honeypot-auditor

.. | :: H-AUDITOR :: v1.0.3 :: "DIALING IN... CARRIER DETECTED" :: | |------------------------------------------------------------------------------| | "warez? nah. headers. we trade banners, not bins." | | "if it answers any password, it ain't production — it's a lure." | | "respect the sysop...

cve-2023-23397-purple-team

CVE-2023-23397 — Purple Team: Exploit + Detection Two halves of one project against the same Outlook NTLM-leak vulnerability CVE-2023-23397: Red team done: phishing delivery + exploitation of CVE-2023-23397 against a Windows 10 victim VM, full writeup in FINALPROJECTREPORT.pdf, walkthrough in...

qlcoder

QLCoder Agentic Framework for Synthesizing CodeQL Queries Table of Contents Overview Installation Docker Recommended Native Linux Usage Quick Start Development Tooling Examples Paper Environment Contributions Team Citation Affiliated Projects Overview QLCoder is a framework for using LLMs to...

Learning-to-Detect

Learning to Detect Unknown Jailbreak Attacks in Large Vision-Language Models Official implementation of “Learning to Detect Unknown Jailbreak Attacks in Large Vision-Language Models.” This repository contains the data-processing, hidden-state extraction, classifier training, safety-pattern...

WinFlesher

Like PingCastle went out for drinks with Bloodhound, and they actually decided to get some work done. 🍷 WinFlesher is an advanced attack surface security assessment framework designed to analyze, evaluate, and report on security postures, attack paths, and remediation strategies in complex...

CVE-2026-41940

CVE-2026-41940 | cPanel/WHM Authentication Bypass Detection ╔════════════════════════════════════════════════════════════════════════════╗ ║ cPanel/WHM Authentication Bypass - Detection Artifact Generator ║ ╚════════════════════════════════════════════════════════════════════════════╝ 📌 Descripti...

CVE-2026-41940

CVE-2026-41940 A security research tool for detecting and analyzing cPanel/WHM services and their authentication behavior. Designed for authorized testing and educational purposes only. cPanel Security Scanner Research Tool This project is a security research tool designed to analyze and detect...

CVE-2026-41940

CVE-2026-41940 ✅ Script analysis what the scanner does and how ✅ Root cause technical explanation the CRLF/Session.pm diff ✅ Prevention — patch commands, secure coding lessons ✅ Mitigation — firewall rules, WAF config, hardening ✅ IOC hunting — detecting if you were already hit ✅ VaPT methodology...

CVE-2026-41940-Detection

CVE-2026-41940 Detection Detection rules and log schemas for the cPanel/WHM authentication bypass CVE-2026-41940, by Unfold Security. Blog post: cPanel Exploit — CVE-2026-41940 Structure ├── cpanelcve202641940malget.yml SIGMA rule — detects the CRLF injection request ├──...

CVE-2026-31431_Kernel_Checker

For Free Internet Servers: curl -fsSL https://raw.githubusercontent.com/ShahaB108/CVE-2026-31431KernelChecker/main/kernelcheck.sh | bash For Iran servers: curl -fsSL https://raw.githubusercontent.com/ShahaB108/CVE-2026-31431KernelChecker/main/irkernelupdate.sh | bash...

CVE-2026-31431-detection-defense

CVE-2026-31431: Detection & Defense Against iouring Bypass of Existing Detection Authors : fz0x00, qiwuSEC Research For CVE-2026-31431 "Copy Fail", we demonstrated systematic weaknesses in mainstream security products by combining three bypass strategies: iouring async I/O path , process splittin...

CVE-2026-41940---cPanel-WHM-check

IOC Check Sessions Files Overview iocchecksessionsfiles.sh is a cPanel-provided detection script referenced in the official cPanel security advisory: Security: CVE-2026-41940 - cPanel & WHM / WP2 Security Update 04/28/2026 The script is used to scan cPanel/WHM session files for suspicious...

SPIPScan

SPIPScan SPIP CMS Scanner for penetration testing purpose written in Python, and released under MIT License. This tool has been designed to perform detection of SPIP installs during penetration testing. Currently, the tool detects the version of the SPIP install and tries to detect if the platfor...

c2finder

c2finder Mandatory disclaimer: I am not a master coder by any means, so this is a very simple script. Do not rely on this to be perfect. I am open to feedback or ideas for improvements, though : Description This script downloads the master C&C list from Bambanek Consulting...

yara-rules

yara-rules Collection of YARA signatures from recent malware research Ruleset Dacls Trojan Rule: DaclsLinux.yara Rule: DaclsWindows.yara Reference: https://blog.netlab.360.com/dacls-the-dual-platform-rat/ APT32 KerrDown Rule: APT32KerrDown.yara Reference:...

CVE-2021-45232

Apache APISIX Dashboard Unauthorized Access Description This tool integrates fofa and POC one-click detection functionality, enabling one-click crawling from fofa and one-click detection crawl and test simultaneously Usage Version: python3 Before testing, you need to change your fofatoken value a...

log4shell-honeypot

Log4Shell Honeypot This demo application is vulnerable to the CVE-2021-44228, also known as Log4Shell. For example, it can be used to validate a detection or remediation script. How to launch Build the application: mvn clean package Or, alternatively, download the pre-built JAR. Run the applicati...

CVE-2025-55315-Scanner-Monitor

CVE-2025-55315 Vulnerability Scanner and TLS Proxy This repository contains tools to detect and monitor ASP.NET Core applications vulnerable to CVE-2025-55315, which involves HTTP request smuggling due to conflicting HTTP headers. Tools Included 1. Python Vulnerability Scanner...

CVE-2026-24061-GNU-inetutils-Telnet-Detector

CVE-2026-24061 GNU inetutils Telnet Detector A safe, passive detection tool for identifying potential exposure to CVE-2026-24061 , a vulnerability affecting certain versions of GNU inetutils telnet. This project is designed for DevOps pipelines , infrastructure audits , and defensive security...

cpanel-forensics

cPanel/WHM Forensics after CVE-2026-41940 Bash script for checking a server after the CVE-2026-41940 vulnerability CVSS 9.8. For 64 days attackers had root access without a password — the patch does not remove what has already been planted inside. Usage sudo bash cpanelforensics.sh The report is...