stegowiper

stegoWiper: A powerful and flexible active attack for disrupting stegomalware Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Pand...

stride-gpt

STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models LLMs to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the...

CVE-2023-2825-Gitlab

CVE-2023-2825 El 23 de mayo de 2023 GitLab lanzó la versión 16.0.1 que corrigió una vulnerabilidad crítica, CVE-2023-2825, que afecta a la Community Edition CE y Enterprise Edition EE versión 16.0.0. La vulnerabilidad permite a usuarios no autenticados leer archivos arbitrarios a través de un fal...

sslscan

sslscan2 sslscan 版本 2 现已发布。这包括对后端扫描代码的重大重写，这意味着许多检查不再依赖于 OpenSSL 的版本。这使得无论系统编译时使用的 OpenSSL 版本如何，都可以支持旧协议（SSLv2 和 SSLv3）以及 TLSv1.3。 这主要归功于 jtesta 的工作，他负责了大部分后端重写。 其他关键变化包括： 枚举服务器密钥交换组。 枚举服务器签名算法。 支持扫描 SSLv2 和 SSLv3 协议，但不扫描单个加密套件。 包含使用 Docker 的测试套件，以验证 sslscan 功能正确。 移除了 --http 选项，因为它已损坏且最初使用率很低。...

boofuzz

.. image:: https://github.com/jtpereyda/boofuzz/raw/master/artwork/boo-logo-dark.svg :width: 60% :alt: boofuzz logo boofuzz: Network Protocol Fuzzing for Humans .. image:: https://github.com/jtpereyda/boofuzz/actions/workflows/test.yml/badge.svg?branch=master :target:...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

autovpn

!CAUTION This repository is no longer being maintained. No further updates, bug fixes, or support will be provided. Please use the new version https://github.com/ttlequals0/autowire Overview Script that allows the easy creation of OpenVPN endpoints in any AWS region. To create a VPN endpoint is...

CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 Tipo de vulnerabilidad: Cross-Site Scripting XSS – XSS reflejado CWE: CWE-79 – Neutralización incorrecta de entrada durante la generación de páginas web 'Cross-site Scripting' Severidad: Alta CISA ADP CVSS v3.1: 7.1 Resumen CVE-2026-9833 afecta al plugin de...

TEx

Welcome to Telegram Explorer About The Project TEx is a Telegram Explorer tool created to help Researchers, Investigators and Law Enforcement Agents to Collect and Process the Huge Amount of Data Generated from Criminal, Fraud, Security and Others Telegram Groups. ⚠️ BETA VERSION ⚠️ Please note...

X-force

IBM X-Force Exchange library | IBM Security X-FORCE Exchange library in Python 3. Search: threatactivities, threatgroups, malwareanalysis, collector and industries. For others applications. See ---|--- Install root@kitploit: pip3 install XForce Use Using you APIKEY make a basic authentication. Se...

CVE-2023-2825

CVE-2023-2825 （未认证）目录遍历导致文件读取。 CVE 摘要 GitLab CE/EE 中发现了一个影响仅限于版本 16.0.0 的问题。当公共项目中存在附件且该项目嵌套在至少五个组内时，未认证的恶意用户可以利用路径遍历漏洞读取服务器上的任意文件。 受影响版本 GitLab GitLab 16.0.0 社区版 GitLab GitLab 16.0.0 企业版 异常情况 如果已存在一个包含嵌套组的仓库，则无需认证；否则需要拥有创建组权限的账户。 参考 GitHub POC - OccamSec, 2023年5月25日 GitLab 报告 - pwnie, 2023年5月20日...

awesome-threat-intelligence

awesome-threat-intelligence Una lista curada de recursos increíbles de Threat Intelligence Una definición concisa de Threat Intelligence: conocimiento basado en evidencia, incluidos contexto, mecanismos, indicadores, implicaciones y consejos prácticos, sobre una amenaza o peligro existente o...

CVE-2025-65094

CVE-2025-65094: WBCE CMS es vulnerable a la escalada de privilegios mediante la manipulación del ID de grupo IDOR Descripción general Campo| Detalles ---|--- ID de CVE| CVE-2025-65094 Gravedad| HIGH Aviso| Ver aviso Descubierto por| Lukasz Rybak Productos afectados WBCE/WBCECMS Detalles Resumen U...

BadBlood

BadBlood BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an...

m365_groups_enum

Enumerate Microsoft 365 Groups in a tenant with their metadata Description The allgroups.py script allows to enumerate all Microsoft 365 Groups in a Azure AD tenant with their metadata: name visibility: public or private description email address owners members Teams enabled? SharePoint URL e.g...

m365_groups_enum

枚举租户中的 Microsoft 365 组及其元数据 描述 allgroups.py 脚本允许枚举 Azure AD 租户中所有 Microsoft 365 组及其元数据： name visibility: public or private description email address owners members Teams enabled? SharePoint URL 例如用于 Teams 共享文件 所有这些，即使是私有组也能获取！ 更多信息请阅读我的博客文章 “Microsoft Teams 和 Microsoft 365 组的安全风险” reporting.py...

CVE-2026-42533

CVE-2026-42533 — Exploit PoC de desbordamiento de búfer en el montón de nginx Ejecución remota de código sin autenticación mediante la corrupción de capturas en dos pasadas PoC público liberado el 2026-07-27 — No esperes, aplica el parche ahora. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Crítico...

ThreatActors-TTPs

NOTA: Esto es un fork de Crocodyli - Todo lo que hago es agregarle para mis propios fines. Lo estoy usando para alimentar las páginas de gapMATRIX en https://incidentbuddy.ai ACTORES DE AMENAZAS Y RANSOMWARES - TTPs Este repositorio fue creado con el objetivo de ayudar a empresas e investigadores...

CVE-2024-8349-and-CVE-2024-8350

CVE-2024-8349 和 CVE-2024-8350 背景信息 Uncanny Groups for LearnDash uncanny-learndash-group 是 LearnDash LMS sfwd-lms 的第三方插件。该插件允许 Group Leaders（自定义 LearnDash 角色）在前端管理自己 LearnDash 分组的用户。 Group Leaders 可以将现有用户添加到他们的分组中。现有用户会被自动添加（即无需接受任何邀请）。 如果站点管理员启用了名为“Allow group leaders to edit...

ransomware_map

Orange Cyberdefense CERT - Ransomware Ecosystem Map Latest = version 29 January 2026 - incoming Map visualizing relationships and timelines associated to +300 ransomware groups, between 2015 and 2026. Hope this helps! World Watch team - Global CERT Orange Cyberdefense All rights reserved...