DIBF

DIBF Windows 驱动 IOCTL 工具套件。 DIBF 动态 IOCTL 暴力破解器（及模糊测试器） 该工具包含两个不同的功能。它会猜测驱动程序接受的 IOCTL 值及其有效的长度限制，并将结果存储在文件中以便将来重用。第二个功能由 3 个简单模糊测试器组成：一个纯随机模糊测试器、一个滑动 DWORD 模糊测试器和一个异步模糊测试器。你可以按顺序运行这 3...

CVE-2026-24415

CVE-2026-24415：OpenSTAManager 在 modificaiva.php 中受 righe 参数影响的 XSS 漏洞 概述 字段| 详情 ---|--- CVE ID| CVE-2026-24415 严重性| 中危 安全公告| 查看公告 发现者| Lukasz Rybak 受影响产品 devcode-it/openstamanager （版本：" $GET'righe' 参数未经任何使用 htmlspecialchars 或等效函数的过滤，被直接输出到 HTML value 属性中。这允许攻击者突破属性上下文并注入任意 HTML/JavaScript。 所有受影响文...

go-pillage-registries

go-pillage-registries 该项目会获取一个 Docker 注册表，并对其目录中每个镜像的 manifest 和 configuration 进行掠夺。 它使用 Google 的 crane 命令包，该包应遵循 Docker 的 keychain 语义。 如果你想覆盖此行为，只需按照 https://github.com/google/go-containerregistry/tree/master/pkg/authn/k8schain 中的描述更改 authn.DefaultKeychain 即可。 安装： root@kitploit: git clone...

HTTPSignatures

HTTPSignatures Burp Suite 扩展 HTTPSignatures 是一个 Burp Suite 扩展，实现了 Signing HTTP Messages draft-ietf-httpbis-message-signatures-01 规范草案。 这使得 Burp Suite 用户能够无缝测试需要 HTTP Signatures 的应用程序。 功能特性 当扩展检测到现有的 HTTP Signature 头时，会自动在 Burp Repeater、Intruder 和 Scanner 中创建新的签名和摘要。 支持使用 rsa-sha256...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling due to incomplete validation of request Transfer-Encoding headers. An...

CVE-2026-45761 Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached...

CVE-2026-45761 Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached...

EUVD-2026-75755

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached...

CVE-2026-45761

Suricata versions prior to 7.0.16 and 8.0.5 are affected by a heap buffer overflow in the rule parsing/loading path. A crafted detection rule using mixed-case frame syntax triggers the overflow while Suricata loads signatures — not via network traffic alone. The CVSS 3.1 score is 3.3 (LOW) , with...

CVE-2026-45761 Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached...

libmempool

libmempool 初步说明：我们建议您将其作为 asatools 的一部分使用，但它也可以 独立使用。 libmempool 是一个 Python 脚本和 GDB 分析工具，用于辅助分析在 Cisco ASA 设备的各种堆中发现的与内存池（mempool）相关的数据结构。通常，这些信息嵌入在堆块（heap chunk）中，或者是对其他常见堆结构（如 dlmalloc mstate 结构）的自定义扩展。 Cisco 使用“mempool”一词来描述为各种目的（如常规分配、DMA 等）映射的内存区域。这些区域通常包含自己的堆，例如...

CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759 Suricata http1: quadratic Content-Disposition processing can lead to denial of service

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

CVE-2026-45759

Suricata (a network IDS/IPS/NMS engine) is vulnerable to a denial of service via quadratic processing of large HTTP Content-Disposition headers during HTTP response body processing. Prior to versions 7.0.16 and 8.0.5 , crafted HTTP traffic can cause excessive CPU consumption with no impact on con...

EUVD-2026-75754

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata could repeatedly perform expensive parsing of large HTTP Content-Disposition headers during HTTP response body processing. Crafted HTT...

metasploitavevasion

Metasploit 反病毒绕过 一款可规避大多数反病毒产品的 Metasploit 载荷生成器。 由 NCC Group Plc 以开源形式发布 - http://www.nccgroup.com/ 由 Daniel Compton 开发，daniel dot compton at nccgroup dot com https://github.com/nccgroup/metasploitavevasion 以 AGPL 协议发布，更多信息请参阅 LICENSE =================================== 2015 年 8 月由 Jason Soto...

ssh_user_enum

sshenumv0.3.py 用法：sshenumv0.3.py 选项 选项： root@kitploit: -h, --help 显示此帮助信息并退出 -u --userlist 指定一个以换行符分隔的用户名字文件 -i --ip 指定目标 -m --multiplier 指定密码的乘数（用于造成延迟） -t --threshold 根据乘数调整阈值 -p --port 如果 SSH 服务未运行在 22 端口，请指定端口 -a --autotune 计算最佳延迟/阈值 提示 仅使用 userlist 和 host 参数运行脚本将使用默认值。这样可以工作，但可能不是最优的。 使用...

Solitude

Solitude Solitude 是一款隐私分析工具，让任何人都能开展自己的隐私调查。无论是充满好奇的新手，还是更资深的研究人员，Solitude 都能让评估应用内用户隐私的过程变得人人可及。 重要提示 在安装 Solitude 之前，需要说明的是，Solitude 应在受信任的专用网络上运行。 Solitude Web 应用界面的当前构建方式，是基于用户会在受信任的私有网络上运行该工具的假设。 关于证书固定的说明 如果你使用 Solitude 测试移动应用（我们希望你是这样的！），那么 你应该清楚，如果你使用的是未越狱的设备，当应用或应用中嵌入的第三方 SDK 使用证书固定时，你可能...

thetick

The Tick Un sencillo backdoor para Linux embebido. The Tick Compilación Instalación Uso Medios Compilación The Tick solo depende de libcurl, así que asegúrate de tener el paquete de desarrollo correspondiente. Por ejemplo, en distribuciones basadas en Debian harías lo siguiente: root@kitploit: su...