CVE-2026-85100 2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption

A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulation results in resource consumption. It...

CVE-2026-85100

A resource consumption vulnerability in 2FastLabs agent-squad (versions up to 1.1.4 ) affects the function AgentSquad.routeRequest within the Streaming Agent Response Workflow component (file agent-squad/typescript/src/orchestrator.ts). The flaw allows a remote attacker with low privileges to tri...

tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator

A flaw was found in Apache Tomcat. This vulnerability, an authentication bypass by capture-replay, affects the DIGEST authenticator. A remote attacker can exploit this by making a specially crafted DIGEST authenticated request with a nonceCount at the upper boundary of the replay window. This...

social-engineer-toolkit

The Social-Engineer Toolkit SET The Social-Engineer Toolkit is an open-source penetration testing framework for authorized social-engineering assessments. SET provides guided attack vectors for security teams that need to test user awareness, validate controls, and run consent-based red-team...

recipe-blog-encoding

recipe-blog-encoding !WARNING Этот проект полностью создан с помощью vibe-coding вероятно, частично плагиачен из этого репозитория, и автор — дурачок , которому просто показалась забавной эта идея Используйте SEO-игривые преамбулы рецептов как средство для кодирования секретных сообщений хотя...

cve-2025-8110-GOGS-RCE

GOGS RCE cve-2025-8110 Gogs는 GitHub의 개인 버전과 유사한 경량의 자체 호스팅 Git 서비스로, 저사양 서버에서도 쉽게 실행되도록 설계되었습니다. CVE-2025-8110 취약점은 공격자가 심볼릭 링크를 사용하여 경로 제한을 우회할 수 있게 하는 심각한 보안 결함입니다. .api/config를 가리키는 악의적인 링크를 업로드하면 공격자는 gogs API를 사용하여 sshCommand 매개변수가 포함된 악성 구성 파일을 삽입하고 호스트 서버에서 RCE를 달성할 수 있습니다. 사용법 1. 이 저장소를 로...

hoaxshell

hoaxshell ⚡ The latest version of this project is the HoaxShell standalone listener which comes with refreshed payload templates. Wou can also use it directly from https://revshells.com make sure to choose hoaxshell as the listener. ⚠️ As of 2022-10-18, hoaxshell is detected by AMSI...

jwt-hack

JSON Web Token Hack Toolkit A high-performance toolkit for testing, analyzing and attacking JSON Web Tokens. Installation Cargo root@kitploit: cargo install jwt-hack Homebrew root@kitploit: brew install jwt-hack Snapcraft Ubuntu root@kitploit: sudo snap install jwt-hack From source root@kitploit:...

text4shellburpscanner

text4shellburpscanner Этот проект является модификацией log4j2burpscanner, из которой удалена функция активного сканирования; при необходимости она будет добавлена позже. CVE2022-42889 Ссылка на лабораторию: https://github.com/karthikuj/cve-2022-42889-text4shell-docker.git Также можно подписаться...

ctftool

CTFTOOL Just want to test the SYSTEM exploit? Click here. An Interactive CTF Exploration Tool This is ctftool, an interactive command line tool to experiment with CTF, a little-known protocol used on Windows to implement Text Services. This might be useful for studying Windows internals, debuggin...

pinecone

Pinecone is a WLAN networks auditing tool, suitable for red team usage. It is extensible via modules, and it is designed to be run in Debian-based operating systems. Pinecone is specially oriented to be used with a Raspberry Pi, as a portable wireless auditing box. This tool is designed for...

espoofer

espoofer espoofer is an open-source testing tool to bypass SPF, DKIM, and DMARC authentication in email systems. It helps mail server administrators and penetration testers to check whether the target email server and client are vulnerable to email spoofing attacks or can be abused to send spoofi...

HTTPLoot

HTTPLoot أداة آلية يمكنها في نفس الوقت الزحف إلى المواقع، وملء النماذج، وتشغيل صفحات الأخطاء/التصحيح، و"نهب" الأسرار من الكود المواجه للعميل في المواقع. الاستخدام لاستخدام الأداة، يمكنك الحصول على أي من الملفات القابلة للتنفيذ المجمعة مسبقًا من قسم الإصدارات في المستودع. إذا كنت ترغب في بناء الكو...

Security Bulletin:Vulnerabilities exists in callhome of IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Software have been addressed in security patch ina-release-callhomeimage-1.0.2.3. Vulnerability Details CVEID:CVE-2022-2042 DESCRIPTION: Use After Free in GitHub repository vim/vim prior to 8.2. CWE:CWE-416: Use After Free CVSS Source: IBM X-Force...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...

automato

automato.rb يستخدم أدوات LDAP الأصلية لأتمتة جمع وتعداد كائنات الدليل المختلفة. هذا مفيد جدًا أثناء اختبار الاختراق الداخلي. يمكن لـ automato أيضًا تنفيذ هجمات رش كلمات المرور، وتحديد ما إذا كان المستخدم مسؤولًا محليًا على أي عدد من الأنظمة. يتم إنشاء ملفات الإخراج تلقائيًا للحفاظ على الأدلة...

hate_crack

root@kitploit: / | \ / | \ \ | | / \ \ / \ / \ /\ \ \ / | |/ / \ Y // | | \ / \ | | // \ | \ /|| /\ | \ / / // / / / / Installation Installing from source is the only supported path. hatecrack is not distributed on PyPI: pip install hate-crack resolves to a 0.0.0 placeholder that...

awesome-pentest

Awesome Penetration Testing Коллекция замечательных ресурсов по тестированию на проникновение и наступательной кибербезопасности. Тестирование на проникновение — это практика проведения авторизованных, смоделированных атак на компьютерные системы и их физическую инфраструктуру для выявления...

DCS932L-Emulation-CVE-2024-37606-Attack

Rendre l'émulation facile à nouveau Bienvenue ! Ce dépôt fournit des outils et un environnement pour émuler le firmware du D-Link DCS-932L et démontrer la vulnérabilité CVE-2024-37606. Il inclut des binaires pré-patchés et les bibliothèques nécessaires, simplifiant la configuration de l'émulation...

assless-chaps

assless-chaps Crack MSCHAPv2/NTLMv1 challenge/responses quickly using a database of NT hashes Introduction Assless CHAPs is an efficient way to recover the NT hash used in a MSCHAPv2/NTLMv1 exchange if you have the challenge and response e.g. from a WiFi EAP WPE attack. It requires a database of ...