tcpflow

TCPFLOW 1.5.0 Downloads directory: http://digitalcorpora.org/downloads/tcpflow/ Installation Most common GNU/Linux distributions ship tcpflow in their repositories. So on Debian/Ubuntu/etc you can say root@kitploit: sudo apt-get install tcpflow and on Fedora/RedHat/CentOS/etc you can say...

goca

Goca — это форк FOCA, написанный на Go. Это инструмент, используемый в основном для поиска метаданных и скрытой информации в документах, которые он сканирует. Эти документы могут находиться на веб-страницах, их можно загрузить и проанализировать с помощью Goca. Он способен анализировать множество...

pymeta

PyMeta PyMeta — это переписанная на Python3 версия инструмента PowerMeta, созданного dafthack на PowerShell. Он использует специально сформированные поисковые запросы для поиска и загрузки следующих типов файлов pdf, xls, xlsx, csv, doc, docx, ppt, pptx с заданного домена, используя парсинг Googl...

FOCA

FOCA Fingerprinting Organizations with Collected Archives — Снятие отпечатков организаций с помощью собранных архивов FOCA — это инструмент, используемый в основном для поиска метаданных и скрытой информации в сканируемых документах. Эти документы могут находиться на веб-страницах, их можно...

qs_old

QuickSand.io Для QuickSand версии 2, написанной на Python с поддержкой анализа PDF, смотрите quicksand.io. QuickSand версия 1 Lite больше не разрабатывается активно. QuickSand — это компактный C-фреймворк для анализа подозрительных документов на вредоносное ПО, позволяющий 1 выявлять эксплойты в...

DeepPass

DeepPass 문서에서 비밀번호 후보를 분석하는 Docker 기반 애플리케이션입니다. 블로그 게시글 "DeepPass — Finding Passwords With Deep Learning" 에 모델의 접근 방식과 개발에 대한 자세한 내용이 나와 있습니다. 실행 방법: docker-compose up 이렇게 하면 문서를 업로드할 수 있는 http://localhost:5000이 노출됩니다. API는 http://localhost:5000/api/passwords 에서 수동으로 사용할 수 있습니다: root@kitploit:...

pdfresurrect

pdfresurrect PDFResurrect는 PDF 문서를 분석하기 위한 도구입니다. PDF 형식은 이전 문서 변경 사항을 문서의 최신 버전에 보존할 수 있게 하여, 문서의 변경 이력을 계속해서 생성합니다. 이 도구는 읽기 유틸리티가 PDF의 이전 버전을 제공받도록 PDF를 수정하려고 시도합니다. 수정된 "버전들"은 새 파일로 생성되며 원본 PDF는 수정되지 않은 채로 유지됩니다. 참고 스크러빙 기능-s은 심각한 보안 용도로 신뢰해서는 안 됩니다. 이 실험적 기능을 사용한 후에는 실제로 우려되는 모든 객체0으로 설정되어야 ...

GHSA-45W3-2HVV-PFXQ XML Injection in Apache Solr

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

Goca Scanner - FOCA fork written in Go

Goca is a FOCA fork written in Go, which is a tool used mainly to find metadata and hidden information in the documents its scans. These documents may be on web pages, and can be downloaded and analyzed with Goca. It is capable of analyzing a wide variety of documents, with the most common being...

Threat Analysis: Recent Attack Technique Attempts to Bypass Whitelisting by Leveraging MS Office Document Macros, MSBuild, Certutil

Carbon Black continues to monitor and track evolving techniques that attackers leverage. Over the last several years, there has been an increase in attackers leveraging open source frameworks and proof of concept POC techniques that are released publically by researchers. A document was recently...

An (un)documented Word feature abused by attackers

A little while back we were investigating the malicious activities of the Freakyshelly targeted attack and came across spear phishing emails that had some interesting documents attached to them. They were in OLE2 format and contained no macros, exploits or any other active content. However, a clo...

Analyze Suspected Malware Documents: QuickSand

Analyze Suspected Malware Documents QuickSand is a compact C framework to analyze suspected malware documents to 1 identify exploits in streams of different encodings, 2 locate and extract embedded executables. By having the ability to locate embedded obfuscated executables, QuickSand could detec...

Aj Classifieds - For Sale 3.0 - Remote Shell Upload Vulnerability

No description provided by source. AJClassifieds Merchandise RFu script down: http://www.ajclassifieds.net/demo/ajclassifiedsme/ClassifiedsMerchandise/ ---------------------------------------------------------- Discovered By: ZoRLu msn: [email protected] Date: 16.01.09 Home: z0rlu.blogspot.com...

Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

Solr: XML eXternal Entity (XXE) flaw in DocumentAnalysisRequestHandler

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

DEBIAN-CVE-2013-6408

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

Xxe

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

UBUNTU-CVE-2013-6408

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Enti...

PT-2013-1143 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 4.3.1 Description: The issue is related to the DocumentAnalysisRequestHandler in Apache Solr, which does not properly use the EmptyEntityResolver. This allows remote attackers to have an unspecified impact via XM...