...

Fireaway

FireAway-Next Generation Firewall Bypass Tool v0.2 Fireaway is a tool for auditing, bypassing, and exfiltrating data against layer 7/AppID inspection rules on next generation firewalls, as well as other deep packet inspection defense mechanisms, such as data loss prevention DLP and application...

Fireaway

FireAway-下一代防火墙绕过工具 v0.2 Fireaway 是一款用于审计、绕过和从下一代防火墙的第7层/AppID检测规则以及其他深度包检测防御机制（如数据丢失防护（DLP）和感知应用的代理）中窃取数据的工具。这些策略基于必须允许连接通过NGFW才能看到第7层数据以进行过滤的原则，以及通过伪造应用程序来隐藏通信信道，使其在防火墙日志中看起来像正常用户流量（例如上网浏览）。在绕过数据丢失防护工具时，Fireaway...

monkey

Monkey documentation This folder contains the Monkey Documentation site. For more information see content/development/contribute-documentation.md...

cansina

Cansina Cansina is a Web Content Discovery Application. It is well known Web applications don't publish all their resources or public links, so the only way to discover these resources is requesting for them and check the response. Cansina duty is to help you making requests and filtering and...

CVE-2017-5638

LAB 1 — Inyección OGNL en Apache Struts2 CVE-2017-5638 / S2-045 I. ANÁLISIS DEL SISTEMA Análisis de la superficie de ataque Después de iniciar el contenedor, los registros de Struts2 muestran que la aplicación carga archivos de configuración conocidos como struts-default.xml , struts-plugin.xml y...

turkce-wordlist

本项目不包含任何电子邮件地址、姓名、电话号码等个人数据。密码仅用于学术目的列出。无法将密码与真实个人关联。 土耳其语词汇表 这是一项用于分析土耳其用户密码选择的研究。通过识别互联网泄露的电子邮件和密码数据中的土耳其语词汇来实现。 有关研究的详细信息，请阅读以下博客文章： https://utkusen.com/blog/rockyou-wordlistindeki-turkce-parolalarin-tespiti.html https://utkusen.com/blog/turkce-wordlist-calismasinda-ikinci-faz.html 如需贡献，请查看...

CVE-2016-2098-my-first-exploit

CVE-2016-2098-my-first-exploit Este exploit es una vulnerabilidad de ejecución remota de código en Ruby-on-Rails cuando se utiliza render sobre datos proporcionados por el usuario. Está escrito en python3, y recuerda instalar la librería requests. Aquí está el comando. root@kitploit: pip3 install...

OSSEM

开源安全事件元数据 OSSEM 一个社区主导的项目，主要关注安全事件日志的文档化、标准化和建模。 https://ossemproject.com/intro.html 目标 定义并共享一个通用数据模型，以改善安全事件日志的数据标准化和转换 定义并共享安全事件日志中识别出的数据结构和关系 以字典格式向社区提供多个安全事件日志的详细信息 了解更多关于安全事件日志的信息（Windows、Linux、macOS、Azure、AWS等） 项目结构 数据字典 DD: 包含按操作系统及其相应数据提供者组织的多个安全事件日志的特定信息。 每个字典描述单个事件日志及其对应的字段名称。...

CVE-2023-28432

CVE-2023-28432 CVE-2023-28432 MinIO敏感信息泄露检测脚本 Usage root@kitploit: go mod tidy go build main.go ./main -u 'http://example.com'...

libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks

An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity...

Malicious code in simple-date-formatter-new-16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e57e9eff2fae987a2a23e3107d64c818e020b03380e31d6a3ae9cf8d4eb14ec package.json declares a postinstall lifecycle script that pipes a string-reversed shell one-liner through rev | bash, decoding to a bash reverse shel...

Malicious code in eslint-config-compact-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc01e3a8316b2d4e11b34a9c8cbe1cf5bd2af83a6a70052e40a22b54f13f78b index.js executes on module load and collects host reconnaissance data — os.platform, os.hostname, os.userInfo.username, architecture, Node version,...

Malicious code in aliftech-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61479316af4cfc0884dfe88744a0ed14fa64e052471cc216667c80502689860 postinstall.js runs automatically on npm install and reads os.hostname and os.userInfo.username, then issues an https.get to a hardcoded webhook.site...

Malicious code in @nf-addons/am-global-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f4f7297a2ae76eee65506183462a7138df6115ee2bfad9c84878b7f3c7998c8 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That module reads os.userInfo.usernam...

cve-2023-0669-simulation

Estructura del proyecto cve-2023-0669-simulation/ ├── docker-compose.yml ├── attacker/ │ ├── Dockerfile │ └── CVE20230669helper.java ├── vulnerable/ │ ├── Dockerfile │ └── VulnerableServer.java ├── listener/ │ ├── Dockerfile │ └── server.py └── received/ ← creado automáticamente exfiltración 2...

android-locdump

Tras la indignación/sobrerreacción de los últimos días en internet ante la revelación de que el iPhone tiene una caché para su servicio de localización, decidí echar un vistazo a lo que mis dispositivos Android almacenan en caché para la misma función. Este es un volcador rápido que armé para...

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...

kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...