SysmonSimulator

SysmonSimulator SysmonSimulator is an Open source Windows event simulation utility created in C language, that can be used to simulate most of the attacks using WINAPIs. This can be used by Blue teams for testing the EDR detections and correlation rules. I have created it to generate attack data...

OSSEM

Open Source Security Events Metadata OSSEM A community-led project focused primarily on the documentation, standardization and modeling of security event logs. https://ossemproject.com/intro.html Goals Define and share a common data moel in order to improve the data standardization and...

Suborner

Suborner: The Invisible Account Forger What's this? A simple program to create a Windows account you will only know about : Create invisible local accounts without net user or Windows OS user management applications e.g. netapi32::netuseradd Works on all Windows NT Machines Windows XP to 11,...

CVE-2021-32644

CVE-2021-32644 该漏洞是影响 Ampache 4.4.3 之前版本的 XSS 漏洞。 https://nvd.nist.gov/vuln/detail/CVE-2021-32644 安装及运行步骤 1. Ampache 安装 进行安装时，请先在 docker-compose.yml 文件中配置端口转发。 当前安装的 Ampache 版本为 4.4.2。 root@kitploit: $docker-compose up 2. 访问 Amapache 转到 http://web-server ip:port/ 2. 访问 Amapache 并配置 MySQL 转到...

CVE-2022-47529

CVE-2022-47529 RSA NetWitness Platform EDR Agent / Control de acceso incorrecto - Ejecución de código Durante una auditoría de seguridad del agente EDR descubrí un vector novedoso para manipular el servicio con solo derechos de usuario estándar al apuntar a un objeto de evento de memoria Win32...

evtx

EVTX A cross-platform parser for the Windows XML EventLog format Features 🔒 Implemented using 100% safe rust - and works on all platforms supported by rust that have stdlib. ⚡ Fast - see benchmarks below. It's faster than any other implementation by orders of magnitude! 🚀 Multi-threaded. ✨ Suppor...

CVE-2025-56605

CVE-2025-56605 XSS（跨站脚本漏洞） CVE-2025-56605 — Event Management System 1.0 中的反射型 XSS 描述： PuneethReddyHC/event-management 1.0 中的 register.php 存在反射型跨站脚本（XSS）漏洞。 mobile POST 参数未正确验证，并在响应中反射回显，允许注入任意 JavaScript 代码。 CVE ID： CVE-2025-56605 发现者： Isroil Mustafoqulov 漏洞类型： 反射型 XSS 攻击向量： 远程 复现步骤（仅限本地）： 1...

Sealighter

Sealighter - Easy ETW Tracing for Security Research I created this project to help non-developers dive into researching Event Tracing for Windows ETW and Windows PreProcessor Tracing WPP. Features Subscribe to multiple ETW and WPP Providers at once Automatically parse events into JSON without...

latma

Lateral movement analyzer tool Lateral movement analyzer LATMA collects authentication logs from the domain and Azure AD environments and searches for potential lateral movement attacks and suspicious activity, the lateral movement can be in the AD environment or between cloud and on-prem. The to...

CVE-2019-10779

CVE-2019-10779 GCHQ Stroom es vulnerable a Cross-Site Scripting debido a la capacidad de cargar el dashboard de Stroom en otro sitio y a la protección insuficiente contra los orígenes de eventos de ventana...

SharpEventPersist

SharpEventPersist Persistence by writing/reading shellcode from Event Log. Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:\path\to\shellcode.bin" -instanceid 1337 -source Persistence -eventlog "Key Management Service". The shellcode is converted to hex and written to...

circuit-artist

高效的 C++ JSON 解析／生成器，提供 SAX 及 DOM 风格 API Tencent is pleased to support the open source community by making RapidJSON available. Copyright C 2015 THL A29 Limited, a Tencent company, and Milo Yip. All rights reserved. RapidJSON GitHub RapidJSON 文档 English 简体中文 GitBook 可下载 PDF/EPUB/MOBI，但不含 API 参考手册。...

T3SF

T3SF Technical Tabletop Exercises Simulation Framework Table of Contents About Getting Things Ready TODO CHANGELOG Contributing About T3SF is a framework that offers a modular structure for the orchestration of events based on a master scenario events list MSEL together with a set of rules define...

EDRaser

EDRaser Usage Guide EDRaser is a powerful tool for remotely deleting access logs, Windows event logs, databases, and other files on remote machines. It offers two modes of operation: automated and manual. Automated Mode In automated mode, EDRaser scans the C class of a given address space of IPs...

ThreatHound

ThreatHound ThreatHound is an advanced cybersecurity tool designed to facilitate efficient threat detection and analysis, windows events logs. it offers a user-friendly interface for managing and analyzing security data. Key features include log analysis, Sigma rule integration, and real-time...

BamboozlEDR

BamboozlEDR Una herramienta integral de generación de eventos ETW Event Tracing for Windows diseñada para fines de prueba e investigación. BamboozlEDR cuenta con una interfaz TUI y puede generar eventos de seguridad realistas en múltiples proveedores ETW de Windows para probar las capacidades de...

ossem-power-up

OSSEM A tool to assess data quality, built on top of the awesome OSSEM project. Mission Answer the question: I want to start hunting ATT&CK techniques, what log sources and events are more suitable? Create transparency on the strengths and weaknesses of your log sources Provide an easy way to...

CVE-2024-39031

CVE-2024-39031 : XSS almacenado en Silverpeas Core en Mes agendas Información Descripción: En Mes Agendas, un usuario puede crear nuevos eventos y añadirlos a su calendario. Además, los usuarios pueden invitar a otros del mismo dominio, incluidos administradores, a estos eventos. Un usuario...

CVE-2017-6913

CVE-2017-6913 这是我不久前在 open-xchange OX App Suite 的 webmail（https://www.open-xchange.com/）中发现的一个漏洞。 漏洞详情 该 webmail 在打开邮件时存在存储型 XSS 漏洞，原因是 HTML time 标签的事件属性未被正确过滤。因此，如下所示的内嵌 HTML 代码可以在毫无防备的目标上运行 JavaScript： root@kitploit: time onafterprint="console.log'onafterprint'"...

ATTACKdatamap

ATTACKdatamap A datasource assessment on an event level to show potential coverage of the "MITRE ATT&CK" framework. This tool is developed by me and has no affiliation with "MITRE" nor with its great "ATT&CK" team, it is developed with the intention to ease the mapping of data sources to assess...