tcpflow

TCPFLOW 1.5.0 Downloads directory: http://digitalcorpora.org/downloads/tcpflow/ Installation Most common GNU/Linux distributions ship tcpflow in their repositories. So on Debian/Ubuntu/etc you can say root@kitploit: sudo apt-get install tcpflow and on Fedora/RedHat/CentOS/etc you can say...

goca

Goca is a FOCA fork written in Go, which is a tool used mainly to find metadata and hidden information in the documents its scans. These documents may be on web pages, and can be downloaded and analyzed with Goca. It is capable of analyzing a wide variety of documents, with the most common being...

qs_old

QuickSand.io 关于使用Python编写的QuickSand版本2以及PDF分析支持，请参见quicksand.io。 QuickSand版本1 Lite不再积极开发。 QuickSand是一个紧凑的C语言框架，用于分析疑似恶意软件文档，以1识别不同编码流中的漏洞利用，2定位并提取嵌入的可执行文件。通过定位嵌入的混淆可执行文件的能力，QuickSand可以检测包含零日或未知混淆漏洞利用的文档。 用于漏洞利用和活跃内容检测的文件格式 doc, docx, docm, rtf, etc ppt, pptx, pps, ppsx, etc xls, xlsx, etc mime ms...

FOCA

FOCA Fingerprinting Organizations with Collected Archives FOCA is a tool used mainly to find metadata and hidden information in the documents it scans. These documents may be on web pages, and can be downloaded and analysed with FOCA. It is capable of analysing a wide variety of documents, with t...

pymeta

PyMeta PyMeta 是 PowerMeta 工具的 Python3 重写版，由 dafthack 用 PowerShell 创建。它使用精心构造的搜索查询，通过 Google 和 Bing 抓取来识别并下载给定域名下的以下文件类型（pdf、xls、xlsx、csv、doc、docx、ppt、pptx ）。 下载后，使用 Phil Harvey 的 exiftool 从这些文件中提取元数据，并添加到 .csv 报告中。另外，也可以使用 -dir 命令行参数将 PyMeta 指向一个目录，以提取手动下载的文件中的元数据。更多信息请参见 用法 或 全部选项 部分。 为什么？...

DeepPass

DeepPass Dockerized application that analyzes documents for password candidates. The blogpost "DeepPass — Finding Passwords With Deep Learning" gives more detail on the approach and development of the model. To run: docker-compose up This will expose http://localhost:5000 where documents can be...

pdfresurrect

pdfresurrect PDFResurrect è uno strumento progettato per analizzare documenti PDF. Il formato PDF consente di mantenere le modifiche precedenti del documento in una versione più recente dello stesso, creando così una cronologia continua delle modifiche del documento. Questo strumento tenta di...

GHSA-45W3-2HVV-PFXQ XML Injection in Apache Solr

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

Goca Scanner - FOCA fork written in Go

Goca is a FOCA fork written in Go, which is a tool used mainly to find metadata and hidden information in the documents its scans. These documents may be on web pages, and can be downloaded and analyzed with Goca. It is capable of analyzing a wide variety of documents, with the most common being...

Threat Analysis: Recent Attack Technique Attempts to Bypass Whitelisting by Leveraging MS Office Document Macros, MSBuild, Certutil

Carbon Black continues to monitor and track evolving techniques that attackers leverage. Over the last several years, there has been an increase in attackers leveraging open source frameworks and proof of concept POC techniques that are released publically by researchers. A document was recently...

An (un)documented Word feature abused by attackers

A little while back we were investigating the malicious activities of the Freakyshelly targeted attack and came across spear phishing emails that had some interesting documents attached to them. They were in OLE2 format and contained no macros, exploits or any other active content. However, a clo...

Analyze Suspected Malware Documents: QuickSand

Analyze Suspected Malware Documents QuickSand is a compact C framework to analyze suspected malware documents to 1 identify exploits in streams of different encodings, 2 locate and extract embedded executables. By having the ability to locate embedded obfuscated executables, QuickSand could detec...

Aj Classifieds - For Sale 3.0 - Remote Shell Upload Vulnerability

No description provided by source. AJClassifieds Merchandise RFu script down: http://www.ajclassifieds.net/demo/ajclassifiedsme/ClassifiedsMerchandise/ ---------------------------------------------------------- Discovered By: ZoRLu msn: [email protected] Date: 16.01.09 Home: z0rlu.blogspot.com...

Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

DEBIAN-CVE-2013-6408

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

Xxe

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

UBUNTU-CVE-2013-6408

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

PT-2013-1143 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 4.3.1 Description: The issue is related to the DocumentAnalysisRequestHandler in Apache Solr, which does not properly use the EmptyEntityResolver. This allows remote attackers to have an unspecified impact via XM...