SCANNER-INURLBR

説明 検索エンジンでの高度な検索を行い、発見された各ターゲット/URLに対して内部カスタム検証結合を用いて、GET/POSTを悪用する分析を可能にし、メールやURLをキャプチャします。 さまざまなLinuxディストリビューションで実行可能なPHPツールで、ハッカーやセキュリティ専門家が特定の検索エンジンにおいて支援を行います。 Scannerを含む、自動探索のためのいくつかの手法があります。 INURLBR（コードネーム：Facada）ツールは、ハッキングコミュニティを支援するために作成されました。Web上の潜在的な脆弱性を特定し、 高度な検索を実行します。Google...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

Important: Red Hat Security Advisory: grafana security update

An update for grafana is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

maigret

Maigret English · 简体中文 Maigret collects a dossier on a person by username only , checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling demo. Sponsors IPcook provides reliable residential proxies for online...

CVE-2023-34992

CVE-2023-34992: Fortinet FortiSIEM の認証不要コマンドインジェクション 脆弱なFortiSIEMアプライアンスでルートとしてコマンドを盲目的に実行する概念実証エクスプロイト ブログ記事 根本原因と侵害の指標はこちら: https://www.horizon3.ai/attack-research/disclosures/cve-2023-34992-fortinet-fortisiem-command-injection-deep-dive 使用方法 root@kitploit: % python3 CVE-2023-34992.py -h usage:...

exploit-CVE-2016-7434

CVE-2016-7434 ntpd DOS 漏洞利用 ntpd 存在一个空指针引用问题，可被触发从而导致应用程序崩溃。根据 NTP.org 的说法，“如果 ntpd 被配置为允许来自服务器的 mrulist 查询请求，而该服务器发送了精心构造的恶意数据包，那么 ntpd 在收到该精心构造的恶意 mrulist 查询数据包时将会崩溃。” ntpd 程序是一个操作系统守护进程，负责设置并维护计算机系统的系统时间，使其与互联网标准时间服务器保持同步。它是网络时间协议（NTP）第 4 版的完整实现，同时保留了与第 1、2、3 版的兼容性。 读取 MRU...

exrex

EXREX Irregular methods for regular expressions. Exrex is a command line tool and python module that generates all - or random - matching strings to a given regular expression and more. It's pure python, without external dependencies. There are regular expressions with infinite matching strings...

bkcrack

bkcrack Crack legacy zip encryption with Biham and Kocher's known plaintext attack. Overview A ZIP archive may contain many entries whose content can be compressed and/or encrypted. In particular, entries can be encrypted with a password-based symmetric encryption algorithm referred to as...

openssl

Welcome to the OpenSSL Project OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit for the Transport Layer Security TLS, formerly SSL, Datagram TLS DTLS, and QUIC protocols. The protocol implementations are based on a full-strength general purpose cryptographic library, which...

reaver-wps-fork-t6x

Overview Reaver implements a brute force attack against Wifi Protected Setup WPS registrar PINs in order to recover WPA/WPA2 passphrases , as described in Brute forcing Wi-Fi Protected Setup When poor design meets poor implementation. by Stefan Viehböck. Reaver has been designed to be a robust an...

netlas-cookbook

Netlas CookBook The goal of this guide is to teach anyone interested in cybersecurity, regardless of their knowledge level, how to make the most of Netlas Search Tools. This is a long read. We have collected as many simple use cases as possible and demonstrated how to automate them. ⭐️ Give us a...

netlas-cookbook

Netlas 요리책 이 가이드의 목표 는 사이버 보안에 관심 있는 모든 사람이 지식 수준에 관계없이 Netlas 검색 도구를 최대한 활용할 수 있도록 하는 것입니다. 긴 내용입니다. 가능한 한 많은 간단한 사용 사례를 모았으며 이를 자동화하는 방법을 보여드립니다. ⭐️ 감사의 표시로 별표를 눌러주세요. 👁️ 업데이트를 구독하세요. Netlas 는 인터넷에서 사용 가능한 모든 IP 주소와 도메인에 대한 정보를 찾고 분석하기 위해 설계된 검색 엔진입니다. Netlas에는 몇 가지 공격 표면 관리 기능이 있지만, 이 가이드는 주로...

themis

Themis 为忙碌的人们提供强大、易用的密码学 用于存储和消息传递的通用密码学库，支持 iOS（Swift、Obj-C）、Android（Java、Kotlin）、React Native（iOS、Android）、桌面 Java、С/С++、Node.js、Python、Ruby、PHP、Go、Rust、WASM。 非常适合多平台应用。隐藏密码学细节。由密码学家为开发者打造 🧡 Themis 是什么 Themis 是一个开源的高层密码学服务库，用于在身份验证、存储、消息传递、网络交换等过程中保护数据安全。Themis 解决了大多数应用常见的 90% 典型数据保护用例。 Themis...