Follina-Workaround-CVE-2022-30190

Follina workaround CVE-2022-30190 Description These two scripts can be used to apply the workaround provided by Microsoft to mitigate the vulnerability CVE-2022-30190 as detailed in the MSRC blog and to restore the workaround, should an official patch be released. The first script...

sharepoint-toolshell-micro-postmortem

Micro-Postmortem de Incidente — Campaña “ToolShell” de Microsoft SharePoint On-Prem Este kit realiza el triaje de la campaña de día cero “ToolShell” de mediados de 2025 contra Microsoft SharePoint Server local on-premises ; SharePoint Online queda fuera de alcance. Proporciona búsquedas hunts,...

CVE-2019-2618

PoC POST /beawlsdeploymentinternal/DeploymentService HTTP/1.1 Host: 127.0.0.1:7001 User-Agent: Mozilla/5.0 X11; Ubuntu; Linux i686; rv:20.0 Gecko/20100101 Firefox/20.0 Accept: text/html, image/gif, image/jpeg, /; q=.2 Connection: keep-alive username: weblogic password: weblogic wlrequesttype:...

GHSA-4672-HWV6-GQ62 Trigger.dev: Cross-environment deployment cancel

Summary Trigger.dev isolates each project into multiple environments dev, staging, prod, and per-PR preview branches, each with its own secret API key — the environment is a trust boundary a dev/preview/CI key is lower-trust than a prod key. Most API routes enforce this by scoping resource lookup...

CrushFTP10-Docker-CVE-2024-4040

CrushFTP 10.0 Docker Deployment vulnerable to CVE-2024-4040 This repository provides a Dockerfile to build a Docker image and deploy a Linux container with a CrushFTP server that is vulnerable to the CrushFTP VFS Sandbox Escape Vulnerability CVE-2024-4040. ⚠️ Disclaimer This repository is provided...

CollaRE

CollaRE v1.4 Introduction CollaRE is a tool for collaborative reverse engineering that aims to allow teams that do need to use more then one tool during a project to collaborate without the need to share the files on a separate location. It also contains a very simple user management and as such...

PSpersist

PSpersist Dropping a powershell script at %HOMEPATH%\Documents\windowspowershell\ , that contains the implant's path , and whenever powershell process is created, the implant will executed too. DEMO...

zimbra-cve-2026-73570-ir

Zimbra CVE-2026-73570 Community IR Toolkit Detection-first, evidence-preserving incident-response helpers for Zimbra administrators investigating suspected exploitation of CVE-2026-73570. !CAUTION This is an independent community project, not a vendor compromise oracle. The checker is read-only a...

aiiroverlay

Why an overlay, not a replacement. The thesis. Part of the AI IR Overlay™ framework. SeeCONTENTMAP.md for the full repository map. The AI IR Overlay: Framework Overview Current release: v0.35.0 · 2026-07-09 · CHANGELOG A practical incident-response baseline for AI agents in production. Adapt and...

St2-052

S2-052 POC Testing Original title: Tomcat Deploying war Original article: http://blog.csdn.net/caiqiiqi/article/details/77861477 Download the last affected version struts-2.5.12 from the Struts2 official website: http://archive.apache.org/dist/struts/2.5.12/struts-2.5.12-apps.zip Note that you on...

ssh-honeypot-research

🍯 SSH Honeypot — Research & Threat Intelligence A medium-interaction Cowrie honeypot deployed on a rented public-internet Linux VPS, designed to attract, log and analyse real-world SSH brute-force traffic. Over an 8-day capture window the sensor recorded 37,477 sessions from 1,582 unique attacker...

CVE-2026-48907-Joomla-JCE-detection

Joomla JCE CVE-2026-48907 — Validación de PoC, Artefactos de Webshell y Detección para SOC Informe de validación defensiva y notas de detección orientadas a SOC para CVE-2026-48907 que afecta a Joomla Content Editor JCE versiones hasta 2.9.99.4. Propósito del repositorio Este repositorio document...

WindowsFirewallRuleset

Windows Firewall Ruleset !Alt Textcorporate firewall Table of Contents Windows Firewall Ruleset Table of Contents About Windows Firewall Ruleset Firewall rules Firewall framework The vision of this firewall License Requirements Requirements details I don't meet the requirements First time user...

mig

MIG: Mozilla InvestiGator MIG es la plataforma de Mozilla para la investigación quirúrgica de endpoints remotos. ⚠️ Aviso de desuso ⚠️ Mozilla ya no mantiene el proyecto Mozilla InvestiGator MIG. Mozilla tampoco utiliza este código internamente. Eres bienvenido a usar este código tal cual, sin...

MozDef

MozDef: ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla Enterprise Defense Platform MozDef project. Please fork it to continue development. Documentation: https://mozdef.readthedocs.org/en/latest/ Give MozDef a Try in AWS: The following button will launch the Mozilla...

golismero

What's GoLismero? GoLismero is an open source framework for security testing. It's currently geared towards web security, but it can easily be expanded to other kinds of scans. The most interesting features of the framework are: Real platform independence. Tested on Windows, Linux, BSD and OS X. ...

vulnreport

Abandoned Project This project is not currently maintained and has been abandoned. Vulnreport Pentesting management and automation platform Vulnreport is a platform for managing penetration tests and generating well-formatted, actionable findings reports without the normal overhead that takes up...

wildPwn

wildPwn - WildFly Exploitation Tool It is a tool for WildFly. Tool can be used to brute force or shell deploy. wildPwn.war contains modified Laudanum Shell. userList.txt contains common usernames and passList.txt contains common passwords. Usage Bruteforce python wildPwn.py -m brute --target -use...

trident

trident El proyecto Trident es una herramienta automatizada de rociado de contraseñas desarrollada para cumplir con los siguientes requisitos: La capacidad de ser desplegado en varias plataformas en la nube/proveedores de ejecución La capacidad de programar campañas de rociado de acuerdo con la...

ransomwatch

RansomWatch RansomWatch is a ransomware leak site monitoring tool. It will scrape all of the entries on various ransomware leak sites, store the data in a SQLite database, and send notifications via Slack or Discord when a new victim shows up, or when a victim is removed. Note: RansomWatch isn't...