Reticulum

Reticulum Network Stack Este repositorio esun espejo público. Todo el desarrollo se realiza en otro lugar. Para entender la filosofía fundacional y los objetivos de este sistema, lea el Zen de Reticulum. Reticulum es la pila de red basada en criptografía para construir redes locales y de área...

Stowaway

Stowaway English Stowaway es una herramienta de proxy multinivel escrita en Go, diseñada específicamente para profesionales de pruebas de penetración. Los usuarios pueden usar este programa para enrutar el tráfico externo a través de múltiples nodos hacia la red interna, superar las restricciones...

routopsy

routopsy Routopsy is a toolkit built to attack often overlooked networking protocols. Routopsy currently supports attacks against Dynamic Routing Protocols DRP and First-Hop Redundancy Protocols FHRP. Most of the attacks currently implemented make use of a weaponised 'virtual router' as opposed t...

routopsy

routopsy Routopsy 是一个专门用于攻击常被忽视的网络协议的工具包。目前，Routopsy 支持针对动态路由协议DRP和第一跳冗余协议FHRP的攻击。已实现的多数攻击利用了武器化的“虚拟路由器”，而非从头实现协议。该工具不仅限于虚拟路由器，还允许通过添加额外的容器或在 python3 中实现更多攻击。 有关使用方法的更多信息，请参阅维基百科 @ https://github.com/sensepost/routopsy/wiki...

MeshCore

关于 MeshCore MeshCore 是一个轻量级、可移植的 C++ 库，支持使用 LoRa 和其他数据包无线电的嵌入式项目实现多跳数据包路由。专为希望创建无需互联网即可运行、具有弹性的去中心化通信网络的开发者而设计。 🔍 什么是 MeshCore？ MeshCore 现在支持多种 LoRa 设备，无需手动编译固件即可轻松刷写。用户可以使用 Adafruit ESPTool 等工具刷写预构建的二进制文件，并通过串口控制台与网络进行交互。 MeshCore 能够创建无线 Mesh 网络，与 Meshtastic 和 Reticulum...

email-header-analyzer

电子邮件头分析器 MHA 什么是电子邮件头分析器 MHA： 电子邮件头分析器是一款基于 Flask 编写的工具，用于解析电子邮件头并将其转换为人类可读的格式，此外它还可以： 识别跳转延迟。 识别电子邮件的来源。 识别跳转所在国家。 MHA 是以下工具的替代方案： 名称| 开发者| 问题 ---|---|--- MessageHeader| Google| 未显示所有跳转。 EmailHeaders| Mxtoolbox| 不准确且速度慢。 Message Header Analyzer| Microsoft| 界面损坏。 安装 安装系统依赖： root@kitploit: sudo...

IMDShift

IMDShift 依赖元数据端点的AWS工作负载容易受到服务器端请求伪造（SSRF）攻击。IMDShift可以自动化将所有工作负载迁移到IMDSv2，具备广泛的功能，实现了增强的安全措施以防御这些攻击。 特性 检测依赖元数据端点的AWS工作负载，涵盖多种服务，包括：EC2、ECS、EKS、Lightsail、AutoScaling Groups、Sagemaker Notebooks、Beanstalk（进行中） 简单直观的命令行界面，便于使用 自动将所有工作负载迁移到IMDSv2 对兼容资源进行独立的跃点限制更新 对兼容资源进行独立的元数据端点启用操作 迁移过程的详细日志记录...

Venom

Venom - A Multi-hop Proxy for Penetration Testers 简体中文 ｜ English Venom是一款为渗透测试人员设计的使用Go开发的多级代理工具。 Venom可将多个节点进行连接，然后以节点为跳板，构建多级代理。 渗透测试人员可以使用Venom轻松地将网络流量代理到多层内网，并轻松地管理代理节点。 此工具仅限于安全研究和教学，用户承担因使用此工具而导致的所有法律和相关责任！ 作者不承担任何法律和相关责任！ 特性 可视化网络拓扑 多级socks5代理 多级端口转发 端口复用 apache/mysql/... ssh隧道 交互式shell...

GHSA-FQ95-V8XC-JM3V Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Affected: github.com/fabiolb/fabio = 1.6.6 through 1.7.1 and master HEAD c75f8a6. Summary The v1.6.6 fix for CVE-2025-48865 sweeps the client Connection header against a hardcoded allowlist protectHeaders proxy/httpheaders.go:28-36 containing only the 7 X-Forwarded family headers. Fabio also...

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Affected: github.com/fabiolb/fabio = 1.6.6 through 1.7.1 and master HEAD c75f8a6. Summary The v1.6.6 fix for CVE-2025-48865 sweeps the client Connection header against a hardcoded allowlist protectHeaders proxy/httpheaders.go:28-36 containing only the 7 X-Forwarded family headers. Fabio also...

doublehop

Doublehop 该工具旨在通过 WinRM 双跳技术，协助利用 PowerShell Remoting / WinRM 在远程主机上执行 PowerShell 命令。 该工具假定您拥有内部网络和 CLI 访问权限。 用法 root@kitploit: doublehop Usage: -c string 要执行的命令。 -j string 我们对其执行命令的目标主机。 -l string 起始跳转主机。 -m string 添加主机，以逗号分隔。格式：'host1,host2' -p string 用户密码 -u string 格式：'DOMAIN\USER'，用于身份验证的用户。 ...

CVE-2022-45059-demo

CVE-2022-45059-demo Las versiones 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.1.0, 7.1.1 y 7.2.0 de Varnish Cache tienen una vulnerabilidad de contrabando de solicitudes donde un atacante puede solicitar que el encabezado content-length se convierta en hop-by-hop. Esta es una demostración que consiste en una...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fixed soft lockups in fib6selectpath under high next hop changes. Soft lockups were observed on a cluster of Linux-based edge routers located in a highly dynamic environment. Using the bird service, these routers continuous...

Astra Linux – Vulnerability in Apache2

Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on the client-side Connection header hop-by-hop mechanism. This could be used to bypass IP-based authentication on the origin server/application...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: httpd (UTSA-2023-003819)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003819 advisory. Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded- headers to the origin server based on client side Connection header hop-by-hop mechanism. This ma...

NPM: fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

NPM: fastify vulnerable to X-Forwarded- spoofing under trustProxy hop-count vulnerability discovered by ? in WordPress Npm fastify versions = 5.8.3, 5.12.1...

fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Impact The fix for CVE-2026-3635 GHSA-444r-cwp2-x5xf added a proxyFnsocket.remoteAddress, 0 guard on the X-Forwarded- reads in request.host, request.protocol, request.hostname, request.ip, and request.ips. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly because...

GHSA-3M5P-2C4R-XXW2 fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count

Impact The fix for CVE-2026-3635 GHSA-444r-cwp2-x5xf added a proxyFnsocket.remoteAddress, 0 guard on the X-Forwarded- reads in request.host, request.protocol, request.hostname, request.ip, and request.ips. That guard closes the IP, CIDR, and custom-function forms of trustProxy correctly because...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Net: Marvell: Pestera: Fixed handling of IPv4 routes with nhid. Fixed the handling of IPv4 routes that reference a nexthop via its id by replacing calls to fibinfonh with fibinfonhc. When attempting to add an IPv4 route that...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, pinot-fips, tez, apache-hop-fips, trino, hadoop-fips, seata, thingsboard, management-api-for-apache-cassandra-4.0, tinkerpop, management-api-for-apache-cassandra-5.0, pinot, celeborn...