faraday

Open Source Vulnerability Manager Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your termin...

shhgit

🚨 shhgit is no longer maintained. If you need support or consultation for your secret scanning endeavours, drop me an e-mail [email protected] 🚨 shhgit helps secure forward-thinking development, operations, and security teams by finding secrets across their code before it leads to a security...

DumpsterFire

DumpsterFire Toolset DumpsterFire Toolset - "Des incidents de sécurité dans une boîte !" Mise à jour 27/05/2020 : Oui, je vais migrer tous mes projets Github vers Python3 au cours de l'été 2020. Le DumpsterFire Toolset est un outil modulaire, piloté par menu et multi-plateforme pour construire de...

avml

AVML Acquire Volatile Memory for Linux Summary A portable volatile memory acquisition tool for Linux. AVML is an X8664 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distributi...

ketshash

Ketshash A little tool for detecting suspicious privileged NTLM connections, in particular Pass-The-Hash attack, based on event viewer logs. The tool was published as part of the "Pass-The-Hash detection" research - more details on "Pass-The-Hash detection" are in the blog post:...

agentsh

agentsh Note macOS : La mise en œuvre native macOS via ESF Endpoint Security Framework + NE Network Extension est en version Alpha. Elle fonctionne de bout en bout — les événements de fichiers, de processus et de réseau transitent par l'extension système vers le moteur de politique Go — mais...

fsmon

fsmon Low level filesystem monitor utility for Linux, Android, iOS and macOS. Author : pancake @ nowsecure License : MIT Designed for System administrators and incident responders Security researchers and forensic analysts Developers debugging I/O-heavy applications Reverse engineers interested i...

PowerLurk

PowerLurk PowerLurk est un ensemble d'outils PowerShell pour créer des abonnements malveillants aux événements WMI. L'objectif est de faciliter le déclenchement d'événements WMI lors d'un test de pénétration ou d'un engagement de red team. Veuillez consulter mon article Creeping on Users with WMI...

drs-malware-scan

Perform malware scan analysis of on-prem servers using AWS services Challenges with on-premises malware detection It can be difficult for security teams to continuously monitor all on-premises servers due to budget and resource constraints. Signature-based antivirus alone is insufficient as moder...

xz-backdoor-github

xz-backdoor-github История коммитов, связанных с бэкдором в xz, обнаруженным 29 марта 2024 года: CVE-2024-3094. В настоящее время GitHub удалил репозитории за нарушение условий использования. Цель этого репозитория — содействовать исследованию безопасности того, как этот бэкдор был пронесён в...

whids

IMPORTANT : ce README et les autres documentations ne sont pas mis à jour pour refléter les changements apportés aux dernières versions bêta car beaucoup de changements ont eu lieu. Tout cela sera mis à jour en temps voulu lorsqu'une version stable sera publiée voir Roadmap jusqu'à la prochaine...

exploit-CVE-2022-0482

Divulgation de PII dans Easy!Appointments Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples:...

CVE-2026-17089-PoC-pwnVader

CVE-2026-17089 — Events Manager = 7.4.0.1 — Отражённый XSS без аутентификации headerformat Автор: pwnVader · Лицензия: MIT корень репозитория | ---|--- Компонент| Events Manager – Calendar, Bookings, Tickets, and more! плагин WordPress Тип| CWE-79 — Отражённый межсайтовый скриптинг Затронуто| =...

CVE-2021-24145

CVE-2021-24145 Vulnérabilité de téléchargement de fichier WordPress, plugin Modern Events Calendar Lite WordPress antérieur à 5.16.5 https://nvd.nist.gov/vuln/detail/CVE-2021-24145 Ordre d'installation et d'exécution 1. Installation de WordPress Lors de l'installation, veuillez effectuer la...

Crescendo

Table des matières 1. Pour commencer 2. Prérequis 3. Composants 4. Tests et développement 5. Signature 6. Construction 7. Problèmes/Bogues/Fonctionnalités 8. Dépannage 9. TODO Pour commencer Apple a introduit de nouveaux mécanismes de sécurité que nous devons activer pour faire fonctionner...

mimikatz

mimikatz mimikatz is a tool I've made to learn C and make somes experiments with Windows security. It's now well known to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory. mimikatz can also perform pass-the-hash, pass-the-ticket or build Golden tickets. .. mimikatz 2....

WordPress Modern Events Calendar <6.1.5 - Blind SQL Injection

WordPress Modern Events Calendar plugin before 6.1.5 is susceptible to blind SQL injection. The plugin does not sanitize and escape the time parameter before using it in a SQL statement in the mecloadsinglepage AJAX action. An attacker can possibly obtain sensitive information, modify data, and/o...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...

MISP < 2.5.37 - SQL Injection

MISP before 2.5.37 is vulnerable to SQL injection via the order parameter in EventsController. The POST body order value is passed directly into ORDER BY clauses without validation. id: CVE-2026-44381 info: name: MISP 2.5.37 - SQL Injection author: malcha severity: medium description: | MISP befo...

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...