yellow

root@kitploit: | | | | | | |/ \ | |/ \ \ /\ / / | || | / | | \ V V / , ||||/ // |/ - Just add blue. yellow - einfach Blau hinzufügen Einfache Binärmodifikationen, die einen Canary-Token auslösen, wenn eine Binärdatei ausgeführt wird. Ideal zum Präparieren von Produktionssystemen gegen...

PyHmmm

PyHmmm Was ist das? Dies ist ein Drittanbieter-Agent für Havoc C2, geschrieben in Python. Er ist als einfacher PoC gedacht, um zu lernen, wie man eigene Havoc-Agenten schreibt, mit dem dazugehörigen Blogbeitrag...

JuicyPotatoNG

JuicyPotatoNG Solo un'altra escalation di privilegi locali di Windows da account di servizio a System. Dettagli completi su -- https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/ Utilizzo root@kitploit: JuicyPotatoNG by decoderit & splintercode Mandatory args: -t...

SharpGmailC2

SharpGmailC2 Unser freundliches Gmail fungiert als Server und der Implantat exfiltriert Daten über SMTP und liest Befehle vom C2 Gmail über das IMAP-Protokoll. HAFTUNGSAUSSCHLUSS: Dieses Projekt funktioniert nach dem 29. November 2022 nicht mehr gegen Windows Defender. Dieses Tool wird von MS...

palera1n

palera1n Jailbreak per dispositivi A8 fino ad A11, T2, su iOS/iPadOS/tvOS 15.0, bridgeOS 5.0 e versioni successive. --- Uno screenshot di palera1n usato in un Terminale Supporto dispositivi Nota: sui dispositivi A11 iPhone X, 8, 8 Plus, è necessario disattivare il passcode mentre si è in stato di...

orpheus

Orpheus Orpheus ist ein Wrapper für eine modifizierte Version von Impackets GetUserSPNs.py und kerberosv5.py, die die KDC-Optionen Ticket-Optionen und den Verschlüsselungstyp für Kerberoasting verändert. Hinweis: Orpheus ist nach dem griechischen Gott benannt, der es schaffte, an Cerberus dem...

DCOMPotato

Raccolta di exploit per alcune vulnerabilità di escalation locale dei privilegi di oggetti DCOM di servizi tramite abuso di SeImpersonatePrivilege spiegazione DCOM usa RPCCIMPLEVELIDENTIFY come livello di impersonificazione predefinito, per la chiamata IUnknown in uscita predefinita, vedere...

jenkins_scan

jenkinsscan Trova ambienti Jenkins e verifica la CVE-2024-23897 Come funziona Rilevamento di Jenkins Testa i percorsi: /, /login, /oops, /api/json, /cli, /jenkins/, /jenkins/api/json Identifica tramite: 1. Header X-Jenkins — il più affidabile, restituisce anche la versione 2. Header X-Hudson —...

c2-framework

E1A Malware Lab Final Project - Command & Control Framework...

gha-oidc-auditor

gha-oidc-auditor !Licensehttps://img.shields.io/badge/lic...

SUSE CVE-2026-53804

OTRS Community Edition contains an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary operating-system commands by supplying crafted values for the PGP binary path and command options. Administrator-supplied configuration...

SUSE CVE-2026-55558

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

SUSE CVE-2026-68283

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free freeing trigger private data Commit 61d445af0a7c "tracing: Add bulk garbage collection of freeing eventtriggerdata" moved the kfree of eventtriggerdata to a kthread that runs...

Apkx-Hunter v2.7.2

APKX-Hunter v2.7.1 — Debian Package APKX-Hunter is an open-source Android Static Analysis Framework written entirely in C , purpose-built for Android security assessments, reverse engineering, malware analysis, OWASP MASVS compliance scanning, bug bounty hunting, and penetration testing. The...

VulnCheck KEV: CVE-2026-57739

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Blind SQL Injection.This issue affects AcyMailing SMTP Newsletter: from n/a through = 10.11.0...

Linux Distros Unpatched Vulnerability : CVE-2026-54552

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sh provides Python process launching. Prior to 2.2.4, the uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh runs...

MiracleLinux 9 : gpsd-minimal-3.26.1-2.el9_8.1 (AXSA:2026-1609:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1609:02 advisory. gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution CVE-2026-58459 Tenable has extracted the preceding description block...

Security update for apptainer (important)

openSUSE security update: security update for apptainer ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21611-1 Rating: important References: bsc1275248 Cross-References: CVE-2026-17106 CVSS scores: CVE-2026-17106 SUSE : 7.1...

Security update for chromium (critical)

openSUSE security update: security update for chromium ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21609-1 Rating: critical References: bsc1275706 Cross-References: CVE-2026-76033 CVE-2026-76034 CVE-2026-76035 CVE-2026-76036 CVE-2026-76037...

PT-2026-79536

better-npm-audit through 3.11.0, and the 4.0.0-rc.2 prerelease, builds its npm audit command by interpolating the user-supplied --registry option into a command string in src/handlers/handleInput.ts without validation or quoting, then passes that string to child process.exec in index.ts, which...