24113 matches found
CVE-2015-7547
CVE-2015-7547 https://github.com/fjserna/CVE-2015-7547 So I tried to see if many things crash on CentOS6. root@kitploit: ./CVE-2015-7547-poc.py & vi /etc/resolve.conf --------------------------------------------------------------- options single-request-reopen nameserver 8.8.8.8 nameserver...
MiracleLinux 9 : python3.14-cryptography-45.0.4-4.el9_8.6 (AXSA:2026-1788:01)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1788:01 advisory. python-cryptography: python-cryptography: Duplicate self-signed intermediates can cause exponential path-building CVE-2026-69249 python-cryptography...
PT-2026-89173
Summary With the Playwright web loader enabled, Open WebUI checks the address behind a user-submitted URL before allowing the request, then handed the request to the browser to perform. The browser resolved the hostname a second time, on its own, and that answer was never checked. An attacker who...
SSRF-CVE-2020-15002
Summary The URL validation logic applied when handling /appsuite/api/oxodocumentfilter&action=addfile suffers from three defects which can be used to execute Time of Check Time of Use ToCToU SSRF attack. This issue allows malicious actors to execute HTTP GET requests on internal network services...
CVE-2020-1350-Fix
KB4569509: Guidance for DNS Server Vulnerability CVE-2020-1350 Introduction On July 14, 2020, Microsoft released a security update for the issue that is described in CVE-2020-1350 | Windows DNS Server Remote Code Execution Vulnerability. This advisory describes a Critical Remote Code Execution RC...
py-log4shellscanner
PY-Log4ShellScanner A simple, one-file DNSLog server with HTTP endpoint for log retrieval Credit Based on the Log4jScanner by fullhunt.io, modified with multithreading and custom DNS Callback server Features Support for lists of URLs Fuzzing for more than 60 HTTP request headers, with ability to...
dnstwist
Descubre en qué tipo de problemas pueden meterse los usuarios al intentar escribir tu nombre de dominio. Encuentra dominios similares que los adversarios pueden usar para atacarte. Puede detectar typosquatters, ataques de phishing, fraude y suplantación de marca. Útil como fuente adicional de...
CVE-2017-3143
TSIG Bypass exploit Exploit for CVE-2017-3143 in Bind and CVE-2017-11104 in Knot DNS. See https://www.synacktiv.com/ressources/CVE-2017-3143BIND9TSIGdynamicupdatesvulnerabilitySynacktiv.pdf for more info. Author Clément Berthaux - clement dot berthaux at synacktiv dot com...
Malicious code in open-item-validator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...
Microsoft Plugs Nearly 1,000 Security Holes
Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that man...
CVE-2026-3333-DNS-Rebinding-to-Steal-Cloud-Metadata
CVE-2026-3333 – DNS Rebinding to Steal Cloud Metadata Program Code Python attacker server + vulnerable app root@kitploit: !/usr/bin/env python3 dnsrebindingserver.py - Malicious DNS server that alternates between attacker IP and 169.254.169.254 import socket, threading, time This simple server...
Log4Shell
log4shell A fully automated, accurate, and extensive scanner for finding vulnerable log4j hosts Features Support for lists of URLs. Fuzzing for more than 60 HTTP request headers. Fuzzing for HTTP POST Data parameters. Fuzzing for JSON data parameters. Supports DNS callback for vulnerability...
Massive-Subdomain-Enumerator
Massive-Subdomain-Enumerator This tool uses a combination of dictionary-based wordlists brute-force and DNS resolution checks to verify the existence of subdomains. Features Wordlist Processing: Capable of handling large wordlists efficiently. Multi-threading: Boosts search speed by using multipl...
cupntlm-Automated-Exploit-For-CVE-2025-33073-
cupntlm CVE-2025-33073 — NTLM Reflection Bypass via DNS Coercion Automated exploitation tool for Active Directory environments. Overview cupntlm automates the NTLM reflection/relay attack chain that abuses CVE-2025-33073. It combines DNS record injection, forced authentication coercion PetitPotam...
Dashboards-Splunk-DNS-Hunting-Beaconing
DNS Hunting-Beaconing v19.2.0.0 DNS Dashboard for hunting and identifying beaconing This dashboard no longer uses any third-party modules or a Splunk lookup table to identify "Trusted Domains". All of that work has been moved to the Corelight/Zeek sensor. However, the dashboard does use two Splun...
icannTLD
icannTLD Corelight-update can now be used to create and maintain the icannTLD input files. Script Description Zeek script using the official ICANN Top-Level Domain TLD list with the Input Framework to extract the relevant information from a DNS query and mark whether it's trusted or not. The sour...
top-dns
Top DNS Measurement Overview This script uses a built in probabalistic measurement mechanism in Bro to measure the top DNS requests by type of query, i.e., CNAME, A, AAAA, etc being done over a definable period of time. This is logged into a new log named "topdns.log". By using the probabalistic...
CVE-2025-33073
Obscura$ DNS Relay Injector + NTLM Coercion Tool A stealthy proof-of-concept that chains DNS injection, NTLM relay, and RPC-based coercion to test authentication relay paths in Windows Active Directory environments. ⚠️ DISCLAIMER: For authorized security testing and educational use only. ❌...
