CVE-2026-42533

CVE-2026-42533 — nginx Heap Buffer Overflow PoC Exploit Exécution de code à distance sans authentification via écrasement de capture en deux passes PoC public publié le 2026-07-27 — N'attendez pas, corrigez maintenant. | ---|--- CVE| CVE-2026-42533 CVSS 4.0| 9.2 Critique Type| Dépassement de tas...

sslscan

sslscan2 La version 2 de sslscan est maintenant publiée. Elle inclut une réécriture majeure du code de scan back-end, ce qui signifie qu'elle ne dépend plus de la version d'OpenSSL pour de nombreux contrôles. Il est ainsi possible de supporter les protocoles anciens SSLv2 et SSLv3, ainsi que...

ThreatActors-TTPs

REMARQUE : Ceci est un fork de Crocodyli - Tout ce que je fais, c'est ajouter des éléments pour mes propres besoins. Je l'utilise pour alimenter les pages gapMATRIX sur https://incidentbuddy.ai ACTEURS DE MENACE ET RANSOMWARES - TTPs Ce dépôt a été créé dans le but d'aider les entreprises et les...

autovpn

!CAUTION This repository is no longer being maintained. No further updates, bug fixes, or support will be provided. Please use the new version https://github.com/ttlequals0/autowire Overview Script that allows the easy creation of OpenVPN endpoints in any AWS region. To create a VPN endpoint is...

awesome-threat-intelligence

awesome-threat-intelligence Курируемый список лучших ресурсов по Threat Intelligence Краткое определение Threat Intelligence: обоснованные знания, включая контекст, механизмы, индикаторы, последствия и практические рекомендации, о существующей или возникающей угрозе или опасности для активов,...

Windows-Privilege-Escalation-Notes

Повышение привилегий в Windows Предпочтительная комната: https://tryhackme.com/room/windows10privesc, но вы можете использовать что угодно на ваш выбор. Некоторые ресурсы, https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/...

CVE-2023-2825-Gitlab

CVE-2023-2825 Le 23 mai 2023, GitLab a publié la version 16.0.1 qui corrige une vulnérabilité critique, CVE-2023-2825, affectant les éditions Community CE et Enterprise EE version 16.0.0. Cette vulnérabilité permet à des utilisateurs non authentifiés de lire des fichiers arbitraires via un bogue ...

stride-gpt

STRIDE GPT is an AI-powered threat modelling tool that leverages Large Language Models LLMs to generate threat models and attack trees for a given application based on the STRIDE methodology. Users provide application details, such as the application type, authentication methods, and whether the...

CyberThreatIntel

CyberThreatIntel Анализ вредоносного ПО и киберразведка APT-групп и киберпреступников Сводка 2020-01-20 - Transparent Tribe APT 2020-01-03 - MAAS Terraloader 2019-12-28 - SideWinder: те же цели, те же TTPs, пора контратаковать! 2019-11-18 - APT33 продолжает нацеливаться на компании США 2019-11-12...

ransomware_map

Orange Cyberdefense CERT - Карта экосистемы программ-вымогателей Последняя версия = 29 январь 2026 - ожидается Карта, визуализирующая взаимосвязи и хронологию, связанные с более чем 300 группами программ-вымогателей, за период с 2015 по 2026 год. Надеемся, это поможет! Команда World Watch - Globa...

stegowiper

stegoWiper: A powerful and flexible active attack for disrupting stegomalware Over the last 10 years, many threat groups have employed stegomalware or other steganography-based techniques to attack organizations from all sectors and in all regions of the world. Some examples are: APT15/Vixen Pand...

pacbot

Introduction Policy as Code Bot PacBot is a platform for continuous compliance monitoring, compliance reporting and security automation for the cloud. In PacBot, security and compliance policies are implemented as code. All resources discovered by PacBot are evaluated against these policies to...

boofuzz

.. image:: https://github.com/jtpereyda/boofuzz/raw/master/artwork/boo-logo-dark.svg :width: 60% :alt: boofuzz logo boofuzz: Network Protocol Fuzzing for Humans .. image:: https://github.com/jtpereyda/boofuzz/actions/workflows/test.yml/badge.svg?branch=master :target:...

Apache NiFi - Information Disclosure

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

attack-stix-data

ATT&CK® STIX Data MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and ...

BadBlood

BadBlood BadBlood by Secframe fills a Microsoft Active Directory Domain with a structure and thousands of objects. The output of the tool is a domain similar to a domain in the real world. After BadBlood is ran on a domain, security analysts and engineers can practice using tools to gain an...

SharpPrivesc

SharpPrivesc Практикую C и собираю поверхности атак Privesc вместе. Пока что любительские вещи. Проверки Privesc и тому подобное. Я предпочел классы разбора командной строки от Spectreops, поэтому решил использовать их вместо других .net пакетов, таких как command line parser и т.д. Список дел:...

BLACKHAT_Asia2023

BLACKHATAsia2023 Просто о публичных PDF BLACKHAT USA2022 Список файлов, ищите то, что вам интересно. BLACKHATAsia2023 ├── AS-23-Babkin-firmWar-An-Imminent-Threat-to-the-Foundation-of-Computing.pdf ├── AS-23-Bai-Stealthy-Sensitive-Information-Collection-from-Android-Apps.pdf ├──...

EUVD-2026-91790

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

automato

automato.rb automato uses native LDAP libraries to automate the collection and enumeration of various directory objects. This is incredibly useful during an internal penetration test. automato can also conduct password spraying attacks, and identify if a user is a local administrator against any...