CVE-2022-30040

Vulnerabilidad de denegación de servicio en Tenda AX1803 v1.0.0.12890 Resumen Información del sitio web del fabricante: https://www.tenda.com.cn/profile/contact.html Dirección de descarga del firmware: https://www.tenda.com.cn/download/default.html Descripción de la vulnerabilidad La vulnerabilid...

wardn

wardn AI 代理的凭据防火墙。 核心主张是结构性的，而非策略性的：代理接收的是占位令牌，而非真实的 API 密钥。真实的密钥仅跨越一个网络边界——在 wardn 代理内部，前往上游 API 的途中——并在响应返回代理之前被剥离。日志、环境、LLM 上下文窗口、临时文件以及 shell 历史中仅保留占位符。text agent process OPENAIKEY=wdnplaceholdera1b2c3d4e5f6g7h8 useless agent logs Authorization: Bearer wdnplaceholdera1b2... useless LLM contex...

CVE-2024-32371

CVE-2024-32371 Description Description A vulnerability identified as CVE-2024-32371 allows an attacker to elevate privileges by changing the type parameter from 1 to 0. This vulnerability enables an attacker with a regular user account to escalate their privileges and gain administrative access t...

xepor

Xepor Xepor pronounced /ˈzɛfə/ , zephyr is a web routing framework for reverse engineers and security researchers. It provides a Flask-like API for hackers to intercept and modify HTTP requests and/or HTTP responses in a human-friendly coding style. This project is meant to be used with mitmproxy...

blindy

Blindy 用于运行暴力破解盲注式MySQL注入的简单脚本 注意：此脚本仅供娱乐，在某些CTF挑战中或有帮助 : 描述 脚本将遍历提供文件中列出的查询集，并尝试对任何包含 占位符的位置进行暴力破解。 支持 GET 和 POST HTTP 方法 HTTP HEADERS 以与其他参数相同的方式支持 在默认模式下，脚本查找负面模式（注入成功时不可见的文本） 使用 --positive 标志可切换到查找预期响应 命令行界面 root@kitploit: $ python3 blindy.py --help usage: blindy.py -h -X HTTPMETHOD -p...

pytm

pytm：一个Python式的威胁建模框架 简介 传统的威胁建模往往姗姗来迟，有时甚至根本不会进行。此外，手动创建数据流和报告极其耗时。pytm 的目标是将威胁建模前置，使其更加自动化并以开发人员为中心。 功能特性 基于您对架构设计的输入和定义，pytm 可以自动生成以下内容： 数据流图（DFD） 序列图 与您的系统相关的威胁 依赖要求 Linux/MacOS Python 3.11+ Graphviz 软件包 Java（OpenJDK 10 或 11） plantuml.jar 快速开始 tm.py 是一个示例模型。您可以运行它以生成其引用的报告和图表图像文件： mkdir -p tm...

pytm

pytm: A Pythonic framework for threat modeling Introduction Traditional threat modeling too often comes late to the party, or sometimes not at all. In addition, creating manual data flows and reports can be extremely time-consuming. The goal of pytm is to shift threat modeling to the left, making...

Hack Tools

Hack Tools（黑客工具） 本仓库包含 200 多种 工具 和资源 ，可用于 红队活动 。 其中一些工具是专门为红队设计的，而另一些则是通用工具，可适用于红队场景。 警告 本仓库中的材料仅供参考和教育目的。不应用于任何非法活动。 注意 使用箭头隐藏工具列表标题。 点击 🔙 返回列表。 克隆命令bash git submodule update --init --recursive root@kitploit: 添加新项目bash git submodule add https://github.com/example.git docs:...

dynmx

dynmx Prototype dynmx spoken dynamics is a signature-based detection approach for behavioural malware features based on Windows API call sequences. In a simplified way, you can think of dynmx as a sort of YARA for API call traces so called function logs originating from malware sandboxes. Hence,...

Exploit for CVE-2026-85706

CVE-2026-85706 — GitLab Path Traversal IOC Scanner & Detection...

CobraAudit

CobraAudit 漏洞赏金审计框架 — 针对常见漏洞类别的三个专注模块。 root@kitploit: ╔═╗╔═╗╔╗ ╦═╗╔═╗ ╔═╗╦ ╦╔╦╗╦╔╦╗ ║ ║ ║╠╩╗╠╦╝╠═╣ ╠═╣║ ║ ║║║ ║ ╚═╝╚═╝╚═╝╩╚═╩ ╩ ╩ ╩╚═╝═╩╝╩ ╩ 模块 模块| 测试内容 ---|--- apikeys| Stripe, SendGrid, GitHub classic & fine-grained, GitLab, OpenAI, Anthropic, Slack, Mailgun, Firebase, NPM, AWS, Shopify, Twilio...

o365enum

Office 365 User Enumeration Enumerate valid usernames from Office 365 using ActiveSync, Autodiscover, or office.com login page. Usage o365enum will read usernames from the file provided as first parameter. The file should have one username per line. The output is CSV-based for easier parsing. Val...

thc-hydra

H Y D R A root@kitploit: c 2001-2023 by van Hauser / THC https://github.com/vanhauser-thc/thc-hydra Many modules were written by David dot Maciejak @ gmail dot com BFG code by Jan Dlabal Licensed under AGPLv3 see LICENSE file Please do not use in military or secret service organizations, or for...

google-dorks-bug-bounty

漏洞赏金用的Google Dorks 一份用于漏洞赏金、Web应用安全和渗透测试的Google Dorks列表 在线工具 带排除项的宽泛域名搜索 root@kitploit: site:example.com -www -shop -share -ir -mfa PHP扩展带参数 root@kitploit: site:example.com ext:php inurl:? API端点 root@kitploit: site:example.com inurl:api | site:/rest | site:/v1 | site:/v2 | site:/v3 敏感扩展名...

awesome-web-security

Awesome Web Security - ZH 🐶 Curated list of Web Security materials and resources. Needless to say, most websites suffer from various types of bugs which may eventually lead to vulnerabilities. Why would this happen so often? There can be many factors involved including misconfiguration, shortage ...

XnlReveal

Acerca de - v4.5 Esta es una extensión para Chrome/Firefox que puede hacer lo siguiente: Para hosts que están en el alcance: Mostrar una alerta para cualquier parámetro de consulta que se refleje e identificar parámetros "sus". Opcionalmente, comprobar si los caracteres ', " y se reflejan sin est...

BloodHound.py

BloodHound.py BloodHound.py is a Python based ingestor for BloodHound, based on Impacket. The code in this branch is only compatible with BloodHound 4.2 and 4.3. For BloodHound CE, check out the bloodhound-ce branch Installation There are different install methods for BloodHound Community Edition...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

KeePass-CVE-2023-24055

KeePass-CVE-2023-24055 KeePass CVE-2023-24055复现 KeePass CVE-2023-24055复现 1，准备机器：kali（192.168.232.129），windows10（192.168.232.128） 2,keepass版本：2.53 2，原理：通过修改keepass配置文件KeePass.config.xml，添加触发器配置项：导出明文密码并上传到攻击者服务器上；添加触发器的xml代码如下： 其中：c:\Users\Long\AppData\Local\Temp\exploit.xml字段为设置导出明文密码的本机路径...

pylibemu

Pylibemu |version badge| |downloads badge| .. |version badge| image:: https://img.shields.io/pypi/v/pylibemu.svg :target: https://pypi.python.org/pypi/pylibemu/ .. |downloads badge| image:: https://img.shields.io/pypi/dm/pylibemu.svg :target: https://pypi.python.org/pypi/pylibemu/ Pylibemu is a...