mac-monitor

🎉 欢迎来到 Mac Monitor 的官方新家！ Mac Monitor 是一款先进、独立的系统监控工具，专为 macOS 安全研究、恶意软件分类和系统故障排除而设计 。利用 Apple 的 Endpoint Security ES 和 System Extension API，它收集并丰富系统事件，以图形方式显示，具有广泛的功能集，旨在仅显示与您相关的事件。收集的遥测数据包括进程、进程间、内存、XPC、文件事件等，以及丰富的元数据，使用户能够轻松地将事件置于上下文中并讲述一个故事。凭借直观的界面和丰富的分析功能，Mac Monitor...

letsdefend-cve2024-3400-case-study

letsdefend-cve2024-3400-case-study Estrategias de detección, análisis y respuesta para los intentos de explotación de CVE-2024-3400 dirigidos a los portales GlobalProtect de Palo Alto PAN-OS. Incluye IOCs, patrones de explotación y guía de mitigación. Investigación del Incidente CVE-2024-3400 🔍...

Meerkat

Meerkat Meerkat 是一个 PowerShell 模块集合，专为基于 Windows 的端点进行工件收集和侦察而设计，无需预部署代理。用例包括事件响应分类、威胁狩猎、基线监控、快照比较等。 工件 主机信息| 网络适配器| 进程| 服务| 文件 ---|---|---|---|--- 审核策略| Windows 防火墙规则| DLL| 本地用户| 备用数据流 ADS 磁盘| 端口| 字符串| 本地组| 回收站 修补程序| ARP| 句柄| 计划任务| Hosts 文件 TPM| DNS| 环境变量| 自动运行| 证书 软件| 网络路由| 会话| BitLocker| 选择性注册...

mhf

Mobile Helper Framework is a tool that automates the process of identifying the framework/technology used to create a mobile application. Additionally, it assists in finding sensitive information or provides suggestions for working with the identified platform. How work? The tool searches for fil...

CVE-2026-104964

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

CVE-2026-104894

Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in their own workspace. This issue is fixed ...

CVE-2026-22557-Path-Traversal-Ubiquti-UniFi

CVE-2026-22557 Path Traversal Ubiquti UniFi Network Application Este repositorio contiene un escáner de prueba de concepto basado en Go para CVE-2026-22557 dirigido a UniFi Network Application. La herramienta realiza un escaneo controlado y no destructivo contra un conjunto de endpoints comunes y...

iMonitorSDK

简介 iMonitorSDK是一款为终端、云端提供系统行为监控的开发套件。 旨在帮助安全、管理、审计等行业应用可以快速实现必要功能，而不用关心底层驱动的开发、维护和兼容性问题，让其可以专注于业务开发。 iMonitorSDK使用基于消息协议的通信框架，让驱动开发更加稳定、快速。内核监控使用了稳定、标准的方式实现，同时支持Windows（XP-Win11）。Linux、MacOS也正在规划支持中。 利用iMonitorSDK可以极低成本地实现自保护、进程拦截、勒索病毒防御、主动防御、上网行为管理等等终端安全常见的功能。 使用注意...

CVE-2022-1388-Exploit

CVE-2022-1388-Exploit Scripts de prueba y explotación para CVE-2022-1388 F5 Big-IP masscheck.py tomará un archivo de entrada y comprobará si los hosts son vulnerables sin explotarlos. Detección: Escaneo de /mgmt/tm/util/bash como endpoint, es probable que aparezca en los registros del servidor we...

CVE-2026-104969 Plane: Cross-Tenant Cycle Issue Hijack via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...

EUVD-2026-92491

Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle they control. If a victim issue is...

CVE-2026-104964

The project management tool Plane is vulnerable to a cross-workspace project modification flaw in versions prior to 1.4.0 . The vulnerability exists because the project update endpoint validates the workspace slug in the URL but fetches the target project globally using its UUID without verifying...

CVE-2026-104964 Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

EUVD-2026-92486

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administrator of one workspace can modify a...

iMonitor

简介 iMonitor（冰镜 - 终端行为分析系统）是一款基于iMonitorSDK的终端行为监控分析软件。 提供了对进程、文件、注册表、网络等系统行为的监控。支持扩展和脚本，可以轻易定制和添加更多功能。可以用于病毒分析、软件逆向、入侵检测，EDR等。 软件截图 更新说明 2.2.0（2022.10.30） 添加脚本支持 （可以使用脚本来扩展列、自定义匹配器）详细参考脚本开发指南 优化若干使用体验 修复一些小问题 2.1.1（2022.10.7） 调整分组跟过滤的优先级（之前是先分组后过滤，现在是先过滤后再分组） 修复选择列导致崩溃的问题 2.1（2022.10.5） 添加事件快照支持...

CVE-2024-40422

CVE-2024-40422 Implementación en Python/PoC para CVE-2024-40422. Explota una vulnerabilidad crítica de directory traversal en el endpoint /api/get-browser-snapshot de Devika v1 para leer archivos arbitrarios del sistema...

CVE-2023-25157-checker

CVE-2023-25157-checker 一个用 golang 编写的脚本。CVE-2023-25157 的 POC 使用步骤 1. git clone https://github.com/7imbitz/CVE-2023-25157-checker.git 2. cd CVE-2023-25157-checker 3. go run CVE-2023-25157.go 将 替换为目标服务器的 URL。 Google Dork inurl:"/geoserver/ows?service=wfs" 研究 出于研究目的，你可以设置并部署自己的 geoserver 实例。这款 docke...

EUVD-2026-92480

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956 Plane: Unauthenticated ORM field-name injection via `group_by`/`sub_group_by` on public deploy boards (DoS + blind oracle)

Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts groupby and subgroupby query parameters and passes them without an allowlist to grouped paginators, where they are used as ORM field names by Ffield, .valuesfield, .orderbyfield, an...

CVE-2026-104956

The open-source project management tool Plane is vulnerable to unauthenticated ORM field-name injection in versions prior to 1.4.0 . The public issues endpoint fails to validate the group_by and sub_group_by query parameters, passing them directly to grouped paginators. Attackers can supply arbit...