cve-2010-0426

CVE-2010-0426 これはCvedの一部です: 脆弱なdockerコンテナを管理するツールです。 Cved: https://github.com/git-rep-src/cved 画像ソース: https://github.com/cved-sources/cve-2010-0426 画像作者: https://github.com/t0kx/privesc-CVE-2010-0426...

analyzer

This project automates the daily tasks of Threat Intelligence Analyzer role internally without external resources' interaction. It analyzes, visualizes and structures sensitive files Malware or data by extracting features, artifacts and IoC using different modules. The output of those modules can...

docker-onion-nmap

docker-onion-nmap Use nmap to scan hidden "onion" services on the Tor network. Minimal image based on alpine, using proxychains to wrap nmap. Tor and dnsmasq are run as daemons via s6, and proxychains wraps nmap to use the Tor SOCKS proxy on port 9050. Tor is also configured via DNSPort to...

docker-onion-nmap

docker-onion-nmap nmap을 사용하여 Tor 네트워크 상의 숨겨진 'onion' 서비스를 스캔합니다. alpine 기반의 최소 이미지로, proxychains를 사용하여 nmap을 래핑합니다. Tor와 dnsmasq는 s6을 통해 데몬으로 실행되며, proxychains는 Tor SOCKS 프록시포트 9050를 사용하도록 nmap을 래핑합니다. Tor는 또한 DNSPort를 통해 DNS 요청을 포트 9053으로 익명으로 해결하도록 구성됩니다. dnsmasq는 이 localhost:9053을 권위 있는 DNS 서버...

php-app-race-condition

脆弱なPHPアプリ（競合状態） 環境構築: root@kitploit: docker-compose up 環境検証: 接続テスト: http://localhost/test.php 脆弱なエンドポイント: http://localhost/poc.php 競合状態のエクスプロイト: root@kitploit: echo http://localhost | nuclei -t race.yml 残高から引き出しとして計上されたのは1280$未満であることが確認できます（10$ 128リクエスト）。純利益は変動します。 参考:...

web-hacking-playground

Web Hacking Playground 설명 Web Hacking Playground는 통제된 웹 해킹 환경입니다. 모의 침투 테스트와 버그 바운티 프로그램에서 발견된 실제 사례의 취약점들로 구성되어 있습니다. 목표는 사용자들이 이 취약점들을 연습하고, 탐지 및 익스플로잇 방법을 배우는 것입니다. 또한 다음과 같은 관심 주제들도 다룰 것입니다: 맞춤형 페이로드를 생성하여 필터 우회, 여러 취약점을 연계한 공격 실행, 개념 증명 스크립트 개발 등이 있습니다. 중요사항 애플리케이션 소스 코드는 공개되어 있습니다. 하지만 랩의 접...

web-hacking-playground

Web Hacking Playground Description Web Hacking Playground is a controlled web hacking environment. It consists of vulnerabilities found in real cases, both in pentests and in Bug Bounty programs. The objective is that users can practice with them, and learn to detect and exploit them. Other topic...

cve-2019-5736-poc

実行手順: 1. stage2.c 内の poc コマンドを編集 2. docker をビルド docker build -t cve . 3. docker を実行 docker run -d cve /bin/bash -c "tail -f /dev/null" 4. docker-runc をバックアップ cp /usr/bin/docker-runc /usr/bin/docker-runc.bak 5. docker exec -it docker-id /bin/bash 6. docker 内で実行 cd /root && ./run.sh && exit 7. dock...

CVE-2024-21626-demo

CVE-2024-21626-demo Container Runtime Meetup 5 的 LT 演示用。 基于公开信息旨在普及攻击风险，严禁滥用。 幻灯片 Container Runtime Meetup 5 ～那个镜像，真的可信吗？～ 使用 CVE-2024-21626 夺取宿主机的 root 权限 登录 victim-server 演示用笔记本电脑的 sshconfig 中注册为 victim-server 的机器。 root@kitploit: ssh victim-server 作为受害前提条件的版本信息: root@kitploit:...

scallion

2020 Project Update Scallion was a hobby project to learn OpenCL and RSA. We are not currently maintaining scallion. It has bitrotted in two important ways: 1. Tor has moved on to v3 Onion addresses, which scallion does not support. Old v2 addresses will stop working in October of 2021. The new...

