instaloctrack

instaloctrack TL;DR : ascineema, video del proyecto Una herramienta para extraer ubicaciones georreferenciadas de perfiles de Instagram. Salida en JSON y mapa interactivo. requisitos root@kitploit: sudo apt install chromium-chromedriver && chmod a+x /usr/bin/chromedriver 🛠️ instalación...

dumpscan

El desarrollo público de esta herramienta se ha pausado, pero todavía se está trabajando en privado. Espere una actualización masiva en el tercer/cuarto trimestre de 2024. Dumpscan es una herramienta de línea de comandos diseñada para extraer y volcar secretos de kernels y formatos de Minidump de...

GlobalUnProtect

GlobalUnProtect PoC tool for decrypting and collecting GlobalProtect configuration, cookies, and HIP files from windows client installations. Blog post: https://rotarydrone.medium.com/4a1d8fc7773e Usage Run as standalone or in-memory via execute-assembly or equivalent. Collects all contents to an...

dfir-toolkit

!CAUTION DFIR Toolkit is leaving github Why? We believe that all men and women, and all human between and above are created equal. In this mindset, it does not make sense to judge people based on their birthplace, or their language, color, religion, or whatsoever. We believe that who you are is...

NtDumpBOF

NtDumpBOF BOF port of the tool https://github.com/ricardojoserf/NativeDump written by @ricardojoserf. Import NtDump.cna and run: root@kitploit: ntdump The minidump file will be created in memory and downloaded using CALLBACKFILE and CALLBACKFILEWRITE. Once downloaded the file will be visible at...

LinkedIntel

LinkedIntel root@kitploit: ╔══════════════════════════════════════════════════════════════════════════════════════╗ ║ ║ ║ ██▓ ██▓ ███▄ █ ██ ▄█▀▓█████ ▓█████▄ ██▓ ███▄ █ ▄▄▄█████▓▓█████ ██▓ ║ ║ ▓██▒ ▓██▒ ██ ▀█ █ ██▄█▒ ▓█ ▀ ▒██▀ ██▌▓██▒ ██ ▀█ █ ▓ ██▒ ▓▒▓█ ▀ ▓██▒ ║ ║ ▒██▒ ▒██▒▓██ ▀█ ██▒▓███▄░ ▒███ ░...

UBUNTU-CVE-2026-76175

SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...

PT-2026-86233

Name of the Vulnerable Software and Affected Versions SonicWall Network Security Manager NSM On-Prem affected versions not specified Description A Zip Slip issue exists in the file upload and archive processing functionality. This allows an attacker to extract files outside the intended destinati...

Linux Distros Unpatched Vulnerability : CVE-2026-76175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator...

Linux Distros Unpatched Vulnerability : CVE-2026-85396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparis...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

GHSA-QVQ9-HQ6P-V378 SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

CVE: This vulnerability corresponds to CVE-2026-72803. Summary POST /api/attr/getBlockAttrs and POST /api/attr/batchGetBlockAttrs return a block's full attribute set IAL with no publish-access check. Both are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymo...

Extractor

Installation Instructions For Those That Don't Want to Compile Themselves: 1. Download Google's GSON library from Maven http://central.maven.org/maven2/com/google/code/gson/gson/2.8.2/gson-2.8.2.jar wget http://central.maven.org/maven2/com/google/code/gson/gson/2.8.2/gson-2.8.2.jar 2. In Burp's...

go-pillage-registries

go-pillage-registries This project takes a Docker registry and pillages the manifest and configuration for each image in its catalog. It uses Google's crane command's package, which should follow docker's keychain semantics. If you would like to override this, just change authn.DefaultKeychain as...

MetadataPlus

MetadataPlus V.1.0 - Chris Nevin @ NCCGroup A tool to extract metadata from Microsoft Office files that includes new locations not checked in other tools. Example Usage: Run on compatible documents in the directory it is in: MetaDataPlus.exe Specify input folder: MetaDataPlus.exe -i=c:\Docs Run o...

AZL-99087 CVE-2026-85396 affecting package rubygem-rubyzip 2.3.2-1

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-85388

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract...

EUVD-2026-70673

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-85396 rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

iocx v0.7.6.1

IOCX Deterministic, Zero‑Risk IOC Extraction for Modern Security Pipelines Static IOC extraction from a PE file using the IOCX CLI Official IOCX Project This is the original IOCX engine for deterministic static IOC extraction and PE analysis. Any other repositories using the name "iocx" are not...