Crawl4AI <= 0.8.6 - Remote Code Execution

Crawl4AI through 0.8.6 ships a Docker API server that exposes an unauthenticated /crawl endpoint. The computed field type of JsonCssExtractionStrategy evaluates a user supplied expression inside an AST based sandbox that does not restrict attribute access on generator frame objects. A generator...

Crawl4AI < 0.8.7 - Hardcoded JWT Signing Key Authentication Bypass

Crawl4AI Docker API server versions before 0.8.7 ship with a hardcoded default JWT signing key "mysecret" used to sign and verify HS256 authentication tokens. Because the key is identical across every deployment where SECRETKEY has not been overridden, an unauthenticated attacker can forge a vali...

Crawl4AI < 0.8.0 - Local File Inclusion

The Crawl4AI Docker API endpoints accepted arbitrary URL schemes without an allow-list. An unauthenticated request with a file:// URL could read local files. Fixed in 0.8.0, which restricts accepted URL schemes. id: CVE-2026-26217 info: name: Crawl4AI 0.8.0 - Local File Inclusion author:...

Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass

The official Gitea Docker image through version 1.26.2 ships with REVERSEPROXYTRUSTEDPROXIES set to a wildcard, causing Gitea to trust reverse-proxy authentication headers X-WEBAUTH-USER from any source IP instead of restricting trust to the configured reverse proxy. When reverse-proxy...

Plone Docker - Host Header Injection

Plone Docker Official Image 5.2.13 5221 is vulnerable to Host Header Injection due to improper validation of input by the HOST headers. This can lead to Cross-Site Scripting XSS attacks when the malicious Host header value is reflected in the response. id: CVE-2024-23055 info: name: Plone Docker ...

cve-2018-17207

CVE-2018-17207 这是Cved的一部分： 一个管理易受攻击的Docker容器的工具。 Cved：https://github.com/git-rep-src/cved 图片来源：https://github.com/cved-sources/cve-2018-17207 图片作者：https://github.com/cved-sources/cve-2018-17207...

AutoSploit

Dockerデプロイ手順 要約 docker-composeを使用する場合: root@kitploit: git clone https://github.com/NullArray/AutoSploit.git cd Autosploit/Docker docker-compose run --rm autosploit Dockerのみを使用する場合: root@kitploit: git clone https://github.com/NullArray/AutoSploit.git cd Autosploit/Docker...

cve-2018-16509

CVE-2018-16509 これはCvedの一部です： 脆弱なDockerコンテナを管理するツール。 Cved: https://github.com/git-rep-src/cved イメージソース: https://github.com/cved-sources/cve-2018-16509 イメージ作成者: https://github.com/knqyf263/CVE-2018-16509...

CVE-2020-13925

CVE-2020-13925 환경 구축 https://github.com/apache/kylin 를 참조하여 docker를 사용해 환경을 배포하고, 버전을 3.0.1취약한 버전로 수정합니다. -m 8G \는 메모리 할당 크기를 지정하는 것으로 제거해도 됩니다. 그런 다음 http://host:7070/kylin/login 에 접속합니다. 초기 사용자 이름과 비밀번호는 ADMIN/KYLIN입니다. root@kitploit: docker pull apachekylin/apache-kylin-standalone:3.0.1 docker...

cve-2019-5737

Linux: docker build -t cve:linux - Dockerfile docker run cve:linux strings /usr/bin/docker-runc | tail -n 2 Windows: Get-Content Dockerfile | docker build -t cve:windows docker run cve:windows findstr /usr/bin/docker-runc | tail -n 2...